| sentinel |
User account created without expected attributes defined |
Scheduled |
— |
| sentinel |
NRT First access credential added to Application or Service Principal where no credential was present |
NRT |
— |
| sentinel |
Microsoft Entra ID Hybrid Health AD FS New Server |
— |
— |
| sentinel |
Microsoft Entra ID Hybrid Health AD FS Service Delete |
— |
— |
| sentinel |
Microsoft Entra ID Hybrid Health AD FS Suspicious Application |
— |
— |
| sentinel |
Azure Diagnostic settings removed from a resource |
Scheduled |
— |
| sentinel |
Suspicious number of resource creation or deployment activities |
— |
— |
| sentinel |
Creation of expensive computes in Azure |
— |
— |
| sentinel |
Suspicious granting of permissions to an account |
— |
— |
| sentinel |
NRT Microsoft Entra ID Hybrid Health AD FS New Server |
— |
— |
| sentinel |
External User Access Enabled |
Scheduled |
— |
| sentinel |
NRT Creation of expensive computes in Azure |
— |
— |
| sentinel |
New CloudShell User |
— |
— |
| sentinel |
Suspicious Resource deployment |
— |
— |
| sentinel |
Rare subscription-level operations in Azure |
— |
— |
| sentinel |
Mass Cloud resource deletions Time Series Anomaly |
— |
— |
| sentinel |
AppServices AV Scan Failure |
Scheduled |
— |
| sentinel |
AppServices AV Scan with Infected Files |
Scheduled |
— |
| sentinel |
Azure DevOps Agent Pool Created Then Deleted |
— |
— |
| sentinel |
Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
Azure DevOps New Extension Added |
— |
— |
| sentinel |
Azure DevOps PAT used with Browser. |
— |
— |
| sentinel |
Azure DevOps Pipeline modified by a new user. |
— |
— |
| sentinel |
Azure DevOps Retention Reduced |
— |
— |
| sentinel |
Azure DevOps Variable Secret Not Secured |
— |
— |
| sentinel |
Azure DevOps Build Variable Modified by New User. |
— |
— |
| sentinel |
Azure DevOps Administrator Group Monitoring |
— |
— |
| sentinel |
Azure DevOps Pull Request Policy Bypassing - Historic allow list |
— |
— |
| sentinel |
Azure DevOps Service Connection Addition/Abuse - Historic allow list |
— |
— |
| sentinel |
Azure DevOps Personal Access Token (PAT) misuse |
— |
— |
| sentinel |
Azure DevOps Pipeline Created and Deleted on the Same Day |
— |
— |
| sentinel |
Azure DevOps Service Connection Abuse |
— |
— |
| sentinel |
External Upstream Source Added to Azure DevOps Feed |
— |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
New PA, PCA, or PCAS added to Azure DevOps |
— |
— |
| sentinel |
Azure WAF matching for Log4j vuln(CVE-2021-44228) |
— |
— |
| sentinel |
Sensitive Azure Key Vault operations |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |