| sentinel |
MFA Rejected by User |
— |
— |
| sentinel |
NRT MFA Rejected by User |
— |
— |
| sentinel |
TI map Domain entity to DnsEvents |
— |
— |
| sentinel |
TI map Domain entity to PaloAlto |
— |
— |
| sentinel |
TI map Domain entity to SecurityAlert |
— |
— |
| sentinel |
TI map Domain entity to Syslog |
— |
— |
| sentinel |
(Preview) TI map Domain entity to Web Session Events (ASIM Web Session schema) |
— |
— |
| sentinel |
TI map Email entity to AzureActivity |
— |
— |
| sentinel |
TI map Email entity to OfficeActivity |
— |
— |
| sentinel |
TI map IP entity to AppServiceHTTPLogs |
— |
— |
| sentinel |
(Preview) TI map IP entity to Web Session Events (ASIM Web Session schema) |
— |
— |
| sentinel |
TI map IP entity to SigninLogs |
— |
— |
| sentinel |
TI map URL entity to AuditLogs |
— |
— |
| sentinel |
TI map URL entity to OfficeActivity data |
— |
— |
| sentinel |
TI map URL entity to PaloAlto data |
— |
— |
| sentinel |
TI map URL entity to SecurityAlert data |
— |
— |
| sentinel |
TI map URL entity to Syslog data |
— |
— |
| sentinel |
Anomalous User Agent connection attempt |
Scheduled |
— |
| sentinel |
High count of failed attempts from same client IP |
Scheduled |
— |
| sentinel |
High count of failed logons by a user |
Scheduled |
— |
| sentinel |
High count of connections by client IP on many ports |
Scheduled |
— |
| sentinel |
Malicious web application requests linked with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) alerts |
Scheduled |
— |
| sentinel |
Exchange SSRF Autodiscover ProxyShell - Detection |
Scheduled |
— |
| sentinel |
Suspicious link sharing pattern |
Scheduled |
— |
| sentinel |
Exchange Server Suspicious File Downloads. |
Scheduled |
— |
| sentinel |
Silk Typhoon Suspicious File Downloads. |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Empty User Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Connection to Unpopular Website Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Hack Tool User-Agent Detected |
Scheduled |
— |
| sentinel |
Cisco Umbrella - Crypto Miner User-Agent Detected |
Scheduled |
— |
| sentinel |
A host is potentially running a crypto miner (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
A host is potentially running a hacking tool (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) |
Scheduled |
— |
| sentinel |
Changes to internet facing AWS RDS Database instances |
— |
— |
| sentinel |
Changes to Amazon VPC settings |
— |
— |
| sentinel |
Changes made to AWS CloudTrail logs |
— |
— |
| sentinel |
Login to AWS Management Console without MFA |
— |
— |
| sentinel |
Suspicious Service Principal creation activity |
— |
— |
| sentinel |
URL Added to Application from Unknown Domain |
Scheduled |
— |
| sentinel |
User Account Created Using Incorrect Naming Format |
Scheduled |
— |