| elastic |
OpenAI ChatGPT Enterprise Workspace Log Files Accessed |
production |
2026-10-09 |
| elastic |
GCP Vertex AI High GenerateContent Volume From Single IP |
production |
2026-10-02 |
| elastic |
Anthropic Compliance Audit Log Export Accessed |
production |
2026-09-25 |
| elastic |
Anthropic Organization Data Export Accessed |
production |
2026-09-25 |
| splunk |
AWS Repeated CloudWatch Logs Read Operations |
production |
2026-09-21 |
| elastic |
Azure Storage Blob Retrieval via AzCopy |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Enumeration or Brute Force |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Updated |
production |
2026-09-18 |
| elastic |
Azure Storage Account Blob Public Access Enabled |
production |
2026-09-18 |
| elastic |
Azure Storage Anonymous Blob Access to Unusual Resource |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Subscription Creation |
production |
2026-09-18 |
| elastic |
GCP Pub/Sub Topic Creation |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User |
production |
2026-09-18 |
| elastic |
Kubernetes Secret or ConfigMap Access via Azure Arc Proxy |
production |
2026-09-18 |
| elastic |
M365 OneDrive/SharePoint Excessive File Downloads |
production |
2026-09-18 |
| elastic |
M365 SharePoint/OneDrive File Access via PowerShell |
production |
2026-09-18 |
| elastic |
M365 SharePoint Search for Sensitive Content |
production |
2026-09-18 |
| elastic |
AzCopy or Azure Storage Explorer Usage on Unusual Host |
production |
2026-09-18 |
| elastic |
AWS CloudTrail Log Created |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket ACL Modified to Allow Public Access by New Identity |
production |
2026-09-18 |
| elastic |
AWS S3 Unauthenticated Bucket Access by Rare Source |
production |
2026-09-18 |
| elastic |
AWS S3 Credential File Retrieved from Bucket |
production |
2026-09-18 |
| elastic |
AWS S3 Rapid Bucket Posture API Calls from a Single Principal |
production |
2026-09-18 |
| elastic |
AWS DynamoDB Scan by Unusual User |
production |
2026-09-18 |
| elastic |
AWS EC2 Export Task |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Share with External Account |
production |
2026-09-18 |
| elastic |
AWS S3 Bucket Policy Added to Allow Public Access |
production |
2026-09-18 |
| elastic |
AWS API Activity from Uncommon S3 Client by Rare User |
production |
2026-09-18 |
| elastic |
AWS SNS Rare Protocol Subscription by User |
production |
2026-09-18 |
| elastic |
Potential Third-Party Cloud Storage Client Execution |
production |
2026-09-14 |
| splunk |
O365 Exfiltration via File Download |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Sync Download |
production |
2026-05-13 |
| splunk |
Detect GCP Storage access from a new IP |
experimental |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy Activity |
production |
2026-05-13 |
| splunk |
O365 Exfiltration via File Access |
production |
2026-05-13 |
| splunk |
Detect Spike in S3 Bucket deletion |
experimental |
2026-05-13 |
| splunk |
Detect S3 access from a new IP |
experimental |
2026-05-13 |
| splunk |
Detect New Open S3 buckets |
production |
2026-05-13 |
| splunk |
Detect New Open S3 Buckets over AWS CLI |
production |
2026-05-13 |
| splunk |
Detect New Open GCP Storage Buckets |
experimental |
2026-05-13 |
| sentinel |
Users searching for VIP user activity |
Scheduled |
— |