IAM Event - Multiple Login Connections From Different IP Addresses

EVENT

Multiple Login Connections From Different IP Addresses.

RECOMMENDED ACTION

This event provides the ability to observe application logins for a single application, which can commonly occur from multiple IP Addresses because of connections from multiple devices.  Two devices should be expected and are common (computer, phone), three or more may be a cause for investigation.

ALERT TYPE

Logged Event