New detection type: check logins against threatlist

[ManofWax]

This new detection should be a new celery task scheduled independently on celery_beat config.

Successful login from a blocklisted IP

This task should load a file containing IOC and match them against the source_ip of the login. The login should be successful (I.E: event.outcome: sucess)

→ Please, before starting, read the CONTRIBUTING file

[drona-gyawali]

Hi @ManofWax, I noticed that this issue is still open, and I’d love to work on it.

[kunalsz]

Hi @Lorygold @ManofWax I would like to work on this issue.

Implementation Steps:-

• A celery task that runs on a schedule (independently via celery_beat).
• It will load a file containing blocklisted IP addresses (Indicators of Compromise - IOCs).
• It will check recent successful logins (event.outcome: success) against this blocklist.
• If a match is found, generate an alert.

I'll generate a draft PR soon enough.

[Lorygold]

@drona-gyawali please remove the link to your PR, that assignment is made by me or @ManofWax.
Please, be more respectful with the flow of the project.
Make sure you have read the CONTRIBUTING file

[ManofWax]

Sorry I'm closing this Issue for now because i bigger refactory is needed. I will reopen it when we are ready