| sentinel |
Sign-ins from IPs that attempt sign-ins to disabled accounts |
— |
— |
| sentinel |
Brute force attack against Azure Portal |
— |
— |
| sentinel |
Successful logon from IP and failure from a different IP |
— |
— |
| sentinel |
ProofpointPOD - High risk message not discarded |
— |
— |
| sentinel |
User Accounts - Sign in Failure due to CA Spikes |
— |
— |
| sentinel |
Failed logon attempts in authpriv |
— |
— |
| sentinel |
NRT Squid proxy events related to mining pools |
— |
— |
| sentinel |
ProofpointPOD - Email sender in TI list |
Scheduled |
— |
| sentinel |
Squid proxy events related to mining pools |
— |
— |
| sentinel |
Squid proxy events for ToR proxies |
— |
— |
| sentinel |
SSH - Potential Brute Force |
— |
— |
| sentinel |
TI map Domain entity to CommonSecurityLog |
— |
— |
| sentinel |
ProofpointPOD - Email sender IP in TI list |
Scheduled |
— |
| sentinel |
TI map Email entity to CommonSecurityLog |
— |
— |
| sentinel |
TI map Email entity to SecurityAlert |
— |
— |
| sentinel |
TI map Email entity to SecurityEvent |
— |
— |
| sentinel |
TI map Email entity to SigninLogs |
— |
— |
| sentinel |
TI map File Hash to CommonSecurityLog Event |
— |
— |
| sentinel |
TI map File Hash to Security Event |
— |
— |
| sentinel |
TI map IP entity to AWSCloudTrail |
— |
— |
| sentinel |
TI map IP entity to AzureActivity |
— |
— |
| sentinel |
TI map IP entity to AzureFirewall |
— |
— |
| sentinel |
TI map IP entity to Azure Key Vault logs |
— |
— |
| sentinel |
TI map IP entity to AzureNetworkAnalytics_CL (NSG Flow Logs) |
— |
— |
| sentinel |
ProofpointPOD - Possible data exfiltration to private email |
— |
— |
| sentinel |
TI map IP entity to Azure SQL Security Audit Events |
— |
— |
| sentinel |
Potential Build Process Compromise - MDE |
— |
— |
| sentinel |
TI map IP entity to CommonSecurityLog |
— |
— |
| sentinel |
ProofpointPOD - Binary file in attachment |
— |
— |
| sentinel |
Office policy tampering |
— |
— |
| sentinel |
Exchange AuditLog disabled |
— |
— |
| sentinel |
SharePointFileOperation via devices with previously unseen user agents |
— |
— |
| sentinel |
TI map IP entity to DnsEvents |
— |
— |
| sentinel |
SharePointFileOperation via previously unseen IPs |
— |
— |
| sentinel |
Known Plaid Rain IP |
— |
— |
| sentinel |
TI map IP entity to OfficeActivity |
— |
— |
| sentinel |
TI map IP entity to VMConnection |
— |
— |
| sentinel |
Suspicious link sharing pattern |
Scheduled |
— |
| sentinel |
Rare and potentially high-risk Office operations |
— |
— |
| sentinel |
New executable via Office FileUploaded Operation |
— |
— |