https://docs.alphasoc.com/search/weekly0.5https://docs.alphasoc.com/tags/weekly0.5https://docs.alphasoc.com/tags/alpha-soc/weekly0.5https://docs.alphasoc.com/tags/cisa/weekly0.5https://docs.alphasoc.com/tags/network-security/weekly0.5https://docs.alphasoc.com/tags/red-team/weekly0.5https://docs.alphasoc.com/tags/threat-detection/weekly0.5https://docs.alphasoc.com/ae/on-premise-installation/weekly0.5https://docs.alphasoc.com/api_reference/weekly0.5https://docs.alphasoc.com/architecture/weekly0.5https://docs.alphasoc.com/articles/alphasoc-red-team-detection/weekly0.5https://docs.alphasoc.com/capabilities/weekly0.5https://docs.alphasoc.com/collecting_data/overview/weekly0.5https://docs.alphasoc.com/collecting_data/transports/amazon_s3/weekly0.5https://docs.alphasoc.com/collecting_data/transports/azure_blob_storage/weekly0.5https://docs.alphasoc.com/collecting_data/transports/azure_event_hub/weekly0.5https://docs.alphasoc.com/collecting_data/transports/coredns/weekly0.5https://docs.alphasoc.com/collecting_data/transports/cribl/weekly0.5https://docs.alphasoc.com/collecting_data/transports/google_cloud_storage/weekly0.5https://docs.alphasoc.com/collecting_data/transports/https/weekly0.5https://docs.alphasoc.com/collecting_data/transports/kafka/weekly0.5https://docs.alphasoc.com/collecting_data/transports/s3_protocol/weekly0.5https://docs.alphasoc.com/collecting_data/transports/sftp/weekly0.5https://docs.alphasoc.com/collecting_data/transports/snowflake/weekly0.5https://docs.alphasoc.com/collecting_data/transports/splunk/weekly0.5https://docs.alphasoc.com/data_origins/1password/weekly0.5https://docs.alphasoc.com/data_origins/atlassian/weekly0.5https://docs.alphasoc.com/data_origins/aws/cloudtrail/weekly0.5https://docs.alphasoc.com/data_origins/aws/eks/weekly0.5https://docs.alphasoc.com/data_origins/aws/route53/weekly0.5https://docs.alphasoc.com/data_origins/aws/vpc_flow/weekly0.5https://docs.alphasoc.com/data_origins/azure/azure_activity/weekly0.5https://docs.alphasoc.com/data_origins/azure/nsg_flow/weekly0.5https://docs.alphasoc.com/data_origins/azure/vnet_flow/weekly0.5https://docs.alphasoc.com/data_origins/carbonblack_netconn/weekly0.5https://docs.alphasoc.com/data_origins/confluence/weekly0.5https://docs.alphasoc.com/data_origins/coredns/weekly0.5https://docs.alphasoc.com/data_origins/corelight/weekly0.5https://docs.alphasoc.com/data_origins/crowdstrike_fdr/weekly0.5https://docs.alphasoc.com/data_origins/entra_id/weekly0.5https://docs.alphasoc.com/data_origins/gcp/audit/weekly0.5https://docs.alphasoc.com/data_origins/gcp/cloud_dns/weekly0.5https://docs.alphasoc.com/data_origins/gcp/gke/weekly0.5https://docs.alphasoc.com/data_origins/gcp/security_operations/weekly0.5https://docs.alphasoc.com/data_origins/gcp/vpc_flow/weekly0.5https://docs.alphasoc.com/data_origins/github/weekly0.5https://docs.alphasoc.com/data_origins/google_workspace/weekly0.5https://docs.alphasoc.com/data_origins/jira/weekly0.5https://docs.alphasoc.com/data_origins/kubernetes/weekly0.5https://docs.alphasoc.com/data_origins/limacharlie/weekly0.5https://docs.alphasoc.com/data_origins/okta/weekly0.5https://docs.alphasoc.com/data_origins/overview/weekly0.5https://docs.alphasoc.com/data_origins/pan/weekly0.5https://docs.alphasoc.com/data_origins/sentinelone/weekly0.5https://docs.alphasoc.com/data_origins/slack/weekly0.5https://docs.alphasoc.com/data_origins/systemd_journal/weekly0.5https://docs.alphasoc.com/data_origins/zeek/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_brute_force/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_login_anomalous_device/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_login_impossible_travel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_login_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_login/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_modification/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_service_account_token/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_unexpected_action/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/1password_value_exported/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/adversary_simulation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/alternate_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/anon_circuit/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_added_organization_admin/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_admin_api_token_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_user_added_to_admin_group/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_user_impersonated/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/atlassian_user_invited_as_admin/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/audit_unseen_asn_unique/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/audit_unseen_asn/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/audit_unseen_country_unique/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/audit_unseen_country/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_denied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_created_by_root/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_deleted_self_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_deleted_self/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_used_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_access_key_used_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_account_closed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_account_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_account_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_account_left_organization/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_acm_ca_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_alb_insecure_ssl/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ami_public_block_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ami_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_apigateway_key_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_apigateway_key_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_apigateway_key_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_role_access_denied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_role_external_principal/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_role_new_external/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_role_new/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_role_user_agent/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_root_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_root_failure_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_root_failure/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_assume_root/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_group_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_group_changed_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_group_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_large_group_launched_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_large_group_launched_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_autoscaling_large_group_launched/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_backup_plan_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_backup_plan_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_backup_plan_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_backup_vault_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_discovery_access_key/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_model_invoked_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_model_invoked_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_model_invoked_unseen/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_model_invoked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_bedrock_suspicious_api/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudformation_modify_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudformation_modify_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudformation_modify/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudfront_insecure_ssl/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudshell_file_downloaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudtrail_event_selector_coverage_limited/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cloudwatch_alarm_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_codebuild_project_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_compromised_key_quarantine_self/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_compromised_key_quarantine/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_config_monitoring_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_config_monitoring_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_config_monitoring_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_ec2/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_failure_ip/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_failure_user/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_failure_users/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_failure/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_impossible_travel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_new_country/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_no_mfa/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_login/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_console_long_session/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cost_explorer_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cost_explorer_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_cost_explorer_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_data_exfiltration_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_data_exfiltration_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_data_exfiltration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_datasync_task_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_datasync_task_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_datasync_task/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_decoy_resource_accessed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_delete_permission_boundary/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_describe_quota_multi_region_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_describe_quota_multi_region/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_detective_graph_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_disruption_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_disruption_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_disruption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_dry_run_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_dry_run/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_dynamodb_backup_restored_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_dynamodb_backup_restored_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_dynamodb_backup_restored/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ebs_encryption_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ebs_snapshot_copied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ebs_snapshot_public_block_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ebs_snapshot_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_admin_credential_enumeration_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_admin_credential_enumeration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_admin_credential_fetch_attempt_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_admin_credential_fetch_attempt/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_connect_ssh_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_connect_ssh_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_connect_ssh/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_credential_external_location/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_delete_nat_gateway/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_describe_multi_region_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_describe_multi_region/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_export_task_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_export_task_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_iam_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_iam_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_multi_region/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_multiple_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_multiple/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_new_region/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_launch_new_type/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_list_s3_buckets/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_multiple_actions/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_open_port/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_startup_script_enumeration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_startup_script_modify_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_startup_script_modify/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_subnet_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_subnet_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_subnet_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_termination_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ec2_wide_ports_open/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_automatic_registry_scanning_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_automatic_repository_scanning_disabled_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_automatic_repository_scanning_disabled_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_automatic_repository_scanning_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_image_latest_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_image_latest_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_image_latest/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_image_uploaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_public_global_write/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecr_public_image_uploaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecs_cluster_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecs_cluster_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecs_create_cluster_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecs_create_cluster_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ecs_create_cluster/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_efs_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_efs_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_efs_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_eks_admin_access_entry_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_eks_admin_access_entry/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_eks_endpoint_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_eks_multicluster_privilege_escalation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_eks_principal_granted_multiple_clusters/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elasticache_cluster_created_unencrypted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elasticache_security_group_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elasticache_security_group_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elb_security_groups_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elb_security_groups_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_elb_security_groups_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_evasion_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_evasion_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_evasion/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_firehose_destination_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_firehose_destination_changed_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_firehose_destination_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_gateway_api_key_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_gateway_api_key_access_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_gateway_api_key_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_get_signin_token_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_get_signin_token_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_get_signin_token/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_glue_catalog_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_guardduty_destination_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_guardduty_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_guardduty_threat_list_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_guardduty_threat_list_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iac_drift/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_access_key_wakeup/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_analyzer_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_entity_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_group_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_group_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_group_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_oidc_thumbprints_updated_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_oidc_thumbprints_updated_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_oidc_thumbprints_updated/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_password_change_failure/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_any_resource_suspicious_statement/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_any_resource/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_broad_pass_role/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_modified_permissive/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_role_external_principal/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_policy_role_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_role_wakeup_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_role_wakeup/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_trust_policy_oidc_misconfigured/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_update_trust_policy_failed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_update_trust_policy_failed_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_update_trust_policy_failed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_created_with_admin_policy/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_created_with_key/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_generic_name_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_generic_name_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_generic_name/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_profile_no_reset/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_user_wakeup/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_iam_users_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_identity_added_to_admin_group/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ip_transfer_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ipset_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ipset_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ipset_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_kms_key_created_with_bypass/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_kms_key_disruption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_kms_key_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_lambda_layer_version_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_lambda_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_lambda_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_lightsail_launch/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_logging_evasion_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_logging_evasion_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_logging_evasion/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_login_profile_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_login_profile_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_login_profile_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_login_profile_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_macie_evasion/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_malicious_caller_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_malicious_caller_likely/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_mass_mailer_script_setup/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_mfa_disabled_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_mfa_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_mfa_registered_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_mfa_registered/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_opensearch_domain_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_opensearch_insufficient_encryption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_organization_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_organization_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_organization_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_organization_invite_sent/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_changed_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_policy_change_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_policy_change_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_policy_change/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_password_policy_delete/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_persistence_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_persistence_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_persistence/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_accidental_allow/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_accidental_broad/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_accidental_write/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_any_action_suspicious_statement/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_any_action/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_policy_template/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_cloudformation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_datapipeline/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_dynamodb/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_ec2/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_glue/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_iam/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_kms/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_lambda/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_s3/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_ssm/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_privilege_escalation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_quota_increase_request/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ram_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ram_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ram_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_attach_role_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_attach_role/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_deletion_protection_disabled_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_deletion_protection_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_destruction_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_destruction_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_destruction/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_export_task_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_export_task_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_instance_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_instance_unencrypted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_instance_unencrypted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_instance_unencrypted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_password_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_password_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_security_group_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_security_group/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_snapshot_copied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_snapshot_created_public_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_snapshot_created_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_snapshot_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rds_snapshot_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rebinding/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_reconnaissance_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_reconnaissance_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_reconnaissance/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_redshift_cluster_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_redshift_encryption_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_region_toggled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_resource_explorer_enumeration_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_resource_explorer_enumeration_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_resource_explorer_enumeration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_restapi_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_restapi_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_restapi_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_role_assume_any_account/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rolesanywhere_profile_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_rolesanywhere_trust_external_ca/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access_key_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access_key/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access_unusual/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_password_recovery_unknown_asn/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_password_recovery_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_root_password_recovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_associated_vpc/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_domain_registered_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_domain_registered/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_domain_transfer_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_domain_transfer/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_evasion_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_evasion_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_evasion/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_public_zone_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_public_zone_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_route53_transfer_lock_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_access_denied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_access_point_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_account_public_block_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_delete_spike/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_lifecycle_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_mfa_delete_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_policy_external_account/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_public_accidental/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_public_block_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_public_suspicious_statement/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_replication_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_versioning_suspended_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_bucket_versioning_suspended/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_buckets_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_buckets_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_delete_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_delete_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_delete/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_encryption_reset_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_encryption_reset_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_encryption_reset/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_exfiltration_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_exfiltration_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_exfiltration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_external_kms_bucket_encryption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_external_kms_encryption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_logging_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_modify_acl_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_modify_acl_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_modify_acl/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_ransom_note_uploaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_reconnaissance_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_reconnaissance_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_reconnaissance/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_short_bucket_retention_period_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_short_bucket_retention_period_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_short_bucket_retention_period/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_static_website/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_unauthenticated/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_unencrypted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_write_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_write_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_s3_write/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sagemaker_domain_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sagemaker_presigned_url_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sagemaker_presigned_url_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sagemaker_presigned_url/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_saml_activity_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_saml_activity_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_saml_activity/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_secretsmanager_cloudshell_read/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_secretsmanager_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_secretsmanager_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_secretsmanager_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_security_hub_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_security_hub_finding_evasion/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_get_account/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_identities_discovery_via_access_key/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_identity_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ses_production_access_granted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_set_default_policy_version_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_set_default_policy_version/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sns_topic_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sqs_queue_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_association_all_instances/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_command_output_external_bucket/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_decrypt_parameter_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_decrypt_parameter/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_document_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command_multiple_instances_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command_multiple_instances_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command_multiple_instances/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_ssm_send_command/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sso_access_token_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sso_access_token_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sso_access_token_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_consoler/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_discovery_truffle_hog/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_get_federation_token_any_action/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_sts_get_federation_token_any_resource/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_tagging_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_tagging_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_tagging_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_unauthorized_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_unauthorized_access_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_unauthorized_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_vpc_peering_unknown/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_control_list_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_control_list_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_control_list_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_disassociation_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_disassociation_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_waf_disassociation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_workmail_export_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/aws_workmail_export/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_account_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_account_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_account_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_account_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_runbook_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_runbook_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_runbook_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_runbook_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_automation_webhook_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_backup_vault_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_backup_vault_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_backup_vault_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_backup_vault_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_blob_container_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_blob_container_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_compute_restore_point_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_compute_restore_point_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_container_command_run/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_cosmosdb_connection_strings_viewed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_cosmosdb_connection_strings_viewed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_cosmosdb_keys_viewed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_cosmosdb_keys_viewed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_diagnostic_setting_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_disk_snapshot_export_uri/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_flow_logs_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_flow_logs_short_retention/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_front_door_waf_policy_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_key_vault_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_key_vault_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_mysql_database_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_network_packet_capture_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_network_watcher_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_network_watcher_updated/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_nsg_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_database_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_database_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_firewall_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_firewall_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_firewall_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_logging_config_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_logging_config_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_security_config_changed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_security_config_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_postgresql_service_access_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_account_enumeration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_account_role_assigned/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_allow_public_blobs/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_network_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_secure_rest_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_shared_key_access_enabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_storage_weak_tls/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_vm_command_run/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_waf_policy_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_waf_policy_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_waf_policy_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/azure_waf_policy_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/bad_dynamic_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/bad_irc_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/bad_tld/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/bad_tunnel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/blocklist/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/c2_communication/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/capture/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/cleartext_protocol/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/confluence_admin_key_bypass/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/confluence_global_setting_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/confluence_public_link/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/confluence_site_export/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/confluence_space_export/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/cryptomining/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/dga_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/dns_misconfiguration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/dos_outbound/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/encrypted_dns_common/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/encrypted_dns_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/encrypted_dns_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/encrypted_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/excessive_dns_failures/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/excessive_http_failures_bad/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/excessive_http_failures_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/excessive_http_failures/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_access_denied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_api_key_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_bigquery_dataset_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_bigquery_exfiltration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_run_service_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_sql_instance_exported/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_sql_instance_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_storage_bucket_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_storage_bucket_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_cloud_storage_bucket_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_elevated_privileges/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_external_ip_assigned_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_external_ip_assigned_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_external_ip_assigned/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_instance_service_account_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_instance_service_account_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_instance_service_account_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_multiple_instances_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_serial_port_enabled_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_serial_port_enabled_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_serial_port_enabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_shield_config_disabled_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_shield_config_disabled_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_compute_engine_shield_config_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_firewall_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_firewall_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_firewall_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_flow_logs_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_bucket_iam_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_bucket_iam_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_bucket_iam_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_bucket_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_bucket_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gcs_fine_grained_control_enabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gke_auto_upgrade_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_gke_control_plane_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_iam_role_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_iam_service_account_key_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_iam_service_account_key_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_iam_service_account_key_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_iam_workforce_pool_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_image_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_kms_key_destroyed_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_kms_key_destroyed_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_kms_key_destroyed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_kms_key_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_kms_key_without_rotation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_log_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_log_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_log_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_logging_sink_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_logging_sink_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_network_security_firewall_public_egress/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_project_wide_ssh_block_removed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_pubsub_subscription_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_pubsub_topic_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_pubsub_topic_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_pubsub_topic_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_vpc_network_deleted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_vpc_network_deleted_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_vpc_network_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_vpc_route_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/gcp_vpc_route_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_advanced_security_modification/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_anomalous_bot_activity/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_app_restrictions_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_application_installed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_audit_log_stream_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_audit_log_stream_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_branch_protection_bypassed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_branch_protection_policy_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_dependabot_repository_access_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_enterprise_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_enterprise_owner_added/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_enterprise_recovery_codes/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_ip_allow_list_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_mass_pushes/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_mfa_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_oauth_secret_removed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_oauth_token_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_organization_member_updated/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_organization_moderators_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_organization_recovery_codes/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_organization_removed_from_enterprise/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_organization_transferred/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_payment_method_removed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_public_repo_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_recovery_codes_accessed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_register_self_hosted_runner/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repo_download_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repos_exfiltration_with_pat/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repos_exfiltration/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_archived/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_branch_protection_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_deploy_key_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_made_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_ruleset_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_repository_transferred/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_secret_scanning_alert/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_secret_scanning_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_ssh_certificate_authority_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_ssh_certificate_authority_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_ssh_certificate_requirement_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_ssh_key_added_by_suspicious_ip/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_sso_configuration_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_team_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_token_auto_approve_policy_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_unknown_user_repo_clone/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_added_to_org/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_added_to_repository/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_blocked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_removed_from_org/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_removed_from_repository/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_user_unblocked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_vulnerability_alerts_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/github_webhook_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_calendar_shared_externally/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_drive_document_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_drive_document_shared_externally/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_account_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_account_hijacked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_external_email_forwarding/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_mobile_app_whitelisted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_password_leaked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_password_reuse_enabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_strong_password_enforcement_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/google_workspace_suspicious_login/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/high_volume_ftp/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/high_volume_ssh/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/http_get_bad/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/http_get_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/http_post_bad/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/http_post_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/icmp_tunneling/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter_registered_domain/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter_suspicious_young/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter_young/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/imposter/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/ip_lookup/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/irc_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/jira_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/jira_user_added_to_admin_group/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8_admission_controller_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_access_denied/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_anonymous_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_anonymous_access_granted_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_anonymous_access_granted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_anonymous_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_hostnetwork_pod_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_malicious_caller_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_malicious_caller_likely/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_namespace_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_namespace_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_namespace_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_permission_discovery_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_permission_discovery_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_permission_discovery/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_pod_exec/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_privileged_pod_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_resource_created_in_public_namespace/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_resource_created_in_service_namespace/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_secret_access_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_secret_access_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_secret_access/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_service_account_created_in_public_namespace/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_service_account_created_in_service_namespace/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/k8s_user_attached_to_pod/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/likely_malicious_domain/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/link_in_bio_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/link_in_bio/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/linux_sshd_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/mail_implant/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/malicious_js/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/malware_distribution/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/multiple_long_hostnames/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/oast_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_admin_role_assigned/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_api_token_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_api_token_revoked/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_app_token_reuse/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_app_unauthorized_access_attempt/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_sign_on_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_sign_on_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_application_sign_on_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_fastpass_phishing/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_identity_provider_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_identity_provider_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_identity_provider_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_idp_login/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_impersonation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_bypass/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_challenge_without_mfa_app/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_failed_number_challenge/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_mismatch/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_mfa_push_bruteforce/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_multiple_login_failed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_multiple_mfa_push_rejected/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_multiple_users_login_failed_from_ip/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_org2org_app_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_password_extraction_via_scim/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_privilege_granted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_rate_limits/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_suspicious_activity_reported/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_suspicious_session_cookie/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_profile_modified_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_profile_modified_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_profile_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_session_created_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_session_created_impossible_travel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_session_created_new_country/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/okta_user_session_created_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/opendir_suspicious_unusual_port/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/opendir_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/opendir_unusual_port/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/opendir/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/outbound_port_scan/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/p2p_activity/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/popup_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/rare_domain_beacon/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/rare_domain_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/rdp_brute_force/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/remote_access_software/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/reverse_lookup_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/sinkholed_destination/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_admin_action_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_admin_app_access_expanded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_admin_app_added/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_api_call_volume_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_app_access_expanded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_app_added/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_app_removed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_credential_testing_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_device_compromised/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_dlp_rule_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_ekm_logging_config_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_ekm_unenrolled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_excessive_downloads_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_excessive_file_sharing_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_idp_config_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_information_barrier_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_ip_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_legal_hold_policy_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_link_created_to_sensitive_file/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_login_brute_force/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_login_email_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_malicious_caller/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_malware_share_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_manual_export_downloaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_message_deletion_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_mfa_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_microsoft_intune_mdm_disabled/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_multiple_archives_uploaded/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_organization_created/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_organization_deleted/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_private_channel_made_public/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_privilege_escalation/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_scraping_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_service_owner_transferred/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_session_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_sessions_disruption/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_sso_settings_modified/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_suspicious_file/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_unexpected_client_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_user_agent_anomaly/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/slack_user_role_changed/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/smb_outbound_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/smb_outbound/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/spearphishing_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/ssh_brute_force/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/ssh_mask/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/ssh_uncommon/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/survey_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/survey/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_cluster_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_domain_beacon/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_domain_brand_young/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_domain_brand/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_domain_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_domain/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_dynamic_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_hosting_provider/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_ip_trickbot/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_ip_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_ip/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/suspicious_tunnel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/tds_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/telegram_bot/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/tor_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unique_young_domain_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unknown_dynamic_dns/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unknown_tunnel/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unreachable_domain_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unusual_dns_resolver/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unusual_high_traffic_volume/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unusual_network_port_suspicious/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unusual_network_port/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/unwanted_program/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/vpn_activity/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/webhook_traffic/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/winrm_brute_force/weekly0.5https://docs.alphasoc.com/detections_and_findings/alphasoc_detections/young_domain/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/alphasoc_extensions/custom_prefixes/ocsf/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/alphasoc_extensions/custom_prefixes/wisdom/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/alphasoc_extensions/overview/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/introduction/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/supported_features/arrays/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/supported_features/correlations/weekly0.5https://docs.alphasoc.com/detections_and_findings/sigma/supported_features/supported_attributes/weekly0.5https://docs.alphasoc.com/detections_and_findings/wisdom_flags/weekly0.5https://docs.alphasoc.com/escalating_findings/ocsf/weekly0.5https://docs.alphasoc.com/escalating_findings/overview/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/aws_eventbridge/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/aws_s3/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/bigquery/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/cribl/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/kafka/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/secops/weekly0.5https://docs.alphasoc.com/escalating_findings/transports/snowflake/weekly0.5https://docs.alphasoc.com/escalating_findings/v1eventalert/weekly0.5https://docs.alphasoc.com/getting_started/account_setup/weekly0.5https://docs.alphasoc.com/getting_started/cloud_vs_onprem/weekly0.5https://docs.alphasoc.com/getting_started/detections_and_findings/weekly0.5https://docs.alphasoc.com/getting_started/pipeline_configuration/weekly0.5https://docs.alphasoc.com/integration_guides/aws/weekly0.5https://docs.alphasoc.com/integration_guides/azure/weekly0.5https://docs.alphasoc.com/integration_guides/cribl/weekly0.5https://docs.alphasoc.com/integration_guides/crowdstrike/weekly0.5https://docs.alphasoc.com/integration_guides/gcp/weekly0.5https://docs.alphasoc.com/integration_guides/snowflake/weekly0.5https://docs.alphasoc.com/licensing/weekly0.5https://docs.alphasoc.com/processing_data/data_normalization/weekly0.5https://docs.alphasoc.com/processing_data/ocsf/ocsf_aws_cloudtrail/weekly0.5https://docs.alphasoc.com/processing_data/ocsf/ocsf_network/weekly0.5https://docs.alphasoc.com/processing_data/ocsf/ocsf_okta/weekly0.5https://docs.alphasoc.com/processing_data/ocsf/ocsf_system/weekly0.5https://docs.alphasoc.com/processing_data/ocsf/overview/weekly0.5https://docs.alphasoc.com/processing_data/product_field_mappings/weekly0.5https://docs.alphasoc.com/web_console/administration/weekly0.5https://docs.alphasoc.com/web_console/configuring_sso/entra/weekly0.5https://docs.alphasoc.com/web_console/configuring_sso/okta/weekly0.5https://docs.alphasoc.com/web_console/demo_workspace/weekly0.5https://docs.alphasoc.com/web_console/destinations/weekly0.5https://docs.alphasoc.com/web_console/detection_findings/weekly0.5https://docs.alphasoc.com/web_console/introduction/weekly0.5https://docs.alphasoc.com/web_console/monitoring_scope/weekly0.5https://docs.alphasoc.com/web_console/rule_management/weekly0.5https://docs.alphasoc.com/web_console/signup/weekly0.5https://docs.alphasoc.com/web_console/sources/weekly0.5https://docs.alphasoc.com/web_console/user_settings/weekly0.5https://docs.alphasoc.com/weekly0.5