| splunk |
AWS IAM Delete Policy |
production |
2026-05-13 |
| splunk |
AWS IAM Failure Group Deletion |
production |
2026-05-13 |
| splunk |
AWS IAM Successful Group Deletion |
production |
2026-05-13 |
| splunk |
AWS Lambda UpdateFunctionCode |
production |
2026-05-13 |
| splunk |
AWS Multi-Factor Authentication Disabled |
production |
2026-05-13 |
| splunk |
AWS Multiple Failed MFA Requests For User |
production |
2026-05-13 |
| splunk |
Windows Product Key Registry Query |
production |
2026-05-13 |
| splunk |
AWS Multiple Users Failing To Authenticate From Ip |
production |
2026-05-13 |
| splunk |
AWS Network Access Control List Created with All Open Ports |
production |
2026-05-13 |
| splunk |
AWS Network Access Control List Deleted |
production |
2026-05-13 |
| splunk |
AWS New MFA Method Registered For User |
production |
2026-05-13 |
| splunk |
AWS Password Policy Changes |
production |
2026-05-13 |
| splunk |
AWS S3 Exfiltration Behavior Identified |
production |
2026-05-13 |
| splunk |
AWS SAML Update identity provider |
production |
2026-05-13 |
| splunk |
AWS SetDefaultPolicyVersion |
production |
2026-05-13 |
| splunk |
AWS Successful Console Authentication From Multiple IPs |
production |
2026-05-13 |
| splunk |
AWS Successful Single-Factor Authentication |
production |
2026-05-13 |
| splunk |
AWS Unusual Number of Failed Authentications From Ip |
production |
2026-05-13 |
| splunk |
AWS UpdateLoginProfile |
production |
2026-05-13 |
| splunk |
Azure Automation Runbook Created |
production |
2026-05-13 |
| splunk |
Azure Runbook Webhook Created |
production |
2026-05-13 |
| splunk |
Cloud Security Groups Modifications by User |
production |
2026-05-13 |
| splunk |
Detect AWS Console Login by New User |
production |
2026-05-13 |
| splunk |
Detect AWS Console Login by User from New City |
production |
2026-05-13 |
| splunk |
Detect AWS Console Login by User from New Country |
production |
2026-05-13 |
| splunk |
Detect AWS Console Login by User from New Region |
production |
2026-05-13 |
| splunk |
Detect GCP Storage access from a new IP |
experimental |
2026-05-13 |
| splunk |
Detect New Open GCP Storage Buckets |
experimental |
2026-05-13 |
| splunk |
Detect New Open S3 buckets |
production |
2026-05-13 |
| splunk |
Detect S3 access from a new IP |
experimental |
2026-05-13 |
| splunk |
Gdrive suspicious file sharing |
experimental |
2026-05-13 |
| splunk |
Detect Spike in AWS Security Hub Alerts for EC2 Instance |
production |
2026-05-13 |
| splunk |
Detect Spike in AWS Security Hub Alerts for User |
experimental |
2026-05-13 |
| splunk |
Detect Spike in blocked Outbound Traffic from your AWS |
experimental |
2026-05-13 |
| splunk |
Detect Spike in S3 Bucket deletion |
experimental |
2026-05-13 |
| splunk |
GCP Authentication Failed During MFA Challenge |
production |
2026-05-13 |
| splunk |
GCP Detect gcploit framework |
experimental |
2026-05-13 |
| splunk |
GCP Kubernetes cluster pod scan detection |
experimental |
2026-05-13 |
| splunk |
GCP Multi-Factor Authentication Disabled |
production |
2026-05-13 |
| splunk |
GCP Multiple Failed MFA Requests For User |
production |
2026-05-13 |