| elastic |
Kubernetes Secrets List Across Cluster or Sensitive Namespaces |
production |
2026-09-18 |
| elastic |
Kubernetes Service Account Token Created via TokenRequest API |
production |
2026-09-18 |
| elastic |
Kubernetes Events Deleted |
production |
2026-09-18 |
| elastic |
Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected |
production |
2026-09-18 |
| elastic |
Kubernetes Potential Endpoint Permission Enumeration Attempt Detected |
production |
2026-09-18 |
| elastic |
Kubernetes Multi-Resource Discovery |
production |
2026-09-18 |
| elastic |
Kubernetes Suspicious Self-Subject Review via Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Anonymous User Create/Update/Patch Pods Request |
production |
2026-09-18 |
| elastic |
Kubernetes Forbidden Creation Request |
production |
2026-09-18 |
| elastic |
Kubernetes Forbidden Request from Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes User Exec into Pod |
production |
2026-09-18 |
| elastic |
Kubernetes CoreDNS or Kube-DNS Configuration Modified |
production |
2026-09-18 |
| elastic |
Kubernetes Anonymous Request Authorized by Unusual User Agent |
production |
2026-09-18 |
| elastic |
Kubernetes Cluster-Admin Role Binding Created |
production |
2026-09-18 |
| elastic |
Kubernetes Exposed Service Created With Type NodePort |
production |
2026-09-18 |
| elastic |
Kubernetes Admission Webhook Created or Modified |
production |
2026-09-18 |
| elastic |
Kubernetes Client Certificate Signing Request Created or Approved |
production |
2026-09-18 |
| elastic |
EKS Authentication Configuration Modified |
production |
2026-09-18 |
| elastic |
Kubernetes Creation or Modification of Sensitive Role |
production |
2026-09-18 |
| elastic |
Kubernetes Creation of a RoleBinding Referencing a ServiceAccount |
production |
2026-09-18 |
| elastic |
Kubernetes API Server Proxying Request to Kubelet |
production |
2026-09-18 |
| elastic |
Kubernetes Container Created with Excessive Linux Capabilities |
production |
2026-09-18 |
| elastic |
M365 Teams Custom Application Interaction Enabled |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Teams External Access Enabled |
production |
2026-09-18 |
| elastic |
M365 SharePoint Search for Sensitive Content |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Created |
production |
2026-09-18 |
| elastic |
M365 Exchange Mail Flow Transport Rule Modified |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance Potential Ransomware Activity |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance Unusual Volume of File Deletion |
production |
2026-09-18 |
| elastic |
M365 Identity Login from Atypical Region |
production |
2026-09-18 |
| elastic |
M365 Identity Login from Impossible Travel Location |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Illicit Consent Grant by Rare Client and User |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant with Unusual User and ASN |
production |
2026-09-18 |
| elastic |
M365 Identity Device Code Grant by an Unusual User (Non-Compliant Device) |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth Phishing via First-Party Microsoft Application |
production |
2026-09-18 |
| elastic |
M365 Identity OAuth ROPC Grant via Legacy Authentication Client |
production |
2026-09-18 |
| elastic |
M365 Identity Unusual SSO Authentication Errors for User |
production |
2026-09-18 |
| elastic |
Deprecated - M365 Security Compliance User Restricted from Sending Email |
production |
2026-09-18 |
| elastic |
M365 Teams Rogue Help Desk Chat Created |
production |
2026-09-18 |
| elastic |
M365 Potential AiTM UserLoggedIn via Office App (Tycoon2FA) |
production |
2026-09-18 |