| elastic |
Modification or Removal of an Okta Application Sign-On Policy |
production |
2026-09-18 |
| elastic |
Stolen Credentials Used to Login to Okta Account After MFA Reset |
production |
2026-09-18 |
| elastic |
Spike in Privileged Command Execution by a User |
production |
2026-09-18 |
| elastic |
High Command Line Entropy Detected for Privileged Commands |
production |
2026-09-18 |
| elastic |
Unusual Process Detected for Privileged Commands by a User |
production |
2026-09-18 |
| elastic |
Unusual Spike in Concurrent Active Sessions by a User |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Okta Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Spike in Group Application Assignment Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Lifecycle Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Membership Events |
production |
2026-09-18 |
| elastic |
Spike in Group Privilege Change Events |
production |
2026-09-18 |
| elastic |
Spike in User Lifecycle Management Change Events |
production |
2026-09-18 |
| elastic |
Spike in Group Management Events |
production |
2026-09-18 |
| elastic |
Spike in Special Logon Events |
production |
2026-09-18 |
| elastic |
Spike in Special Privilege Use Events |
production |
2026-09-18 |
| elastic |
Spike in User Account Management Events |
production |
2026-09-18 |
| elastic |
Unusual Host Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Group Name Accessed by a User |
production |
2026-09-18 |
| elastic |
Unusual Privilege Type assigned to a User |
production |
2026-09-18 |
| elastic |
Unusual Region Name for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Source IP for Windows Privileged Operations Detected |
production |
2026-09-18 |
| elastic |
Unusual Process Spawned by a Host |
production |
2026-09-18 |
| elastic |
Sensitive Keys Or Passwords Searched For Inside A Container |
production |
2026-09-18 |
| elastic |
Potential OpenSSH Backdoor Logging Activity |
production |
2026-09-18 |
| elastic |
Potential SSH Password Grabbing via strace |
production |
2026-09-18 |
| elastic |
Access Control List Modification via setfacl |
production |
2026-09-18 |
| elastic |
Suspicious Write Attempt to AppArmor Policy Management Files |
production |
2026-09-18 |
| elastic |
AppArmor Policy Interface Access |
production |
2026-09-18 |
| elastic |
AppArmor Policy Violation Detected |
production |
2026-09-18 |
| elastic |
AppArmor Profile Compilation via apparmor_parser |
production |
2026-09-18 |
| elastic |
Attempt to Disable Auditd Service |
production |
2026-09-18 |
| elastic |
Attempt to Disable IPTables or Firewall |
production |
2026-09-18 |
| elastic |
Attempt to Disable Syslog Service |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Deletion |
production |
2026-09-18 |
| elastic |
Base16 or Base32 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
Unusual Base64 Encoding/Decoding Activity |
production |
2026-09-18 |
| elastic |
System Binary Moved or Copied |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |