| elastic |
Entra ID Application Credential Modified |
production |
2026-10-19 |
| elastic |
Entra ID Service Principal Credentials Created by Unusual User |
production |
2026-10-19 |
| elastic |
Entra ID Federated Identity Credential Modified |
production |
2026-10-01 |
| elastic |
Anthropic Compliance API Key Created |
production |
2026-09-25 |
| elastic |
AWS IAM Credentials Added to a Bedrock API Key Phantom User |
production |
2026-09-25 |
| elastic |
Anthropic Admin API Key Created |
production |
2026-09-25 |
| elastic |
Google Workspace Object Copied from External Drive with App Consent |
production |
2026-09-24 |
| elastic |
AWS RDS DB Instance or Cluster Password Modified |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
Entra ID Sharepoint or OneDrive Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID Service Principal Federated Credential Authentication by Unusual Client |
production |
2026-09-18 |
| elastic |
Entra ID Windows Hello for Business Credential Registered |
production |
2026-09-18 |
| elastic |
Entra ID Domain Federation Configuration Change |
production |
2026-09-18 |
| elastic |
GCP Service Account Key Creation |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
Application Added to Google Workspace Domain |
production |
2026-09-18 |
| elastic |
Attempt to Create Okta API Token |
production |
2026-09-18 |
| elastic |
Azure Storage Account Key Regenerated |
production |
2026-09-18 |
| elastic |
AWS First Occurrence of STS GetFederationToken Request by User |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Added for Root |
production |
2026-09-18 |
| elastic |
AWS IAM Login Profile Created or Modified for an IAM User |
production |
2026-09-18 |
| elastic |
AWS IAM SAML Provider Created |
production |
2026-09-18 |
| elastic |
AWS IAM User Created Access Keys For Another User |
production |
2026-09-18 |
| elastic |
AWS IAM User Self-Created Access Key Subsequently Used |
production |
2026-09-18 |
| sigma |
Added Credentials to Existing Application |
test |
2026-08-20 |
| splunk |
O365 Service Principal New Client Credentials |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal New Client Credentials |
production |
2026-05-13 |
| sigma |
Okta Identity Provider Created |
test |
2026-04-27 |
| sigma |
Github Outside Collaborator Detected |
test |
2023-01-20 |