Navigation section
ip logs
About this tag
Discussions tagged with 'ip logs' on WindowsForum.com focus on analyzing IP addresses in server logs to detect potential security threats. Users examine event IDs like 4624 (successful logins) and use tools such as QRadar and IP quality scoring to identify suspicious external connections. A recurring theme is evaluating whether IPs from Microsoft datacenters are legitimate or fraudulent, especially when they appear in Exchange server logs. The tag covers practical troubleshooting of log entries, assessing fraud scores, and distinguishing between false positives and genuine attacks in enterprise environments.
-
K
Fraudulent IP connections to my exchange server? False positive or?
Hello dear friends. I wanted to ask you about some logs that from my exchange server which i catch with qradar. They are all with qid: 5000830 or eventid:4624 which is a successful login to a server or anything. I use a rule which tells me if someone logs in to the exchange server from an...- kingslavcho
- Thread
- cybersecurity data security event id exchange server external access false positives firewall fraudulent ip ip logs ip quality score isp tracking login events microsoft network security password management qradar security audits security rules user management
- Replies: 3
- Forum: Windows Security