| elastic |
Application Added to Google Workspace Domain |
production |
2026-09-18 |
| elastic |
Google Workspace Suspended User Account Renewed |
production |
2026-09-18 |
| elastic |
Google Workspace Impossible Travel Login |
production |
2026-09-18 |
| elastic |
Google Workspace User Login with Unusual ASN |
production |
2026-09-18 |
| elastic |
External User Added to Google Workspace Group |
production |
2026-09-18 |
| elastic |
Google Workspace MFA Enforcement Disabled For Organization |
production |
2026-09-18 |
| elastic |
Google Workspace Admin Role Deletion |
production |
2026-09-18 |
| elastic |
Forwarded Google Workspace Security Alert |
production |
2026-09-18 |
| elastic |
Google Workspace Restrictions for Marketplace Modified to Allow Any App |
production |
2026-09-18 |
| elastic |
Potential Tunneling via Tailscaled |
production |
2026-09-18 |
| elastic |
First Time Seen Google Workspace OAuth Login from Third-Party Application |
production |
2026-09-18 |
| elastic |
Systemd Timer Created |
production |
2026-09-18 |
| elastic |
Systemd Service Override Configuration File Created |
production |
2026-09-18 |
| elastic |
Google Workspace Bitlocker Setting Disabled |
production |
2026-09-18 |
| elastic |
Domain Added to Google Workspace Trusted Domains |
production |
2026-09-18 |
| elastic |
Uncommon DNS Request via Bun or Node.js |
production |
2026-09-18 |
| elastic |
Application Removed from Blocklist in Google Workspace |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Encryption Key(s) Accessed from Anonymous User |
production |
2026-09-18 |
| elastic |
Google Workspace Gmail Routing or Forwarding Rule Created or Modified |
production |
2026-09-18 |
| elastic |
Google Workspace Drive Data Transfer or Takeout Export Initiated |
production |
2026-09-18 |
| elastic |
Suspicious Network Connection via systemd |
production |
2026-09-18 |
| elastic |
Systemd Generator Created |
production |
2026-09-18 |
| elastic |
GitHub Owner Role Granted To User |
production |
2026-09-18 |
| elastic |
New GitHub Personal Access Token (PAT) Added |
production |
2026-09-18 |
| elastic |
New GitHub Owner Added |
production |
2026-09-18 |
| elastic |
New GitHub Self Hosted Action Runner |
production |
2026-09-18 |
| elastic |
Attempt to Clear Logs via Journalctl |
production |
2026-09-18 |
| elastic |
Kernel Module Removal |
production |
2026-09-18 |
| elastic |
Kill Command Execution |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Executable Masquerading as Kernel Process |
production |
2026-09-18 |
| elastic |
Unusual LD_PRELOAD/LD_LIBRARY_PATH Command Line Arguments |
production |
2026-09-18 |
| elastic |
Dynamic Linker (ld.so) Creation |
production |
2026-09-18 |
| elastic |
GitHub Actions Workflow Modification Blocked |
production |
2026-09-18 |
| elastic |
GitHub Actions Unusual Bot Push to Repository |
production |
2026-09-18 |
| elastic |
High Number of Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
Several Failed Protected Branch Force Pushes by User |
production |
2026-09-18 |
| elastic |
High Number of Closed Pull Requests by User |
production |
2026-09-18 |
| elastic |
GitHub Repository Deleted |
production |
2026-09-18 |
| elastic |
Github Activity on a Private Repository from an Unusual IP |
production |
2026-09-18 |