| elastic |
Entra ID User Sign-in Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Multiple SonicWall Login Failures Followed by Successful Login |
production |
2026-09-18 |
| elastic |
Okta Successful Login After Credential Attack |
production |
2026-09-18 |
| elastic |
Potential Okta Credential Stuffing (Single Source) |
production |
2026-09-18 |
| elastic |
Multiple Okta User Authentication Events with Same Device Token Hash |
production |
2026-09-18 |
| elastic |
Multiple Okta User Auth Events with Same Device Token Hash Behind a Proxy |
production |
2026-09-18 |
| elastic |
M365 Identity User Account Lockouts |
production |
2026-09-18 |
| elastic |
M365 Identity User Brute Force Attempted |
production |
2026-09-18 |
| elastic |
Entra ID Sign-in Brute Force Attempted (Microsoft 365) |
production |
2026-09-18 |
| elastic |
Entra ID Excessive Account Lockouts Detected |
production |
2026-09-18 |
| splunk |
CrushFTP Max Simultaneous Users From IP |
production |
2026-09-08 |
| splunk |
Windows Local Administrator Credential Stuffing |
production |
2026-05-13 |
| splunk |
O365 Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
O365 Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
GCP Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
GCP Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
Azure AD Multi-Source Failed Authentications Spike |
production |
2026-05-13 |
| splunk |
AWS Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
AWS Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
AWS High Number Of Failed Authentications From Ip |
production |
2026-05-13 |