| elastic |
AWS Bedrock AgentCore Runtime Prompt Targeting Credentials or Instance Metadata |
production |
2026-09-25 |
| elastic |
Anthropic Organization Deletion |
production |
2026-09-25 |
| elastic |
Anthropic Extra Usage Spend Limit Deleted |
production |
2026-09-25 |
| elastic |
AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key |
production |
2026-09-25 |
| elastic |
AWS Bedrock Model Prompt or Completion Containing Credentials |
production |
2026-09-25 |
| elastic |
Anthropic Excessive Chat Creation |
production |
2026-09-25 |
| elastic |
Unusual High Word Policy Blocks Detected |
production |
2026-09-25 |
| elastic |
AWS Bedrock High-Frequency Single-Model Inference API Probing |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Runtime Prompt Containing Credentials |
production |
2026-09-25 |
| elastic |
Anthropic Admin API Key Deleted |
production |
2026-09-25 |
| elastic |
GenAI Process Compiling or Generating Executables |
production |
2026-09-25 |
| elastic |
AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered |
production |
2026-09-25 |
| elastic |
Anthropic Magic Link Second Factor Disabled |
production |
2026-09-25 |
| elastic |
Ollama API Accessed from External Network |
production |
2026-09-25 |
| elastic |
Connection to Common Large Language Model Endpoints |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage via Auditd |
production |
2026-09-25 |
| elastic |
LLM-Based Curl Activity Triage |
production |
2026-09-25 |
| elastic |
GenAI Process Connection to Suspicious Top Level Domain |
production |
2026-09-25 |
| elastic |
Elastic Defend Alert from GenAI Utility or Descendant |
production |
2026-09-25 |
| elastic |
GenAI Process Connection to Unusual Domain |
production |
2026-09-25 |
| elastic |
LLM-Based Wget Activity Triage |
production |
2026-09-25 |
| elastic |
GenAI Process Accessing Sensitive Files |
production |
2026-09-25 |
| elastic |
AWS Bedrock Resource-Based Policy Modified or Deleted |
production |
2026-09-25 |
| elastic |
Unusual Process Modifying GenAI Configuration File |
production |
2026-09-25 |
| elastic |
Anthropic High File Upload Activity |
production |
2026-09-25 |
| elastic |
Anthropic Excessive Chat Snapshot Creation |
production |
2026-09-25 |
| elastic |
AWS IAM Credentials Added to a Bedrock API Key Phantom User |
production |
2026-09-25 |
| elastic |
Anthropic Artifact Shared Publicly |
production |
2026-09-25 |
| elastic |
Anthropic Organization Member and Group Enumeration |
production |
2026-09-25 |
| elastic |
AWS Bedrock Agent or Action Group Manipulation |
production |
2026-09-25 |
| elastic |
Anthropic Excessive Chat Access Failures |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Phantom User Activity Outside Bedrock |
production |
2026-09-25 |
| elastic |
Anthropic SSO Disabled or Connection Removed |
production |
2026-09-25 |
| elastic |
AWS Bedrock AgentCore Resource Created with IAM Execution Role |
production |
2026-09-25 |
| elastic |
Anthropic Organization IP Restriction Deleted |
production |
2026-09-25 |
| elastic |
Unusual High Confidence Content Filter Blocks Detected |
production |
2026-09-25 |
| elastic |
AWS Bedrock API Key Used for Destructive or Anti-Recovery Action |
production |
2026-09-25 |
| elastic |
AWS Bedrock Detected Multiple Attempts to use Denied Models by a Single User |
production |
2026-09-25 |
| elastic |
AWS Bedrock High Risk Filesystem or Execution Tool Invocation |
production |
2026-09-25 |
| elastic |
AWS Bedrock Foundation Model Access Enabled or Entitlement Granted |
production |
2026-09-25 |