Navigation section
ip quality score
About this tag
The ip quality score tag on WindowsForum.com covers discussions about using IP reputation services like IPQualityScore to evaluate the fraud risk of IP addresses, particularly in the context of Microsoft Exchange server security. Users share experiences with false positives when analyzing logs from QRadar, where external IPs from Microsoft datacenters show elevated fraud scores. The tag focuses on practical troubleshooting of suspicious login attempts, interpreting fraud scores, and distinguishing legitimate Microsoft traffic from potentially malicious connections. It is relevant for IT professionals managing Exchange servers and security monitoring.
-
K
Fraudulent IP connections to my exchange server? False positive or?
Hello dear friends. I wanted to ask you about some logs that from my exchange server which i catch with qradar. They are all with qid: 5000830 or eventid:4624 which is a successful login to a server or anything. I use a rule which tells me if someone logs in to the exchange server from an...- kingslavcho
- Thread
- cybersecurity data security event id exchange server external access false positives firewall fraudulent ip ip logs ip quality score isp tracking login events microsoft network security password management qradar security audits security rules user management
- Replies: 3
- Forum: Windows Security