| sentinel |
Application ID URI Changed |
Scheduled |
— |
| sentinel |
Privileged Role Assigned Outside PIM |
— |
— |
| sentinel |
Rare application consent |
— |
— |
| sentinel |
Service Principal Assigned App Role With Sensitive Access |
Scheduled |
— |
| sentinel |
Service Principal Assigned Privileged Role |
Scheduled |
— |
| sentinel |
Suspicious linking of existing user to external User |
Scheduled |
— |
| sentinel |
Suspicious application consent for offline access |
— |
— |
| sentinel |
Azure DevOps Service Connection Addition/Abuse - Historic allow list |
— |
— |
| sentinel |
Azure DevOps Personal Access Token (PAT) misuse |
— |
— |
| sentinel |
DNS events related to ToR proxies (ASIM DNS Schema) |
Scheduled |
— |
| sentinel |
Azure DevOps Pipeline Created and Deleted on the Same Day |
— |
— |
| sentinel |
Admin promotion after Role Management Application Permission Grant |
— |
— |
| sentinel |
Addition of a Temporary Access Pass to a Privileged Account |
Scheduled |
— |
| sentinel |
Azure DevOps Service Connection Abuse |
— |
— |
| sentinel |
Account Elevated to New Role |
— |
— |
| sentinel |
Account Created and Deleted in Short Timeframe |
— |
— |
| sentinel |
External Upstream Source Added to Azure DevOps Feed |
— |
— |
| sentinel |
NRT Azure DevOps Audit Stream Disabled |
— |
— |
| sentinel |
Account created or deleted by non-approved user |
— |
— |
| sentinel |
New Agent Added to Pool by New User or Added to a New OS Type. |
— |
— |
| sentinel |
Unusual Anomaly |
Scheduled |
— |
| sentinel |
Anomaly Sign In Event from an IP |
Scheduled |
— |
| sentinel |
Microsoft Defender for Endpoint (MDE) signatures for Azure Synapse pipelines and Azure Data Factory |
Scheduled |
— |
| sentinel |
AWS Guard Duty Alert |
— |
— |
| sentinel |
Azure VM Run Command operations executing a unique PowerShell script |
Scheduled |
— |
| sentinel |
New PA, PCA, or PCAS added to Azure DevOps |
— |
— |
| sentinel |
Suspicious access of BEC related documents in AWS S3 buckets |
— |
— |
| sentinel |
NRT Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Azure WAF matching for Log4j vuln(CVE-2021-44228) |
— |
— |
| sentinel |
Sensitive Azure Key Vault operations |
— |
— |
| sentinel |
Mass secret retrieval from Azure Key Vault |
— |
— |
| sentinel |
A potentially malicious web request was executed against a web server |
— |
— |
| sentinel |
NRT_KeyVaultSensitiveOperations.yaml |
— |
— |
| sentinel |
TimeSeriesKeyvaultAccessAnomaly.yaml |
— |
— |
| sentinel |
Cisco Umbrella - Windows PowerShell User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Rare User Agent Detected |
Scheduled |
— |
| sentinel |
Changes to AWS Elastic Load Balancer security groups |
— |
— |
| sentinel |
Cisco Umbrella - Request Allowed to harmful/malicious URI category |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Request to blocklisted file type |
Scheduled |
— |
| sentinel |
Cisco Umbrella - URI contains IP address |
Scheduled |
— |