admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v4.30.0
splunk-security_content/detections/cloud
T
History
Bhavin Patel 72e29c764f ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
detection testing fixes
2023-04-03 15:58:04 -05:00
abnormally_high_number_of_cloud_instances_destroyed.yml
merged with develop
2023-03-03 12:40:16 +01:00
abnormally_high_number_of_cloud_instances_launched.yml
merged with develop
2023-03-03 12:40:16 +01:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
merged with develop
2023-03-03 12:40:16 +01:00
amazon_eks_kubernetes_cluster_scan_detection.yml
merged with develop
2023-03-03 12:40:16 +01:00
amazon_eks_kubernetes_pod_scan_detection.yml
updated descriptions
2023-10-13 13:26:36 -07:00
asl_aws_concurrent_sessions_from_different_ips.yml
Release Branch : v4.28.0
2024-03-27 16:36:00 +00:00
asl_aws_createaccesskey.yml
missing asl
2023-06-22 16:32:04 -07:00
asl_aws_defense_evasion_delete_cloudtrail.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_defense_evasion_delete_cloudwatch_log_group.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_defense_evasion_impair_security_services.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_excessive_security_scanning.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_iam_delete_policy.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_multi_factor_authentication_disabled.yml
update ocsf
2023-06-13 11:06:53 -07:00
asl_aws_new_mfa_method_registered_for_user.yml
minor fix
2023-08-17 10:27:36 -07:00
asl_aws_password_policy_changes.yml
update ocsf
2023-06-13 11:06:53 -07:00
aws_ami_attribute_modification_for_exfiltration.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
aws_concurrent_sessions_from_different_ips.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
aws_console_login_failed_during_mfa_challenge.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_create_policy_version_to_allow_all_resources.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_createaccesskey.yml
mionr
2023-06-22 14:46:26 -07:00
aws_createloginprofile.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_credential_access_failed_login.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_credential_access_getpassworddata.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_credential_access_rds_password_reset.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
aws_cross_account_activity_from_previously_unseen_account.yml
fixing observables
2023-04-18 09:53:16 -07:00
aws_defense_evasion_delete_cloudtrail.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_defense_evasion_delete_cloudwatch_log_group.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_defense_evasion_impair_security_services.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_defense_evasion_putbucketlifecycle.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_defense_evasion_stop_logging_cloudtrail.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_defense_evasion_update_cloudtrail.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_attach_to_role_policy.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_permanent_key_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_role_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_sts_assume_role_abuse.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_sts_get_session_token_abuse.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_disable_bucket_versioning.yml
referenfce and test update
2023-05-17 15:05:01 -07:00
aws_ec2_snapshot_shared_externally.yml
updating risk
2023-05-04 16:21:32 -07:00
aws_ecr_container_scanning_findings_high.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
aws_ecr_container_scanning_findings_low_informational_unknown.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
aws_ecr_container_scanning_findings_medium.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
aws_ecr_container_upload_outside_business_hours.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
aws_ecr_container_upload_unknown_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_excessive_security_scanning.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
aws_exfiltration_via_anomalous_getobject_api_activity.yml
search text updates
2023-05-15 12:52:17 -07:00
aws_exfiltration_via_batch_service.yml
spl fix
2023-07-28 13:11:50 -05:00
aws_exfiltration_via_bucket_replication.yml
search text updates
2023-05-15 12:52:17 -07:00
aws_exfiltration_via_datasync_task.yml
referenfce and test update
2023-05-17 15:05:01 -07:00
aws_exfiltration_via_ec2_snapshot.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
aws_high_number_of_failed_authentications_for_user.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
aws_high_number_of_failed_authentications_from_ip.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_iam_accessdenied_discovery_events.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_iam_assume_role_policy_brute_force.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_iam_delete_policy.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
aws_iam_failure_group_deletion.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
aws_iam_successful_group_deletion.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_lambda_updatefunctioncode.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_multi_factor_authentication_disabled.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_multiple_failed_mfa_requests_for_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_multiple_users_failing_to_authenticate_from_ip.yml
Update aws_multiple_users_failing_to_authenticate_from_ip.yml
2023-04-18 14:15:23 -07:00
aws_network_access_control_list_created_with_all_open_ports.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
aws_network_access_control_list_deleted.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
aws_new_mfa_method_registered_for_user.yml
Fix notable typo user_name to user_arm
2023-08-18 12:52:55 -07:00
aws_password_policy_changes.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_s3_exfiltration_behavior_identified.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
aws_saml_access_by_provider_user_and_principal.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_saml_update_identity_provider.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_setdefaultpolicyversion.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
aws_successful_console_authentication_from_multiple_ips.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
aws_successful_single_factor_authentication.yml
merged with develop
2023-03-03 12:40:16 +01:00
aws_unusual_number_of_failed_authentications_from_ip.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
aws_updateloginprofile.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
azure_active_directory_high_risk_sign_in.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_admin_consent_bypassed_by_service_principal.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_application_administrator_role_assigned.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_authentication_failed_during_mfa_challenge.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_block_user_consent_for_risky_apps_disabled.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_concurrent_sessions_from_different_ips.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_device_code_authentication.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_external_guest_user_invited.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_fullaccessasapp_permission_assigned.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_global_administrator_role_assigned.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_high_number_of_failed_authentications_for_user.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_high_number_of_failed_authentications_from_ip.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_multi_factor_authentication_disabled.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_multi_source_failed_authentications_spike.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_multiple_appids_and_useragents_authentication_spike.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_multiple_denied_mfa_requests_for_user.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_multiple_failed_mfa_requests_for_user.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_multiple_service_principals_created_by_sp.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_multiple_service_principals_created_by_user.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_new_custom_domain_added.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_new_federated_domain_added.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_new_mfa_method_registered_for_user.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_new_mfa_method_registered.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_oauth_application_consent_granted_by_user.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_pim_role_assigned.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_pim_role_assignment_activated.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_privileged_authentication_administrator_role_assigned.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_privileged_graph_api_permission_assigned.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_privileged_role_assigned_to_service_principal.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_privileged_role_assigned.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_service_principal_authentication.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_service_principal_created.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_service_principal_new_client_credentials.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_service_principal_owner_added.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_successful_authentication_from_different_ips.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_successful_powershell_authentication.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_successful_single_factor_authentication.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_tenant_wide_admin_consent_granted.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
azure_ad_unusual_number_of_failed_authentications_from_ip.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_user_consent_blocked_for_risky_application.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
azure_ad_user_consent_denied_for_oauth_application.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_user_enabled_and_password_reset.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_ad_user_immutableid_attribute_updated.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_automation_account_created.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_automation_runbook_created.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
azure_runbook_webhook_created.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
circle_ci_disable_security_job.yml
Edit parsing
2023-09-29 12:11:01 -07:00
circle_ci_disable_security_step.yml
updated with proper format
2023-10-13 13:32:37 -07:00
cloud_api_calls_from_previously_unseen_user_roles.yml
updated with proper format
2023-10-13 13:32:37 -07:00
cloud_compute_instance_created_by_previously_unseen_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
cloud_compute_instance_created_in_previously_unused_region.yml
updated all yml, remove kc,nist,cis, updaated with 3.64.0 new content
2023-04-04 17:15:38 -05:00
cloud_compute_instance_created_with_previously_unseen_image.yml
updated descriptions
2023-10-13 13:26:36 -07:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
updated descriptions
2023-10-13 13:26:36 -07:00
cloud_instance_modified_by_previously_unseen_user.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
cloud_provisioning_activity_from_previously_unseen_city.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
cloud_provisioning_activity_from_previously_unseen_country.yml
manual test
2023-04-18 13:00:52 -07:00
cloud_provisioning_activity_from_previously_unseen_ip_address.yml
manual test
2023-04-18 13:00:52 -07:00
cloud_provisioning_activity_from_previously_unseen_region.yml
manual test
2023-04-18 13:00:52 -07:00
cloud_security_groups_modifications_by_user.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
detect_aws_console_login_by_new_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_aws_console_login_by_user_from_new_city.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_aws_console_login_by_user_from_new_country.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_aws_console_login_by_user_from_new_region.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_gcp_storage_access_from_a_new_ip.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
detect_new_open_gcp_storage_buckets.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_new_open_s3_buckets_over_aws_cli.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_new_open_s3_buckets.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_s3_access_from_a_new_ip.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_spike_in_aws_security_hub_alerts_for_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
detect_spike_in_s3_bucket_deletion.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_authentication_failed_during_mfa_challenge.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
gcp_detect_gcploit_framework.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_kubernetes_cluster_pod_scan_detection.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_multi_factor_authentication_disabled.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
gcp_multiple_failed_mfa_requests_for_user.yml
Fixing 'null' name field to src_ip
2023-08-02 14:33:48 -07:00
gcp_multiple_users_failing_to_authenticate_from_ip.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
gcp_successful_single_factor_authentication.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
gcp_unusual_number_of_failed_authentications_from_ip.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
gdrive_suspicious_file_sharing.yml
merged with develop
2023-03-03 12:40:16 +01:00
github_actions_disable_security_workflow.yml
merged with develop
2023-03-03 12:40:16 +01:00
github_commit_changes_in_master.yml
merged with develop
2023-03-03 12:40:16 +01:00
github_commit_in_develop.yml
merged with develop
2023-03-03 12:40:16 +01:00
github_dependabot_alert.yml
updated descriptions
2023-10-13 13:26:36 -07:00
github_pull_request_from_unknown_user.yml
updated descriptions
2023-10-13 13:26:36 -07:00
gsuite_drive_share_in_external_email.yml
merged with develop
2023-03-03 12:40:16 +01:00
gsuite_email_suspicious_attachment.yml
merged with develop
2023-03-03 12:40:16 +01:00
gsuite_email_suspicious_subject_with_attachment.yml
merged with develop
2023-03-03 12:40:16 +01:00
gsuite_email_with_known_abuse_web_service_link.yml
merged with develop
2023-03-03 12:40:16 +01:00
gsuite_outbound_email_with_attachment_to_external_domain.yml
Release Branch : v4.28.0
2024-03-27 16:36:00 +00:00
gsuite_suspicious_calendar_invite.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
gsuite_suspicious_shared_file_name.yml
merged with develop
2023-03-03 12:40:16 +01:00
high_number_of_login_failures_from_a_single_source.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
kubernetes_abuse_of_secret_by_unusual_location.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kubernetes_abuse_of_secret_by_unusual_user_agent.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kubernetes_abuse_of_secret_by_unusual_user_group.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kubernetes_abuse_of_secret_by_unusual_user_name.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kubernetes_access_scanning.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_anomalous_inbound_network_activity_from_process.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_anomalous_inbound_outbound_network_traffic_io.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_anomalous_outbound_network_activity_from_process.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_anomalous_traffic_on_network_edge.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_aws_detect_suspicious_kubectl_calls.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_create_or_update_privileged_pod.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
kubernetes_cron_job_creation.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_daemonSet_deployed.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_falco_shell_spawned.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_newly_seen_tcp_edge.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_newly_seen_udp_edge.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_nginx_ingress_lfi.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
kubernetes_nginx_ingress_rfi.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
kubernetes_node_port_creation.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_pod_created_in_default_namespace.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_pod_with_host_network_attachment.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_previously_unseen_container_image_name.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_previously_unseen_process.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
kubernetes_process_running_from_new_path.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_process_with_anomalous_resource_utilisation.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_process_with_resource_ratio_anomalies.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_scanner_image_pulling.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_scanning_by_unauthenticated_ip_address.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
kubernetes_shell_running_on_worker_node_with_cpu_activity.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_shell_running_on_worker_node.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kubernetes_suspicious_image_pulling.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kubernetes_unauthorized_access.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
o365_add_app_role_assignment_grant_user.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_added_service_principal.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_admin_consent_bypassed_by_service_principal.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_advanced_audit_disabled.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_application_registration_owner_added.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_applicationimpersonation_role_assigned.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_block_user_consent_for_risky_apps_disabled.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_bypass_mfa_via_trusted_ip.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_compliance_content_search_exported.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_compliance_content_search_started.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_concurrent_sessions_from_different_ips.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
o365_disable_mfa.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_elevated_mailbox_permission_assigned.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_excessive_authentication_failures_alert.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_excessive_sso_logon_errors.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_file_permissioned_application_consent_granted_by_user.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_fullaccessasapp_permission_assigned.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_high_number_of_failed_authentications_for_user.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_high_privilege_role_granted.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_mail_permissioned_application_consent_granted_by_user.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_mailbox_email_forwarding_enabled.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_mailbox_folder_read_permission_assigned.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_mailbox_folder_read_permission_granted.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_mailbox_inbox_folder_shared_with_all_users.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_mailbox_read_access_granted_to_application.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_multi_source_failed_authentications_spike.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_multiple_appids_and_useragents_authentication_spike.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_multiple_failed_mfa_requests_for_user.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_multiple_mailboxes_accessed_via_api.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_multiple_service_principals_created_by_sp.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_multiple_service_principals_created_by_user.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_multiple_users_failing_to_authenticate_from_ip.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
o365_new_email_forwarding_rule_created.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_new_email_forwarding_rule_enabled.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_new_federated_domain_added.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_new_forwarding_mailflow_rule_created.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_new_mfa_method_registered.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_oauth_app_mailbox_access_via_ews.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_oauth_app_mailbox_access_via_graph_api.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_privileged_graph_api_permission_assigned.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_pst_export_alert.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_security_and_compliance_alert_triggered.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
o365_service_principal_new_client_credentials.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_tenant_wide_admin_consent_granted.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
o365_user_consent_blocked_for_risky_application.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_user_consent_denied_for_oauth_application.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
risk_rule_for_dev_sec_ops_by_repository.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00