AlphaSOC Detections

AE can identify both known and unknown emerging threats. AlphaSOC’s threat detections leverage the comprehensive techniques outlined in the Capabilities section to secure multiple layers, including Network, Infrastructure, and Identity, using data from various origins. These detections deliver high-fidelity alerts with a low false positive ratio, enabling security teams to prioritize real threats with minimal distractions.

The table below is an exhaustive list of the individual detections that the engine supports.

Search

x

Data Types

any_type

Title	Data Type	Severity
C2 communication attempt indicating infection	DNS, IP, HTTP, TLS	Critical
Traffic to a malicious spear phishing site	DNS, HTTP	Critical
Traffic to a suspicious young domain impersonating a known brand	DNS, HTTP	Critical
AWS API calls by a malicious caller	AWS CloudTrail	High
AWS API calls indicating setup of mass mailer script	AWS CloudTrail	High
AWS EC2 credential used from an unknown external location	AWS CloudTrail	High
AWS EC2 credential used from an unknown external location Beta	AWS CloudTrail	High
AWS WorkMail mailbox exported to a bucket that was made public	AWS CloudTrail	High
AWS console login from an EC2 instance	AWS CloudTrail	High
AWS policy modified to allow any principal to assume an IAM role	AWS CloudTrail	High
AWS root access key created	AWS CloudTrail	High
Anonymizing circuit setup indicating infection or evasion attempt	IP	High
Cryptomining indicating infection or resource abuse	DNS, IP, HTTP	High
Domain resolves to 169.254.169.254 indicating an AWS rebinding attack	DNS, HTTP	High
Encrypted DNS traffic to a server that supports non-ICANN TLDs	DNS, IP, HTTP	High
Excessive number of HTTP failures to a known bad destination	HTTP	High
GitHub SSH key added by suspicious IP address	GitHub	High
HTTP GET request to a known bad destination indicating infection	HTTP	High
HTTP POST to a known bad destination indicating infection	HTTP	High
Known bad dynamic DNS provider traffic	DNS, HTTP	High
Known bad tunneling provider traffic	DNS, IP, HTTP	High
Kubernetes API calls by a malicious caller Beta	Kubernetes	High
Multiple requests to DGA domains indicating infection	DNS, HTTP	High
Multiple requests to long hostnames indicating DNS tunneling	DNS, HTTP	High
Multiple suspicious connections indicating TrickBot infection	DNS, IP, HTTP, TLS	High
Out-of-band application security testing traffic requiring investigation	DNS, IP, HTTP	High
Outbound TCP port scan indicating hacking tool use or infection	IP	High
Quarantine applied to possibly compromised AWS credentials	AWS CloudTrail	High
Suspicious AWS API calls with root account credentials	AWS CloudTrail	High
Suspicious IRC traffic indicating infection	DNS, IP	High
Suspicious SSH session masquerading as a different protocol	IP	High
Suspicious use of an AWS IAM role that was unused for a long period Beta	AWS CloudTrail	High
Telegram Bot API traffic indicating possible infection	DNS, HTTP	High
Traffic from multiple sources to a domain impersonating a known brand	DNS, HTTP	High
Traffic to a known malware distribution site	DNS, IP, HTTP	High
Traffic to a known sinkhole indicating infection	DNS, IP, HTTP	High
Traffic to a suspicious domain impersonating a known brand	DNS, HTTP	High
Traffic to a web server with a suspicious open directory on an unusual port	DNS, IP, HTTP	High
Traffic to a young suspicious domain containing a brand name	DNS, HTTP	High
Traffic to malicious infrastructure capturing credentials	DNS, IP, HTTP	High
1Password actions by a likely malicious caller Beta	1Password	Medium
AWS API calls indicating EKS privilege escalation in multiple clusters Beta	AWS CloudTrail	Medium
AWS API calls indicating S3 buckets discovery in a suspicious way Beta	AWS CloudTrail	Medium
AWS API calls with root account access key	AWS CloudTrail	Medium
AWS Backup vault modified to allow public access Beta	AWS CloudTrail	Medium
AWS DataSync task initiated to an unknown external account	AWS CloudTrail	Medium
AWS Detective graph deleted Beta	AWS CloudTrail	Medium
AWS EBS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
AWS EC2 export task to an unknown S3 bucked initiated	AWS CloudTrail	Medium
AWS EC2 instance unexpectedly interacted with the IAM API	AWS CloudTrail	Medium
AWS EC2 instances unexpectedly described in multiple regions	AWS CloudTrail	Medium
AWS ECR public repository modified to allow global write access	AWS CloudTrail	Medium
AWS EKS access entry unexpectedly created allowing admin access Beta	AWS CloudTrail	Medium
AWS Elastic IP address transfer to an unknown external account	AWS CloudTrail	Medium
AWS GuardDuty disabled	AWS CloudTrail	Medium
AWS GuardDuty publishing destination deleted Beta	AWS CloudTrail	Medium
AWS IAM policy modified to allow access to any resource via suspicious statement	AWS CloudTrail	Medium
AWS IAM trust policy misconfigured for OIDC Beta	AWS CloudTrail	Medium
AWS IAM user created with admin policy attached Beta	AWS CloudTrail	Medium
AWS KMS key modified to allow public access	AWS CloudTrail	Medium
AWS Lambda layer modified to allow public access Beta	AWS CloudTrail	Medium
AWS RDS export task to an unknown S3 bucket initiated	AWS CloudTrail	Medium
AWS RDS snapshot modified to allow public access	AWS CloudTrail	Medium
AWS RDS snapshot unexpectedly created and made public	AWS CloudTrail	Medium
AWS Redshift cluster modified to allow public access Beta	AWS CloudTrail	Medium
AWS Route 53 domain transfer to an unknown external account	AWS CloudTrail	Medium
AWS S3 bucket accidentally modified to allow public access	AWS CloudTrail	Medium
AWS S3 bucket configured with short retention period in a suspicious way Beta	AWS CloudTrail	Medium
AWS S3 bucket modified to allow public access via suspicious statement	AWS CloudTrail	Medium
AWS S3 bucket replication to an unknown external account	AWS CloudTrail	Medium
AWS S3 object accessed without TLS	AWS CloudTrail	Medium
AWS S3 object accessed without authentication	AWS CloudTrail	Medium
AWS S3 object encrypted using an external KMS key	AWS CloudTrail	Medium
AWS SES identities discovery via access key	AWS CloudTrail	Medium
AWS SNS Topic modified to allow public access	AWS CloudTrail	Medium
AWS SQS Queue modified to allow public access	AWS CloudTrail	Medium
AWS SSM document modified to allow public access Beta	AWS CloudTrail	Medium
AWS STS discovery with Truffle Hog	AWS CloudTrail	Medium
AWS Security Hub disabled Beta	AWS CloudTrail	Medium
AWS VPC peering connection to an unknown external account established	AWS CloudTrail	Medium
AWS access key created by the root account	AWS CloudTrail	Medium
AWS access key used to delete itself unexpectedly	AWS CloudTrail	Medium
AWS account password policy changed in a suspicious way	AWS CloudTrail	Medium
AWS decoy resource accessed	AWS CloudTrail	Medium
AWS policy allows passing any role	AWS CloudTrail	Medium
AWS policy allows to perform any action via suspicious statement	AWS CloudTrail	Medium
AWS policy modified to allow unknown principal to assume an IAM role Beta	AWS CloudTrail	Medium
AWS policy suggests denial but allows actions	AWS CloudTrail	Medium
AWS policy suggests narrow access but allows broad access	AWS CloudTrail	Medium
AWS policy suggests read-only access but allows write actions	AWS CloudTrail	Medium
AWS role assumed by an unknown external principal	AWS CloudTrail	Medium
AWS root account unexpectedly assumed via temporary credentials	AWS CloudTrail	Medium
AWS root password recovery request from an unknown ASN	AWS CloudTrail	Medium
AWS service quota unexpectedly described in multiple regions	AWS CloudTrail	Medium
Anonymous access unexpectedly granted to a Kubernetes cluster Beta	Kubernetes	Medium
Atlassian actions by a likely malicious caller Beta	Atlassian	Medium
Beaconing to a rare domain	DNS, HTTP	Medium
Beaconing to a suspicious domain	DNS, HTTP	Medium
Cluster of suspicious requests requiring investigation	DNS, IP, HTTP	Medium
Excessive disruption of Slack user sessions via invalidation	Slack	Medium
Excessive number of HTTP failures to a suspicious destination	HTTP	Medium
GitHub API calls by a malicious caller	GitHub	Medium
GitHub audit log stream destroyed or paused	GitHub	Medium
GitHub personal access token used to download high number of repositories	GitHub	Medium
High volume of outbound ICMP traffic indicating tunneling	IP	Medium
High volume of outbound traffic over FTP	IP	Medium
High volume of outbound traffic over SMB	IP	Medium
High volume of outbound traffic over SSH	IP	Medium
High volume of reverse DNS lookups indicating scanning activity	DNS	Medium
IRC traffic requiring investigation	DNS, IP	Medium
Jira actions by a likely malicious caller Beta	Jira	Medium
Kubernetes resource created in public namespace Beta	Kubernetes	Medium
Kubernetes service account created in public namespace Beta	Kubernetes	Medium
Linux SSHD login by a likely malicious caller Beta	Linux	Medium
MFA delete disabled on AWS S3 bucket Beta	AWS CloudTrail	Medium
Multiple AWS EC2 instances launched unexpectedly	AWS CloudTrail	Medium
Multiple AWS IAM users deleted within a short period Beta	AWS CloudTrail	Medium
Multiple connections to suspicious IP destinations	IP	Medium
Multiple denied AWS assume role API calls requiring investigation	AWS CloudTrail	Medium
Multiple encrypted DNS requests requiring investigation	DNS, IP, HTTP	Medium
Multiple requests to a rare domain	DNS, HTTP	Medium
Multiple requests to suspicious domains	DNS, HTTP	Medium
Multiple unexpected AWS API calls executed in dry run mode	AWS CloudTrail	Medium
Okta FastPass blocked a phishing attempt	Okta	Medium
Okta MFA bypass attempt detected	Okta	Medium
Outbound SSH session using an uncommon server port	IP	Medium
Outbound traffic indicating Denial of Service attack	IP	Medium
P2P activity	DNS, IP, HTTP	Medium
Possible 1Password login brute force Beta	1Password	Medium
Potential ransomware note uploaded to an AWS S3 bucket	AWS CloudTrail	Medium
Potentially unwanted program or browser extension installed	DNS, IP, HTTP	Medium
Previously unseen AWS Bedrock model invoked Beta	AWS CloudTrail	Medium
Secret found in a GitHub repository	GitHub	Medium
Several unsuccessful AWS console login attempts from the same IP address for different users	AWS CloudTrail	Medium
Several unsuccessful Slack login attempts indicating brute force activity	Slack	Medium
Slack API calls by a malicious caller	Slack	Medium
Slack EKM Unenrolled	Slack	Medium
Slack application access expanded with admin scopes	Slack	Medium
Slack application with admin scopes added	Slack	Medium
Slack login with unexpected user email	Slack	Medium
Slack organization deleted	Slack	Medium
Slack service owner transferred	Slack	Medium
Slack team member logged out due to a compromised device	Slack	Medium
Successful AWS console login without MFA	AWS CloudTrail	Medium
Successful Okta MFA login after multiple MFA pushes	Okta	Medium
Suspicious 1Password login Beta	1Password	Medium
Suspicious AWS API call with account access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating API Gateway keys access Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Backup plan deletion Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Bedrock model invocation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating DynamoDB backup restoration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating EC2 subnet deletion Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating ECR repository with automatic scanning disabled Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating ECS cluster creation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Firehose delivery stream destination change Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating IAM role trust policy modification failure Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating IP set modification	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Organizations discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating RDS data destruction	AWS CloudTrail	Medium
Suspicious AWS API calls indicating RDS instance with disabled encryption Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 bucket encryption reset to default Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 delete operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating S3 write operations	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SAML activity	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SES discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating STS discovery	AWS CloudTrail	Medium
Suspicious AWS API calls indicating SageMaker presigned URL generation Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating Secrets Manager discovery Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating WAF control list modification Beta	AWS CloudTrail	Medium
Suspicious AWS API calls indicating WAF disassociation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating change of IAM user password	AWS CloudTrail	Medium
Suspicious AWS API calls indicating command execution via System Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of API Gateway key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating creation of REST API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of Elastic File System	AWS CloudTrail	Medium
Suspicious AWS API calls indicating deletion of access key	AWS CloudTrail	Medium
Suspicious AWS API calls indicating discovery using Tagging API	AWS CloudTrail	Medium
Suspicious AWS API calls indicating disruption	AWS CloudTrail	Medium
Suspicious AWS API calls indicating evasion	AWS CloudTrail	Medium
Suspicious AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of Resource Access Manager	AWS CloudTrail	Medium
Suspicious AWS API calls indicating modification of config monitoring	AWS CloudTrail	Medium
Suspicious AWS API calls indicating new image being pushed to ECR with latest tag	AWS CloudTrail	Medium
Suspicious AWS API calls indicating persistence	AWS CloudTrail	Medium
Suspicious AWS API calls indicating privilege escalation	AWS CloudTrail	Medium
Suspicious AWS API calls indicating reconnaissance	AWS CloudTrail	Medium
Suspicious AWS API calls indicating resource enumeration	AWS CloudTrail	Medium
Suspicious AWS API calls indicating retrieval of sign-in token	AWS CloudTrail	Medium
Suspicious AWS API calls indicating unauthorized access	AWS CloudTrail	Medium
Suspicious AWS Bedrock API usage via programmatic access Beta	AWS CloudTrail	Medium
Suspicious AWS IAM user created with generic name	AWS CloudTrail	Medium
Suspicious AWS S3 bucket encryption configuration Beta	AWS CloudTrail	Medium
Suspicious AWS access key created	AWS CloudTrail	Medium
Suspicious AWS console login	AWS CloudTrail	Medium
Suspicious HTTP GET request requiring investigation	HTTP	Medium
Suspicious Kubernetes API calls indicating access to secret Beta	Kubernetes	Medium
Suspicious Kubernetes API calls indicating namespace creation Beta	Kubernetes	Medium
Suspicious Kubernetes API calls indicating permission discovery Beta	Kubernetes	Medium
Suspicious Okta API calls indicating MFA modification	Okta	Medium
Suspicious Okta API calls indicating application modification	Okta	Medium
Suspicious Okta API calls indicating application sign on policy modification	Okta	Medium
Suspicious Okta API calls indicating identity provider creation	Okta	Medium
Suspicious Okta API calls indicating user creation	Okta	Medium
Suspicious Okta API calls indicating user profile modification	Okta	Medium
Suspicious Okta user session created	Okta	Medium
Suspicious Tor DNS request	DNS	Medium
Suspicious dynamic DNS provider traffic	DNS, HTTP	Medium
Suspicious file accessed or uploaded to Slack	Slack	Medium
Suspicious hosting provider traffic	DNS, HTTP	Medium
Suspicious traffic to DNS server that supports non-ICANN TLDs	IP	Medium
Suspicious traffic to a link-in-bio destination	DNS, HTTP	Medium
Suspicious traffic to user survey site indicating possible phishing	DNS, HTTP	Medium
Suspicious tunneling provider traffic	DNS, IP, HTTP	Medium
Third-party VPN traffic	DNS, IP, HTTP	Medium
Third-party remote access software installed	DNS, IP, HTTP	Medium
Traffic from multiple sources to a unique young domain	DNS, HTTP	Medium
Traffic over a cleartext protocol exposing content and credentials	IP	Medium
Traffic to a TDS mechanism requiring investigation	DNS, HTTP	Medium
Traffic to a destination serving malicious JavaScript	DNS, HTTP	Medium
Traffic to a free webhook service indicating potential exfiltration	DNS, HTTP	Medium
Traffic to a likely malicious domain	DNS, HTTP	Medium
Traffic to a suspicious domain containing a brand name	DNS, HTTP	Medium
Traffic to a web server with a suspicious open directory	DNS, IP, HTTP	Medium
Traffic to a young domain impersonating a known brand	DNS, HTTP	Medium
Traffic to an unknown blocklisted destination	DNS, IP, HTTP	Medium
Traffic to an unusual and suspicious port requiring investigation	IP	Medium
Unexpected AWS API calls with root account credentials	AWS CloudTrail	Medium
Unexpected AWS EC2 Windows Adminstrator encrypted password enumeration	AWS CloudTrail	Medium
Unexpected AWS role assumed by an external principal	AWS CloudTrail	Medium
Unexpected anonymous API call to a Kubernetes cluster Beta	Kubernetes	Medium
Unsuccessful and unexpected attempt to assume AWS root account	AWS CloudTrail	Medium
Unusual excessive AWS S3 bucket deletion requests Beta	AWS CloudTrail	Medium
Unusual mail traffic indicating possible implant	IP	Medium
Use of an AWS IAM access key that was unused for a long period Beta	AWS CloudTrail	Medium
Use of an AWS IAM role that was unused for a long period Beta	AWS CloudTrail	Medium
Use of an AWS IAM user that was unused for a long period Beta	AWS CloudTrail	Medium
User activity from previously unseen ASN	AWS CloudTrail	Medium
User activity from previously unseen country	AWS CloudTrail	Medium
1Password login from unexpected device Beta	1Password	Low
1Password service account token activity Beta	1Password	Low
1Password values exported Beta	1Password	Low
A large AWS EC2 instance launch with an unusual instance type	AWS CloudTrail	Low
AWS ACM certificate authority deleted Beta	AWS CloudTrail	Low
AWS AMI modified to allow public access	AWS CloudTrail	Low
AWS API calls indicating CloudFormation privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating DataPipeline privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating DynamoDB privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating EC2 privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating Glue privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating IAM privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating KMS privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating Lambda privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating S3 buckets discovery Beta	AWS CloudTrail	Low
AWS API calls indicating SSM privilege escalation Beta	AWS CloudTrail	Low
AWS API calls indicating evasion attempts on Amazon Macie	AWS CloudTrail	Low
AWS API calls indicating tampering with Security Hub findings	AWS CloudTrail	Low
AWS Application Load Balancer configured with insecure SSL protocol policy Beta	AWS CloudTrail	Low
AWS CloudFront distribution configured with insecure SSL protocol policy Beta	AWS CloudTrail	Low
AWS CloudTrail event selector does not cover all management events Beta	AWS CloudTrail	Low
AWS CloudWatch alarm deleted	AWS CloudTrail	Low
AWS CodeBuild project modified to allow public access	AWS CloudTrail	Low
AWS DataSync task initiated unexpectedly	AWS CloudTrail	Low
AWS EBS default encryption disabled	AWS CloudTrail	Low
AWS EC2 export task initiated unexpectedly	AWS CloudTrail	Low
AWS EC2 instance interacted with the IAM API	AWS CloudTrail	Low
AWS EC2 instance launch in a new region	AWS CloudTrail	Low
AWS EC2 instance launches in multiple regions	AWS CloudTrail	Low
AWS EC2 instance performed multiple unique API actions Beta	AWS CloudTrail	Low
AWS EC2 instances described in multiple regions	AWS CloudTrail	Low
AWS ECR automatic registry scanning disabled Beta	AWS CloudTrail	Low
AWS ECR image uploaded	AWS CloudTrail	Low
AWS ECS cluster unexpectedly deleted Beta	AWS CloudTrail	Low
AWS EKS access entry created allowing admin access Beta	AWS CloudTrail	Low
AWS EKS cluster endpoint modified to allow public access Beta	AWS CloudTrail	Low
AWS ElastiCache Redis cluster created without encryption at rest	AWS CloudTrail	Low
AWS ElastiCache security group modified unexpectedly	AWS CloudTrail	Low
AWS GuardDuty threat list disabled	AWS CloudTrail	Low
AWS IAM Access Analyzer deleted Beta	AWS CloudTrail	Low
AWS IAM entity created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile created unexpectedly	AWS CloudTrail	Low
AWS IAM login profile unexpectedly modified by a different identity than the owner	AWS CloudTrail	Low
AWS IAM policy granting full or admin access attached	AWS CloudTrail	Low
AWS IAM policy modified to allow access to any resource	AWS CloudTrail	Low
AWS IAM user created with generic name unexpectedly	AWS CloudTrail	Low
AWS IAM user groups discovery	AWS CloudTrail	Low
AWS IAM user profile created without password reset	AWS CloudTrail	Low
AWS KMS customer managed key disabled or scheduled for deletion	AWS CloudTrail	Low
AWS Lambda function modified to allow public invocation	AWS CloudTrail	Low
AWS Lambda functions modified	AWS CloudTrail	Low
AWS Lightsail instance launched unexpectedly	AWS CloudTrail	Low
AWS MFA device disabled unexpectedly	AWS CloudTrail	Low
AWS MFA device registered unexpectedly	AWS CloudTrail	Low
AWS OpenSearch domain configured to allow public access Beta	AWS CloudTrail	Low
AWS Organization invite sent for another account to join the organization Beta	AWS CloudTrail	Low
AWS RDS Deletion Protection disabled unexpectedly	AWS CloudTrail	Low
AWS RDS export task initiated unexpectedly	AWS CloudTrail	Low
AWS RDS instance modified to allow public access	AWS CloudTrail	Low
AWS RDS instance password changed unexpectedly	AWS CloudTrail	Low
AWS RDS security group created unexpectedly	AWS CloudTrail	Low
AWS RDS snapshot created and made public	AWS CloudTrail	Low
AWS RDS snapshot created manually	AWS CloudTrail	Low
AWS Redshift cluster encryption disabled Beta	AWS CloudTrail	Low
AWS Roles Anywhere profile created	AWS CloudTrail	Low
AWS Route 53 hosted zone associated with a VPC	AWS CloudTrail	Low
AWS Route 53 public hosted zone created unexpectedly	AWS CloudTrail	Low
AWS S3 Access Point modified to allow public access Beta	AWS CloudTrail	Low
AWS S3 bucket lifecycle disabled Beta	AWS CloudTrail	Low
AWS S3 bucket modified to allow public access	AWS CloudTrail	Low
AWS S3 bucket policy allows actions by external accounts Beta	AWS CloudTrail	Low
AWS S3 bucket versioning suspended unexpectedly	AWS CloudTrail	Low
AWS SES GetAccount action invoked via AccessKey	AWS CloudTrail	Low
AWS SES identity deleted	AWS CloudTrail	Low
AWS SES production access granted	AWS CloudTrail	Low
AWS STS GetFederationToken invoked by aws_consoler utility Beta	AWS CloudTrail	Low
AWS STS federation token issued with access to all resources Beta	AWS CloudTrail	Low
AWS STS federation token issued with permissions allowing all actions Beta	AWS CloudTrail	Low
AWS SageMaker domain modified to allow public access Beta	AWS CloudTrail	Low
AWS Secrets Manager access from CloudShell session Beta	AWS CloudTrail	Low
AWS System Manager encrypted parameter retrieved unexpectedly	AWS CloudTrail	Low
AWS WorkMail mailbox exported	AWS CloudTrail	Low
AWS access key created for a newly registered IAM user	AWS CloudTrail	Low
AWS access key created unexpectedly	AWS CloudTrail	Low
AWS access key used to delete itself	AWS CloudTrail	Low
AWS account created unexpectedly	AWS CloudTrail	Low
AWS account password policy changed in an unexpected way	AWS CloudTrail	Low
AWS account password policy deleted	AWS CloudTrail	Low
AWS identity added to an admin group	AWS CloudTrail	Low
AWS network infrastructure modification opening a wide range of ports	AWS CloudTrail	Low
AWS policy contains unsubstituted template values	AWS CloudTrail	Low
AWS policy that allows to perform any action was added	AWS CloudTrail	Low
AWS region enabled or disabled Beta	AWS CloudTrail	Low
AWS resource drift from IaC configuration Beta	AWS CloudTrail	Low
AWS root account assumed via temporary credentials	AWS CloudTrail	Low
AWS service quota described in multiple regions	AWS CloudTrail	Low
AWS service quota increase request created Beta	AWS CloudTrail	Low
An AWS account removed itself from the organization	AWS CloudTrail	Low
Anonymous access granted to a Kubernetes cluster Beta	Kubernetes	Low
Atlassian admin API token created Beta	Atlassian	Low
Atlassian administrator impersonated another user Beta	Atlassian	Low
Atlassian organization admin added Beta	Atlassian	Low
Atlassian user added to administrative group Beta	Atlassian	Low
Confluence global setting modified Beta	Confluence	Low
Confluence public link for a page turned on Beta	Confluence	Low
Confluence site exported Beta	Confluence	Low
Confluence space exported Beta	Confluence	Low
Connection to an AWS EC2 instance using EC2 Instance Connect by a suspicious user	AWS CloudTrail	Low
Connection to multiple AWS EC2 instances using EC2 Instance Connect	AWS CloudTrail	Low
DNS misconfiguration leading to potential compromise	DNS	Low
Encrypted DNS traffic indicating potential infection or evasion	DNS, IP, HTTP	Low
Excessive number of DNS failures requiring investigation	DNS	Low
Excessive number of HTTP failures to an uncommon destination	HTTP	Low
GitHub Advanced Security setting modified	GitHub	Low
GitHub bot unexpected activities	GitHub	Low
GitHub branch protections were disabled for the repository	GitHub	Low
GitHub mass pushes	GitHub	Low
GitHub organization transferred to another Enterprise account	GitHub	Low
GitHub public repository created	GitHub	Low
GitHub repository transferred to another Enterprise account	GitHub	Low
GitHub repository visibility changed to public	GitHub	Low
GitHub secret scanning disabled or bypassed	GitHub	Low
High number of non-public GitHub repositories downloaded	GitHub	Low
IAM default policy set to an unexpected version	AWS CloudTrail	Low
IAM role attached to an AWS RDS instance unexpectedly	AWS CloudTrail	Low
Jira user added to administrative group Beta	Jira	Low
Kubernetes admission controller created Beta	AWS CloudTrail	Low
Kubernetes pod command executed Beta	Kubernetes	Low
Kubernetes privileged pod created Beta	Kubernetes	Low
Kubernetes resource created in service namespace Beta	Kubernetes	Low
Kubernetes service account created in service namespace Beta	Kubernetes	Low
MFA disabled for GitHub organization or Enterprise account	GitHub	Low
Malicious pop-up traffic	DNS, HTTP	Low
Many AWS Route 53 domains registered	AWS CloudTrail	Low
Modification of multiple AWS EC2 instance startup scripts	AWS CloudTrail	Low
Multiple AWS API calls executed in dry run mode	AWS CloudTrail	Low
Multiple AWS EC2 instances launched	AWS CloudTrail	Low
Multiple AWS EC2 instances terminated unexpectedly	AWS CloudTrail	Low
Multiple AWS root password recovery requests	AWS CloudTrail	Low
Multiple Okta users failed to login from a single IP address	Okta	Low
Multiple denied AWS API calls requiring investigation	AWS CloudTrail	Low
Multiple denied AWS S3 API calls requiring investigation	AWS CloudTrail	Low
Multiple denied Kubernetes API calls requiring investigation Beta	Kubernetes	Low
Multiple rejected Okta MFA Push notifications for a single user	Okta	Low
Multiple requests to unreachable domains	DNS, HTTP	Low
Okta MFA IP mismatch between challenge and verification Beta	Okta	Low
Okta admin role assigned	Okta	Low
Okta suspicious session cookie usage Beta	Okta	Low
Outbound RDP traffic indicating brute force activity	IP	Low
Outbound SSH traffic indicating brute force activity	IP	Low
Outbound WinRM traffic indicating brute force activity	IP	Low
Registered domain impersonating a known brand	DNS	Low
Several unsuccessful AWS console login attempts for a user	AWS CloudTrail	Low
Several unsuccessful AWS console login attempts from the same IP address	AWS CloudTrail	Low
Several unsuccessful Okta login attempts for a user Beta	Okta	Low
Slack API calls from an unexpected IP address	Slack	Low
Slack API calls from an unexpected client	Slack	Low
Slack API calls from an unexpected user agent	Slack	Low
Slack EKM logging config modified	Slack	Low
Slack Microsoft Intune MDM disabled	Slack	Low
Slack SSO restriction changed	Slack	Low
Slack app removed	Slack	Low
Slack application access expanded	Slack	Low
Slack application added	Slack	Low
Slack data prevention rule modified	Slack	Low
Slack identity provider config modified	Slack	Low
Slack information barrier modified	Slack	Low
Slack legal hold policy modified	Slack	Low
Slack manual export downloaded	Slack	Low
Slack public link created to file with potentially sensitive data	Slack	Low
Slack user privilege escalation	Slack	Low
Successful AWS console login from a new country	AWS CloudTrail	Low
Successful Okta user session created from a new country	Okta	Low
Successful anonymous API call to a Kubernetes cluster Beta	Kubernetes	Low
Suspicious GitHub activity performed via OAuth access token	GitHub	Low
Suspicious HTTP POST request requiring investigation	HTTP	Low
Traffic to a suspicious IP destination	IP	Low
Traffic to a suspicious domain	DNS, HTTP	Low
Traffic to a valid domain impersonating a known brand	DNS, HTTP	Low
Traffic to a web server with an open directory on an unusual port	DNS, IP, HTTP	Low
Traffic to an IP lookup service	DNS, IP, HTTP	Low
Traffic to an unusual DNS resolver	IP	Low
Traffic to an unusual port requiring investigation	IP	Low
Unexpected 1Password item usage action observed Beta	1Password	Low
Unexpected AWS API call with account access key	AWS CloudTrail	Low
Unexpected AWS API calls by a likely malicious caller	AWS CloudTrail	Low
Unexpected AWS API calls indicating API Gateway keys access Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating Backup plan deletion Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating Bedrock model invocation	AWS CloudTrail	Low
Unexpected AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating DynamoDB backup restoration	AWS CloudTrail	Low
Unexpected AWS API calls indicating EC2 subnet deletion Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating ECR repository with automatic scanning disabled Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating ECS cluster creation	AWS CloudTrail	Low
Unexpected AWS API calls indicating Firehose delivery stream destination change Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating IAM role trust policy modification failure Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating IP set modification	AWS CloudTrail	Low
Unexpected AWS API calls indicating Organizations discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating RDS data destruction	AWS CloudTrail	Low
Unexpected AWS API calls indicating RDS instance with disabled encryption Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 bucket encryption reset to default Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 delete operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating S3 write operations	AWS CloudTrail	Low
Unexpected AWS API calls indicating SAML activity	AWS CloudTrail	Low
Unexpected AWS API calls indicating SES discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating STS discovery	AWS CloudTrail	Low
Unexpected AWS API calls indicating SageMaker presigned URL generation Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating Secrets Manager discovery Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating WAF control list modification Beta	AWS CloudTrail	Low
Unexpected AWS API calls indicating WAF disassociation	AWS CloudTrail	Low
Unexpected AWS API calls indicating change of IAM user password	AWS CloudTrail	Low
Unexpected AWS API calls indicating command execution via System Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of API Gateway key	AWS CloudTrail	Low
Unexpected AWS API calls indicating creation of REST API	AWS CloudTrail	Low
Unexpected AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of Elastic File System	AWS CloudTrail	Low
Unexpected AWS API calls indicating deletion of access key	AWS CloudTrail	Low
Unexpected AWS API calls indicating discovery using Tagging API	AWS CloudTrail	Low
Unexpected AWS API calls indicating disruption	AWS CloudTrail	Low
Unexpected AWS API calls indicating evasion	AWS CloudTrail	Low
Unexpected AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of Resource Access Manager	AWS CloudTrail	Low
Unexpected AWS API calls indicating modification of config monitoring	AWS CloudTrail	Low
Unexpected AWS API calls indicating new image being pushed to ECR with latest tag	AWS CloudTrail	Low
Unexpected AWS API calls indicating persistence	AWS CloudTrail	Low
Unexpected AWS API calls indicating privilege escalation	AWS CloudTrail	Low
Unexpected AWS API calls indicating reconnaissance	AWS CloudTrail	Low
Unexpected AWS API calls indicating resource enumeration	AWS CloudTrail	Low
Unexpected AWS API calls indicating retrieval of sign-in token	AWS CloudTrail	Low
Unexpected AWS API calls indicating unauthorized access	AWS CloudTrail	Low
Unexpected AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Low
Unexpected AWS EC2 instance launch	AWS CloudTrail	Low
Unexpected AWS IAM group deletion	AWS CloudTrail	Low
Unexpected AWS S3 bucket configured with short retention period Beta	AWS CloudTrail	Low
Unexpected AWS console login	AWS CloudTrail	Low
Unexpected AWS role assumed by a principal	AWS CloudTrail	Low
Unexpected Kubernetes API calls by a likely malicious caller Beta	Kubernetes	Low
Unexpected Kubernetes API calls indicating access to secret Beta	Kubernetes	Low
Unexpected Kubernetes API calls indicating namespace creation Beta	Kubernetes	Low
Unexpected Kubernetes API calls indicating permission discovery Beta	Kubernetes	Low
Unexpected Okta API calls indicating MFA modification	Okta	Low
Unexpected Okta API calls indicating application modification	Okta	Low
Unexpected Okta API calls indicating application sign on policy modification	Okta	Low
Unexpected Okta API calls indicating identity provider creation	Okta	Low
Unexpected Okta API calls indicating user creation	Okta	Low
Unexpected Okta API calls indicating user profile modification	Okta	Low
Unexpected Okta user session created	Okta	Low
Unexpected Slack API actions from admin account	Slack	Low
Unexpected Slack API calls indicating credential testing activity	Slack	Low
Unexpected Slack API calls indicating excessive downloads	Slack	Low
Unexpected Slack API calls indicating excessive file sharing	Slack	Low
Unexpected Slack API calls indicating malware share	Slack	Low
Unexpected Slack API calls indicating message deletion activity	Slack	Low
Unexpected Slack API calls indicating scraping activity	Slack	Low
Unexpected Slack session with inconsistent client fingerprint	Slack	Low
Unexpected high volume of Slack API calls	Slack	Low
Unknown GitHub user cloned private repository	GitHub	Low
Unknown dynamic DNS provider traffic	DNS, HTTP	Low
Unknown tunneling provider traffic	DNS, IP, HTTP	Low
Unsuccessful AWS IAM password change attempt	AWS CloudTrail	Low
Unsuccessful attempt to assume AWS root account	AWS CloudTrail	Low
Unusual AWS API calls with root account credentials	AWS CloudTrail	Low
Unusual excessive traffic requiring investigation	IP	Low
User activity from unexpected ASN	AWS CloudTrail	Low
User activity from unexpected country	AWS CloudTrail	Low
User invited to Atlassian organization as an administrator Beta	Atlassian	Low
1Password logins from different locations in a short period Beta	1Password	Informational
1Password value modification Beta	1Password	Informational
AWS AMI Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS API calls indicating API Gateway keys access Beta	AWS CloudTrail	Informational
AWS API calls indicating Backup plan deletion Beta	AWS CloudTrail	Informational
AWS API calls indicating Bedrock model invocation	AWS CloudTrail	Informational
AWS API calls indicating Cost Explorer discovery	AWS CloudTrail	Informational
AWS API calls indicating EC2 subnet deletion Beta	AWS CloudTrail	Informational
AWS API calls indicating ECR repository with automatic scanning disabled Beta	AWS CloudTrail	Informational
AWS API calls indicating ECS cluster creation	AWS CloudTrail	Informational
AWS API calls indicating Firehose delivery stream destination change Beta	AWS CloudTrail	Informational
AWS API calls indicating IAM role trust policy modification failure Beta	AWS CloudTrail	Informational
AWS API calls indicating IP set modification	AWS CloudTrail	Informational
AWS API calls indicating Organizations discovery	AWS CloudTrail	Informational
AWS API calls indicating RDS data destruction	AWS CloudTrail	Informational
AWS API calls indicating RDS instance with disabled encryption Beta	AWS CloudTrail	Informational
AWS API calls indicating Route 53 log tampering	AWS CloudTrail	Informational
AWS API calls indicating S3 ACL modifications	AWS CloudTrail	Informational
AWS API calls indicating S3 bucket encryption reset to default Beta	AWS CloudTrail	Informational
AWS API calls indicating S3 data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating S3 delete operations	AWS CloudTrail	Informational
AWS API calls indicating S3 reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating S3 write operations	AWS CloudTrail	Informational
AWS API calls indicating SAML activity	AWS CloudTrail	Informational
AWS API calls indicating SES discovery	AWS CloudTrail	Informational
AWS API calls indicating STS discovery	AWS CloudTrail	Informational
AWS API calls indicating SageMaker presigned URL generation Beta	AWS CloudTrail	Informational
AWS API calls indicating Secrets Manager discovery Beta	AWS CloudTrail	Informational
AWS API calls indicating WAF control list modification Beta	AWS CloudTrail	Informational
AWS API calls indicating WAF disassociation	AWS CloudTrail	Informational
AWS API calls indicating change of IAM user password	AWS CloudTrail	Informational
AWS API calls indicating command execution via System Manager	AWS CloudTrail	Informational
AWS API calls indicating creation of API Gateway key	AWS CloudTrail	Informational
AWS API calls indicating creation of REST API	AWS CloudTrail	Informational
AWS API calls indicating data staging and exfiltration	AWS CloudTrail	Informational
AWS API calls indicating deletion of Elastic File System	AWS CloudTrail	Informational
AWS API calls indicating deletion of access key	AWS CloudTrail	Informational
AWS API calls indicating discovery using Tagging API	AWS CloudTrail	Informational
AWS API calls indicating disruption	AWS CloudTrail	Informational
AWS API calls indicating evasion	AWS CloudTrail	Informational
AWS API calls indicating infrastructure modification using CloudFormation	AWS CloudTrail	Informational
AWS API calls indicating modification of Resource Access Manager	AWS CloudTrail	Informational
AWS API calls indicating modification of config monitoring	AWS CloudTrail	Informational
AWS API calls indicating new image being pushed to ECR with latest tag	AWS CloudTrail	Informational
AWS API calls indicating persistence	AWS CloudTrail	Informational
AWS API calls indicating privilege escalation	AWS CloudTrail	Informational
AWS API calls indicating reconnaissance	AWS CloudTrail	Informational
AWS API calls indicating resource enumeration	AWS CloudTrail	Informational
AWS API calls indicating retrieval of sign-in token	AWS CloudTrail	Informational
AWS API calls indicating unauthorized access	AWS CloudTrail	Informational
AWS API calls with root account credentials	AWS CloudTrail	Informational
AWS DataSync task initiated	AWS CloudTrail	Informational
AWS DynamoDB table restored from backup	AWS CloudTrail	Informational
AWS EBS snapshot Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS EC2 NAT gateway deleted Beta	AWS CloudTrail	Informational
AWS EC2 Windows Adminstrator encrypted password fetch attempt	AWS CloudTrail	Informational
AWS ECS cluster deleted Beta	AWS CloudTrail	Informational
AWS ElastiCache security group modified	AWS CloudTrail	Informational
AWS GuardDuty threat list modified	AWS CloudTrail	Informational
AWS IAM default policy version set	AWS CloudTrail	Informational
AWS IAM group deleted	AWS CloudTrail	Informational
AWS IAM login profile created	AWS CloudTrail	Informational
AWS IAM login profile modified by a different identity than the owner	AWS CloudTrail	Informational
AWS IAM permission boundary deleted	AWS CloudTrail	Informational
AWS IAM policy modified	AWS CloudTrail	Informational
AWS IAM role can assume roles in any account Beta	AWS CloudTrail	Informational
AWS IAM user created with generic name	AWS CloudTrail	Informational
AWS MFA device disabled	AWS CloudTrail	Informational
AWS MFA device registered	AWS CloudTrail	Informational
AWS RDS Deletion Protection disabled	AWS CloudTrail	Informational
AWS RDS instance password changed	AWS CloudTrail	Informational
AWS RDS security group created	AWS CloudTrail	Informational
AWS Roles Anywhere trust anchor created with an external CA	AWS CloudTrail	Informational
AWS Route 53 domain registered	AWS CloudTrail	Informational
AWS Route 53 domain transfer lock disabled for an account	AWS CloudTrail	Informational
AWS Route 53 domain transfer to an external account	AWS CloudTrail	Informational
AWS Route 53 public hosted zone created	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for a bucket	AWS CloudTrail	Informational
AWS S3 Block Public Access disabled for an account	AWS CloudTrail	Informational
AWS S3 bucket configured with short retention period Beta	AWS CloudTrail	Informational
AWS S3 bucket versioning suspended	AWS CloudTrail	Informational
AWS S3 server access logging disabled	AWS CloudTrail	Informational
AWS S3 static website hosting enabled Beta	AWS CloudTrail	Informational
AWS SES service modified	AWS CloudTrail	Informational
AWS SSO access token created	AWS CloudTrail	Informational
AWS System Manager encrypted parameter retrieved	AWS CloudTrail	Informational
AWS access key created	AWS CloudTrail	Informational
AWS account closed	AWS CloudTrail	Informational
AWS account created	AWS CloudTrail	Informational
AWS account password policy changed	AWS CloudTrail	Informational
AWS role assumed by an external principal with an unexpected user agent	AWS CloudTrail	Informational
AWS root password recovery request	AWS CloudTrail	Informational
AWS security group modification allowing access from any IP address	AWS CloudTrail	Informational
Adversary simulation traffic to a benign destination	DNS, IP, HTTP	Informational
Anomalous GitHub repository download	GitHub	Informational
Confluence page restrictions bypassed with an admin key Beta	Confluence	Informational
Connection to an AWS EC2 instance using EC2 Instance Connect	AWS CloudTrail	Informational
Encrypted DNS traffic to a common destination	DNS, IP, HTTP	Informational
Enumeration of AWS EC2 instance startup scripts	AWS CloudTrail	Informational
GitHub Dependabot repository access changed	GitHub	Informational
GitHub Dependabot vulnerability alerts disabled	GitHub	Informational
GitHub Enterprise account deleted	GitHub	Informational
GitHub Enterprise account owner added	GitHub	Informational
GitHub Enterprise recovery codes accessed	GitHub	Informational
GitHub IP allow list modified	GitHub	Informational
GitHub OAuth application access restrictions disabled	GitHub	Informational
GitHub OAuth secret removed	GitHub	Informational
GitHub Personal Access Token approval policy modified	GitHub	Informational
GitHub SSH certificate authority created	GitHub	Informational
GitHub SSH certificate authority deleted	GitHub	Informational
GitHub SSH certificate requirement disabled	GitHub	Informational
GitHub SSO configuration modified for organization or Enterprise account	GitHub	Informational
GitHub account recovery codes accessed	GitHub	Informational
GitHub application installed	GitHub	Informational
GitHub audit log stream modified	GitHub	Informational
GitHub branch protection policy changed	GitHub	Informational
GitHub organization member updated	GitHub	Informational
GitHub organization moderators changed	GitHub	Informational
GitHub organization recovery codes accessed	GitHub	Informational
GitHub organization removed from an Enterprise account	GitHub	Informational
GitHub payment method removed	GitHub	Informational
GitHub repository archived	GitHub	Informational
GitHub repository deleted	GitHub	Informational
GitHub repository deploy key modified or created	GitHub	Informational
GitHub repository ruleset modified	GitHub	Informational
GitHub self hosted runner registered	GitHub	Informational
GitHub team changed	GitHub	Informational
GitHub user added to an organization	GitHub	Informational
GitHub user blocked from accessing an organization’s repositories	GitHub	Informational
GitHub user invited to a repository	GitHub	Informational
GitHub user removed from a repository	GitHub	Informational
GitHub user removed from an organization	GitHub	Informational
GitHub user unblocked from accessing an organization’s repositories	GitHub	Informational
GitHub webhook modified	GitHub	Informational
IAM role attached to an AWS RDS instance	AWS CloudTrail	Informational
Kubernetes API calls by a likely malicious caller Beta	Kubernetes	Informational
Kubernetes API calls indicating access to secret Beta	Kubernetes	Informational
Kubernetes API calls indicating namespace creation Beta	Kubernetes	Informational
Kubernetes API calls indicating permission discovery Beta	Kubernetes	Informational
Kubernetes pod with host network created Beta	Kubernetes	Informational
Kubernetes user attached to pod Beta	Kubernetes	Informational
Long AWS console session	AWS CloudTrail	Informational
Low source port for outbound traffic	AWS CloudTrail	Informational
MFA disabled for Slack organization	Slack	Informational
Modification of an AWS EC2 instance startup script	AWS CloudTrail	Informational
Multiple archived files uploaded to Slack in a short period	Slack	Informational
New Okta API token generated	Okta	Informational
Okta API calls indicating MFA modification	Okta	Informational
Okta API calls indicating application modification	Okta	Informational
Okta API calls indicating application sign on policy modification	Okta	Informational
Okta API calls indicating identity provider creation	Okta	Informational
Okta API calls indicating user creation	Okta	Informational
Okta API calls indicating user profile modification	Okta	Informational
Okta MFA challenge without MFA app Beta	Okta	Informational
Okta MFA number challenge failed	Okta	Informational
Okta privilege granted	Okta	Informational
Outbound traffic over SMB requiring investigation	IP	Informational
Private Slack channel changed to public	Slack	Informational
Quarantine self applied to AWS credentials	AWS CloudTrail	Informational
Slack organization created	Slack	Informational
Slack user role changed	Slack	Informational
Successful 1Password login Beta	1Password	Informational
Successful AWS console login	AWS CloudTrail	Informational
Successful AWS console logins from different locations in a short period	AWS CloudTrail	Informational
Successful Okta user session created from different locations in a short period	Okta	Informational
Traffic to a destination TLD commonly associated with malware	DNS, HTTP	Informational
Traffic to a destination with a known HTTP open directory	DNS, IP, HTTP	Informational
Traffic to a link-in-bio destination	DNS, HTTP	Informational
Traffic to a user survey site	DNS, HTTP	Informational
Traffic to an unknown young domain	DNS, HTTP	Informational
Unsuccessful AWS console login attempt	AWS CloudTrail	Informational
Use of AWS APIs by a likely malicious caller	AWS CloudTrail	Informational