| splunk |
AWS CreateAccessKey |
production |
2026-10-19 |
| elastic |
OpenAI ChatGPT Enterprise User Invite Sent |
production |
2026-10-09 |
| elastic |
Anthropic Organization User Invite Sent |
production |
2026-09-25 |
| elastic |
Entra ID Service Principal Created |
production |
2026-09-18 |
| elastic |
AWS IAM Create User via Assumed Role on EC2 Instance |
production |
2026-09-18 |
| elastic |
AWS IAM Group Creation |
production |
2026-09-18 |
| elastic |
AWS Sensitive IAM Operations Performed via CloudShell |
production |
2026-09-18 |
| elastic |
AWS IAM Sensitive Operations via Lambda Execution Role |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
Entra ID External Guest User Invited |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
GCP Service Account Creation |
production |
2026-09-18 |
| splunk |
O365 Added Service Principal |
production |
2026-05-13 |
| splunk |
O365 External Guest User Invited |
production |
2026-05-13 |
| splunk |
O365 External Identity Policy Changed |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by SP |
production |
2026-05-13 |
| splunk |
O365 New Federated Domain Added |
production |
2026-05-13 |
| splunk |
O365 SharePoint Allowed Domains Policy Changed |
production |
2026-05-13 |
| splunk |
Windows Azure PowerShell Module Installation Via PowerShell Script |
production |
2026-05-13 |
| splunk |
O365 Multiple Service Principals Created by User |
production |
2026-05-13 |
| splunk |
ASL AWS Create Access Key |
production |
2026-05-13 |
| splunk |
ASL AWS UpdateLoginProfile |
production |
2026-05-13 |
| splunk |
AWS CreateLoginProfile |
production |
2026-05-13 |
| splunk |
AWS UpdateLoginProfile |
production |
2026-05-13 |
| splunk |
Azure AD External Guest User Invited |
production |
2026-05-13 |
| splunk |
Azure AD Multiple Service Principals Created by SP |
production |
2026-05-13 |
| splunk |
Azure AD Multiple Service Principals Created by User |
production |
2026-05-13 |
| splunk |
Azure AD Service Principal Created |
production |
2026-05-13 |
| splunk |
Azure Automation Account Created |
production |
2026-05-13 |
| splunk |
Azure Automation Runbook Created |
production |
2026-05-13 |
| splunk |
O365 Add App Role Assignment Grant User |
production |
2026-05-13 |
| elastic |
Deprecated - AWS RDS Security Group Creation |
deprecated |
2026-01-16 |
| sigma |
New Github Organization Member Added |
test |
2023-01-29 |
| sigma |
AWS ElastiCache Security Group Created |
test |
2022-10-09 |
| sigma |
New Federated Domain Added - Exchange |
test |
2022-02-08 |
| sentinel |
User Account Created Using Incorrect Naming Format |
Scheduled |
— |
| sentinel |
Account created from non-approved sources |
Scheduled |
— |
| sentinel |
User account created without expected attributes defined |
Scheduled |
— |