| elastic |
OpenAI ChatGPT Enterprise Unusual Codex Plugin Installed |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Google Drive Download Burst |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Slack Query Burst |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Suspicious Gmail Discovery |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise High Codex MCP Tool Diversity |
production |
2026-10-09 |
| elastic |
OpenAI ChatGPT Enterprise Google Drive Sensitive Query Burst |
production |
2026-10-09 |
| elastic |
Access to a Sensitive LDAP Attribute |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Unusual MCP App Activity |
production |
2026-10-06 |
| elastic |
OpenAI ChatGPT Enterprise Unusual Codex MCP Tool Call |
production |
2026-10-06 |
| elastic |
GitHub Exfiltration via High Number of Repository Clones by User |
production |
2026-09-18 |
| elastic |
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy |
production |
2026-09-18 |
| elastic |
M365 SharePoint/OneDrive File Access via PowerShell |
production |
2026-09-18 |
| elastic |
M365 SharePoint Search for Sensitive Content |
production |
2026-09-18 |
| elastic |
Potential Database Dumping Activity |
production |
2026-09-18 |
| elastic |
First Time Seen NFS AUTH_SYS Root UID Access |
production |
2026-09-18 |
| elastic |
PowerShell Script with Veeam Credential Access Capabilities |
production |
2026-09-18 |
| elastic |
Potential Veeam Credential Access Command |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |
| elastic |
Potential Secret Scanning via Gitleaks |
production |
2026-09-18 |
| elastic |
AWS Secrets Manager Rapid Secrets Retrieval |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Table Exported to S3 |
production |
2026-09-18 |
| elastic |
AWS RDS Snapshot Export |
production |
2026-09-18 |
| elastic |
Entra ID Sharepoint or OneDrive Accessed by Unusual Client |
production |
2026-09-18 |
| elastic |
Azure Key Vault Excessive Secret or Key Retrieved |
production |
2026-09-18 |
| elastic |
High Number of Cloned GitHub Repos From PAT |
production |
2026-09-18 |
| sigma |
OpenCanary - MSSQL Login Attempt Via SQLAuth |
test |
2024-03-08 |
| sigma |
OpenCanary - GIT Clone Request |
test |
2024-03-08 |
| sigma |
OpenCanary - REDIS Action Command Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - MySQL Login Attempt |
test |
2024-03-08 |
| sigma |
OpenCanary - MSSQL Login Attempt Via Windows Authentication |
test |
2024-03-08 |
| sigma |
Bitbucket User Permissions Export Attempt |
test |
2024-02-25 |
| sigma |
Bitbucket User Details Export Attempt Detected |
test |
2024-02-25 |
| sentinel |
Users searching for VIP user activity |
Scheduled |
— |