| splunk |
Detect S3 access from a new IP |
experimental |
2026-05-13 |
| splunk |
Gdrive suspicious file sharing |
experimental |
2026-05-13 |
| splunk |
Detect Spike in AWS Security Hub Alerts for EC2 Instance |
production |
2026-05-13 |
| splunk |
Detect Spike in AWS Security Hub Alerts for User |
experimental |
2026-05-13 |
| splunk |
Detect Spike in blocked Outbound Traffic from your AWS |
experimental |
2026-05-13 |
| splunk |
Detect Spike in S3 Bucket deletion |
experimental |
2026-05-13 |
| splunk |
GCP Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
GCP Detect gcploit framework |
experimental |
2026-05-13 |
| splunk |
GCP Kubernetes cluster pod scan detection |
experimental |
2026-05-13 |
| splunk |
GCP Multi-Factor Authentication Disabled |
production |
2026-05-13 |
| splunk |
GCP Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
GCP Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
GCP Successful Single-Factor Authentication |
production |
2026-05-13 |
| splunk |
GCP Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable Dependabot |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Disable IP Allow List |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Modify Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Pause Audit Log Event Stream |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Register Self Hosted Runner |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Remove Organization |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Enterprise Repository Deleted |
production |
2026-05-13 |
| splunk |
GitHub Organizations Delete Branch Ruleset |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable 2FA Requirement |
production |
2026-05-13 |
| splunk |
GSuite Email Suspicious Attachment |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable Classic Branch Protection Rule |
production |
2026-05-13 |
| splunk |
GitHub Organizations Disable Dependabot |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Archived |
production |
2026-05-13 |
| splunk |
GitHub Organizations Repository Deleted |
production |
2026-05-13 |
| splunk |
Gsuite Drive Share In External Email |
experimental |
2026-05-13 |
| splunk |
Gsuite Email Suspicious Subject With Attachment |
production |
2026-05-13 |
| splunk |
Gsuite Email With Known Abuse Web Service Link |
production |
2026-05-13 |
| splunk |
Gsuite Outbound Email With Attachment To External Domain |
production |
2026-05-13 |
| splunk |
Gsuite suspicious calendar invite |
experimental |
2026-05-13 |
| splunk |
Gsuite Suspicious Shared File Name |
experimental |
2026-05-13 |
| splunk |
High Number of Login Failures from a single source |
production |
2026-05-13 |