| sentinel |
Cisco Umbrella - Connection to non-corporate private network |
Scheduled |
— |
| sentinel |
Suspicious Sign In by Entra ID Connect Sync Account |
Scheduled |
— |
| sentinel |
Application Gateway WAF - XSS Detection |
Scheduled |
— |
| sentinel |
Application Gateway WAF - SQLi Detection |
Scheduled |
— |
| sentinel |
Front Door Premium WAF - XSS Detection |
— |
— |
| sentinel |
Front Door Premium WAF - SQLi Detection |
— |
— |
| sentinel |
Several deny actions registered |
— |
— |
| sentinel |
TimeSeriesKeyvaultAccessAnomaly.yaml |
— |
— |
| sentinel |
NRT_KeyVaultSensitiveOperations.yaml |
— |
— |
| sentinel |
A potentially malicious web request was executed against a web server |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |
| sentinel |
Sensitive Azure Key Vault operations |
— |
— |
| sentinel |
Azure WAF matching for Log4j vuln(CVE-2021-44228) |
— |
— |
| sentinel |
New PA, PCA, or PCAS added to Azure DevOps |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
External Upstream Source Added to Azure DevOps Feed |
— |
— |
| sentinel |
Azure DevOps Service Connection Abuse |
— |
— |
| sentinel |
Azure DevOps Personal Access Token (PAT) misuse |
— |
— |
| sentinel |
Azure DevOps Service Connection Addition/Abuse - Historic allow list |
— |
— |
| sentinel |
Changes to Application Ownership |
Scheduled |
— |
| sentinel |
User login from different countries within 3 hours (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
Potential Password Spray Attack (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
Changes to PIM Settings |
Scheduled |
— |
| sentinel |
Failed AzureAD logons but success logon to host |
Scheduled |
— |
| sentinel |
DNS events related to ToR proxies (ASIM DNS Schema) |
Scheduled |
— |
| sentinel |
Changes to Application Logout URL |
Scheduled |
— |
| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts (Uses Authentication Normalization) |
Scheduled |
— |
| sentinel |
DNS events related to mining pools (ASIM DNS Schema) |
Scheduled |
— |
| sentinel |
A client made a web request to a potentially harmful file (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Probable AdFind Recon Tool Usage (Normalized Process Events) |
Scheduled |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
New access credential added to Application or Service Principal |
— |
— |
| sentinel |
New External User Granted Admin |
— |
— |
| sentinel |
PIM Elevation Request Rejected |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Outbound Collaboration Settings Changed |
Scheduled |
— |
| sentinel |
Privileged Account Permissions Changed |
— |
— |
| sentinel |
Cross-tenant Access Settings Organization Inbound Direct Settings Changed |
Scheduled |
— |
| sentinel |
Privileged Role Assigned Outside PIM |
— |
— |