ARO: VPN Authentication Detected

Due to the high false positive rate with VPN use (a lot of users use commodity VPNs on a regular basis), Field Effect releases this ARO as an 'Observation' and asks you to confirm whether you expect the identified user to use this service. 

If the user does use a commodity VPN and your organization's policy accepts it, you should 'dismiss' these AROs and Field Effect will suppress future reporting of this activity for this user. 

If the behavior is unexpected, you should 'resolve' the ARO after applying the mitigation measures highlighted in the ARO. Field Effect will then only issue future AROs if it detects the same activity again.

VPN use on its own doesn't necessarily indicate a compromise, which is why Field Effect issued the ARO with a lower severity. However, when other indicators of suspicious activity are present, the likelihood of a compromise increases, and Field Effect issues a higher priority 'Action' ARO. 

Lastly, Field Effect does have the ability to isolate hosts and lockout cloud accounts in the event of a breach, however if this setting is disabled, Field Effect will not take action. 

If you'd like to learn more about, you can read more in our guides: 

• Active Response
• Response Policies for Cloud Accounts