| splunk |
Cisco ASA - Device File Copy Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - Device File Copy to Remote Location |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Disabled via CLI |
production |
2026-05-13 |
| splunk |
ESXi Firewall Disabled |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Filters Configuration Tampering |
production |
2026-05-13 |
| splunk |
Cisco ASA - Logging Message Suppression |
production |
2026-05-13 |
| splunk |
Cisco ASA - New Local User Account Created |
production |
2026-05-13 |
| splunk |
Cisco ASA - Packet Capture Activity |
production |
2026-05-13 |
| splunk |
Cisco Duo Policy Allow Old Java |
production |
2026-05-13 |
| splunk |
Cisco ASA - Reconnaissance Command Activity |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Deleted From Local Database |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Account Lockout Threshold Exceeded |
production |
2026-05-13 |
| splunk |
Cisco ASA - User Privilege Level Change |
production |
2026-05-13 |
| splunk |
M365 Copilot Application Usage Pattern Anomalies |
production |
2026-05-13 |
| splunk |
M365 Copilot Failed Authentication Patterns |
production |
2026-05-13 |
| splunk |
Geographic Improbable Location |
experimental |
2026-05-13 |
| splunk |
M365 Copilot Non Compliant Devices Accessing M365 Copilot |
production |
2026-05-13 |
| splunk |
M365 Copilot Session Origin Anomalies |
production |
2026-05-13 |
| splunk |
MCP Filesystem Server Suspicious Extension Write |
production |
2026-05-13 |
| splunk |
MCP Github Suspicious Operation |
production |
2026-05-13 |
| splunk |
MCP Postgres Suspicious Query |
production |
2026-05-13 |
| splunk |
MCP Prompt Injection |
production |
2026-05-13 |
| splunk |
MCP Sensitive System File Search |
production |
2026-05-13 |
| splunk |
No Windows Updates in a time frame |
experimental |
2026-05-13 |
| splunk |
Okta Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
Okta IDP Lifecycle Modifications |
production |
2026-05-13 |
| splunk |
Okta MFA Exhaustion Hunt |
production |
2026-05-13 |
| splunk |
Okta Mismatch Between Source and Response for Verify Push Request |
production |
2026-05-13 |
| splunk |
Okta Multi-Factor Authentication Disabled |
production |
2026-05-13 |
| splunk |
Okta Multiple Accounts Locked Out |
production |
2026-05-13 |
| splunk |
Okta Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
Okta Multiple Failed Requests to Access Applications |
experimental |
2026-05-13 |
| splunk |
Okta Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
Okta New API Token Created |
production |
2026-05-13 |
| splunk |
Okta New Device Enrolled on Account |
production |
2026-05-13 |
| splunk |
Okta Phishing Detection with FastPass Origin Check |
experimental |
2026-05-13 |
| splunk |
Okta Risk Threshold Exceeded |
production |
2026-05-13 |
| splunk |
Okta Successful Single Factor Authentication |
production |
2026-05-13 |
| splunk |
Okta Suspicious Activity Reported |
production |
2026-05-13 |
| splunk |
Okta Suspicious Use of a Session Cookie |
production |
2026-05-13 |