Suspicious Movement

Description

Suspicious Movement policy monitors changes in users geographical location. When the speed (mph) of traveling between the original and the new location exceeds the maximum threshold, an alert will be generated to inform on the unidentified cloud account intrusion.

The policy also takes in account of the proximity distance of the new location before checking for the speed in which the user traveled.

In exception cases, known users can be excluded from being monitored by placing them on the IP allow list.

Policy Configuration

Follow the steps below to enable and configure the policy

1. Click on any Cloud Account drop down menu from FortiCASB dashboard, e.g. Salesforce, Office365, etc.
2. Click on Policy drop down menu and select Threat Protection.
3. Locate Suspicious Movement and click on the right arrow key > button to expand the policy.
4. Click On in Enabled to enable the policy.



5. Click on Severity level drop down menu to select the severity level (Critical, Alert, Warning, Information).
6. In Velocity Setting (mph), enter the maximum speed in which a user can travel between two locations in any given time before being viewed as suspicious movement. The most commonly used value for this parameter is commercial flight speed, 600 mph.
7. In Distance Tolerance (mile) field, enter a proximity distance that will not be accounted for in monitoring for suspicious movement.

For example, if you entered 50 miles, any login within 50 miles of the origin will not be taken as suspicious movement.

8. In IP Allow List, enter sets of IP ranges to be excluded from being monitored for suspicious movements. This is useful when you know the users who travel periodically.
9. Click Save Changes to update the configuration.

After the policy is enabled and configured, whenever the new user login location exceeded the maximum speed threshold, an alert will be sent on the illegal login, for more details, please refer to Alert.