---
title: "Discussion on \"Tuning Sentinel Analytic Rules: Malicious IP Signon Attempt\" | Hashnode"
description: "Discussion on \"Tuning Sentinel Analytic Rules: Malicious IP Signon Attempt\". Today’s analytic rule had be second guessing myself. For starters, I believe this was a custom rule slapped together by one of the junior analyst. The rule logic is as follows:\nSigninLogs\n| where ResultsDescription contains \"Sign-in was blocked becau..."
url: "https://hashnode.com/posts/tuning-sentinel-analytic-rules-malicious-ip-signon-attempt/68c8dd26426f31f128be0deb"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Tuning Sentinel Analytic Rules: Malicious IP Signon Attempt](https://eddie-pena.com/tuning-sentinel-analytic-rules-malicious-ip-signon-attempt?utm_source=hashnode&utm_medium=feed)

Today’s analytic rule had be second guessing myself. For starters, I believe this was a custom rule slapped together by one of the junior analyst. The rule logic is as follows: SigninLogs | where ResultsDescription contains "Sign-in was blocked becau...

Sep 16, 2025 · 3 min read · eddie-pena.com  
Read the article

## Written by

[Edward Pena](https://hashnode.com/@Cryptosrage)

@Cryptosrage

  
[View profile](https://hashnode.com/@Cryptosrage)

Security Engineer by day, Security Researcher by night

## Responses

Markdown supported · ⌘↵ to post

No responses yet.