> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-06.md).

# 2026.05.06

### Release date: 18-May-2026

### Summary

#### Added

* **10 Detectors:** 1 High, 1 Low, 8 Informational
* **9 Variations:** 1 Medium, 8 Low

#### Modified Logic

* **208 Detectors:** 3 High, 7 Medium, 18 Low, 180 Informational
* **1 Variation:** 1 Medium
* Improved scoring logic for customer-defined alerts

#### Modified Metadata

* **1 Detector:** 1 Informational

### Added

* \[High] [Multiple risk indicators for a cloud identity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity)
* \[Informational] [MFA was disabled for a Google Workspace user](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/mfa-was-disabled-for-a-google-workspace-user)
  * \[Medium] MFA was disabled for a Google Workspace administrative user
  * \[Low] MFA was disabled for a Google Workspace user by a different account for the first time
* \[Low] [ADFS DKM Key Access](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/adfs-dkm-key-access)
* \[Informational] [Chrome OS Remote Access policy was modified in Google Workspace](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/chrome-os-remote-access-policy-was-modified-in-google-workspace)
  * \[Low] Suspicious Chrome OS Remote Access policy was modified in Google Workspace
* \[Informational] [Google Workspace automation was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/google-workspace-automation-was-created)
  * \[Low] Google Workspace automation was created for a public document
* \[Informational] [Google Workspace user authentication information changed](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/google-workspace-user-authentication-information-changed)
  * \[Low] Google Workspace administrative user authentication information changed
  * \[Low] Google Workspace user authentication information changed by another account
* \[Informational] [Large volume of files potentially containing credentials accessed in Google Drive](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/large-volume-of-files-potentially-containing-credentials-accessed-in-google-drive)
  * \[Low] Possible credential files harvesting in Google Drive
* \[Informational] [Security object deletion in Google Workspace Admin Console](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/security-object-deletion-in-google-workspace-admin-console)
  * \[Low] Security object deletion in Google Workspace Admin Console for the first time
* \[Informational] [Unknown DLL was added to the AD FS Global Assembly Cache path](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-path)
  * \[Low] Suspicious DLL was added to the AD FS Global Assembly Cache path
* \[Informational] [Chrome Extension Installed By User](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/chrome-extension-installed-by-user)

### Modified Logic

* \[High] [Cloud penetration testing tool activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-penetration-testing-tool-activity)
* \[High] [Suspicious API call from a Tor exit node](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-api-call-from-a-tor-exit-node)
* \[High] [Suspicious objects encryption in an AWS bucket](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-objects-encryption-in-an-aws-bucket)
* \[Medium] [A Kubernetes API operation was successfully invoked by an anonymous user](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user)
* \[Medium] [A Kubernetes dashboard service account was used outside the cluster](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster)
* \[Medium] [Kubernetes vulnerability scanning tool usage](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage)
* \[Medium] [Logging was impaired via external encryption key](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/logging-was-impaired-via-external-encryption-key)
* \[Medium] [Potential Phishing has been detected](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/potential-phishing-has-been-detected)
* \[Low] [Rare unsigned process execution by scheduled task](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task)
  * \[Medium] Rare unsigned process execution by scheduled task on a sensitive server - Modified Metadata
* \[Medium] [Suspicious heavy allocation of compute resources - possible mining activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity)
* \[Medium] [Windows LOLBIN executable connected to a rare external host](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host)
* \[Low] [A Command Line Interface (CLI) command was executed from a GCP serverless compute service](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-a-gcp-serverless-compute-service)
* \[Low] [A Command Line Interface (CLI) command was executed from an AWS serverless compute service](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-an-aws-serverless-compute-service)
* \[Low] [AWS Guard-Duty detector deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-guard-duty-detector-deletion)
* \[Low] [AWS web ACL deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-web-acl-deletion)
* \[Low] [An Azure Firewall policy deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-firewall-policy-deletion)
* \[Low] [An S3 replication policy to an unknown bucket was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created)
* \[Low] [An identity successfully extracted multiple secrets within the organization](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-identity-successfully-extracted-multiple-secrets-within-the-organization)
* \[Low] [Azure Event Hub Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-event-hub-deletion)
* \[Low] [Azure Network Watcher Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-network-watcher-deletion)
* \[Low] [Billing admin role was removed](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/billing-admin-role-was-removed)
* \[Low] [Disable encryption operations](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/disable-encryption-operations)
* \[Low] [GCP IAM deny policy creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-iam-deny-policy-creation)
* \[Low] [GCP sensitive role granted to group](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-sensitive-role-granted-to-group)
* \[Low] [Kubernetes pod creation from unknown container image registry](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry)
* \[Low] [Microsoft 365 storage services exfiltration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/microsoft-365-storage-services-exfiltration-activity)
* \[Low] [Remote usage of an Azure Managed Identity token](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/remote-usage-of-an-azure-managed-identity-token)
* \[Low] [Suspicious usage of EC2 token](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-usage-of-ec2-token)
* \[Informational] [A Kubernetes DaemonSet was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-daemonset-was-created)
* \[Informational] [A Kubernetes Pod was created with a sidecar container](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container)
* \[Informational] [A Kubernetes Pod was deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-pod-was-deleted)
* \[Informational] [A Kubernetes ReplicaSet was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-replicaset-was-created)
* \[Informational] [A Kubernetes StatefulSet was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-statefulset-was-created)
* \[Informational] [A Kubernetes deployment was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-deployment-was-created)
* \[Informational] [A Kubernetes node service account activity from external IP](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip)
* \[Informational] [A Kubernetes service account executed an unusual API call](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call)
* \[Informational] [A Kubernetes service account has enumerated its permissions](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions)
* \[Informational] [A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-new-server-was-added-to-an-azure-active-directory-hybrid-health-adfs-environment)
* \[Informational] [A Service Principal was created in Azure](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-service-principal-was-created-in-azure)
* \[Informational] [A cloud storage configuration was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-cloud-storage-configuration-was-modified)
* \[Informational] [A new Azure email domain verification was requested](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-new-azure-email-domain-verification-was-requested)
* \[Informational] [A user logged in to the AWS console for the first time](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/a-user-logged-in-to-the-aws-console-for-the-first-time)
* \[Informational] [AWS CloudTrail modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-cloudtrail-modification)
* \[Informational] [AWS CloudWatch log group deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-cloudwatch-log-group-deletion)
* \[Informational] [AWS CloudWatch log stream deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-cloudwatch-log-stream-deletion)
* \[Informational] [AWS Config Recorder stopped](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-config-recorder-stopped)
* \[Informational] [AWS EBS discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS EC2 discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS EC2 instance exported into S3](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-ec2-instance-exported-into-s3)
* \[Informational] [AWS IAM account discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS IAM permission groups discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS IAM resource group deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-iam-resource-group-deletion)
* \[Informational] [AWS Lambda discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS RDS cluster deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-rds-cluster-deletion)
* \[Informational] [AWS S3 discovery operation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [AWS SES account sending settings modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-ses-account-sending-settings-modified)
* \[Informational] [AWS SSM send command attempt](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-ssm-send-command-attempt)
* \[Informational] [AWS STS temporary credentials were generated](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-sts-temporary-credentials-were-generated)
* \[Informational] [AWS SecurityHub findings were modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-securityhub-findings-were-modified)
* \[Informational] [AWS config resource deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-config-resource-deletion)
* \[Informational] [AWS network ACL rule creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-network-acl-rule-creation)
* \[Informational] [AWS network ACL rule deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-network-acl-rule-deletion)
* \[Informational] [AWS root account activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-root-account-activity)
* \[Informational] [AWS support case creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-support-case-creation)
* \[Informational] [AWS user creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aws-user-creation)
* \[Informational] [Abnormal Allocation of compute resources in multiple regions](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions)
* \[Informational] [Abnormal SMB scanning activity to multiple hosts](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/abnormal-smb-scanning-activity-to-multiple-hosts)
* \[Informational] [Allocation of multiple cloud compute resources](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/allocation-of-multiple-cloud-compute-resources)
* \[Informational] [An AWS EC2 instance was exported from a production account](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-ec2-instance-was-exported-from-a-production-account)
* \[Informational] [An AWS EC2 instance was exported into an unknown S3 bucket](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-ec2-instance-was-exported-into-an-unknown-s3-bucket)
* \[Informational] [An AWS EFS File-share mount was deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-efs-file-share-mount-was-deleted)
* \[Informational] [An AWS EFS file-share was deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-efs-file-share-was-deleted)
* \[Informational] [An AWS EKS cluster was created or deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-eks-cluster-was-created-or-deleted)
* \[Informational] [An AWS GuardDuty IP set was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-guardduty-ip-set-was-created)
* \[Informational] [An AWS Lambda Function was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-lambda-function-was-created)
* \[Informational] [An AWS Lambda function was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-lambda-function-was-modified)
* \[Informational] [An AWS RDS Global Cluster Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-rds-global-cluster-deletion)
* \[Informational] [An AWS RDS instance was created from a snapshot](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-rds-instance-was-created-from-a-snapshot)
* \[Informational] [An AWS Route 53 domain was transferred to another AWS account](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-route-53-domain-was-transferred-to-another-aws-account)
* \[Informational] [An AWS S3 bucket configuration was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-s3-bucket-configuration-was-modified)
* \[Informational] [An AWS SAML provider was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-saml-provider-was-modified)
* \[Informational] [An AWS SES identity was deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-ses-identity-was-deleted)
* \[Informational] [An AWS database service master user password was changed](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-aws-database-service-master-user-password-was-changed)
* \[Informational] [An Azure DNS Zone was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-dns-zone-was-modified)
* \[Informational] [An Azure Firewall rule collection group was modified or deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-firewall-rule-collection-group-was-modified-or-deleted)
* \[Informational] [An Azure Firewall was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-firewall-was-modified)
* \[Informational] [An Azure Key Vault key was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-key-vault-key-was-modified)
* \[Informational] [An Azure Key Vault was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-key-vault-was-modified)
* \[Informational] [An Azure Kubernetes Cluster was created or deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-kubernetes-cluster-was-created-or-deleted)
* \[Informational] [An Azure Kubernetes Role or Cluster-Role was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-kubernetes-role-or-cluster-role-was-modified)
* \[Informational] [An Azure Kubernetes Role-Binding or Cluster-Role-Binding was modified or deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-kubernetes-role-binding-or-cluster-role-binding-was-modified-or-deleted)
* \[Informational] [An Azure Kubernetes Service Account was modified or deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-kubernetes-service-account-was-modified-or-deleted)
* \[Informational] [An Azure Network Security Group was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-network-security-group-was-modified)
* \[Informational] [An Azure Point-to-Site VPN was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-point-to-site-vpn-was-modified)
* \[Informational] [An Azure Suppression Rule was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-suppression-rule-was-created)
* \[Informational] [An Azure VM snapshot SAS URL was generated for export from a production subscription](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated-for-export-from-a-production-subscription)
* \[Informational] [An Azure VPN Connection was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-vpn-connection-was-modified)
* \[Informational] [An Azure application reached a throttling API rate](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-application-reached-a-throttling-api-rate)
* \[Informational] [An Azure firewall rule group was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-firewall-rule-group-was-modified)
* \[Informational] [An Azure identity performed multiple actions that were denied](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-identity-performed-multiple-actions-that-were-denied)
* \[Informational] [An Azure virtual network Device was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-virtual-network-device-was-modified)
* \[Informational] [An Azure virtual network was modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-azure-virtual-network-was-modified)
* \[Informational] [An Email address was added to AWS SES](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-email-address-was-added-to-aws-ses)
* \[Informational] [An IAM group was created](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-iam-group-was-created)
* \[Informational] [An identity accessed Azure Kubernetes Secrets](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-identity-accessed-azure-kubernetes-secrets)
* \[Informational] [An identity created or updated password for an IAM user](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-identity-created-or-updated-password-for-an-iam-user)
* \[Informational] [An identity disabled bucket logging](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-identity-disabled-bucket-logging)
* \[Informational] [An identity started an AWS SSM session](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/an-identity-started-an-aws-ssm-session)
* \[Informational] [Attempted Azure application access from unknown tenant](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/attempted-azure-application-access-from-unknown-tenant)
* \[Informational] [Aurora DB cluster stopped](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/aurora-db-cluster-stopped)
* \[Informational] [Azure Automation Account Creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-automation-account-creation)
* \[Informational] [Azure Automation Runbook Creation/Modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-automation-runbook-creation-modification)
* \[Informational] [Azure Automation Runbook Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-automation-runbook-deletion)
* \[Informational] [Azure Automation Webhook creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-automation-webhook-creation)
* \[Informational] [Azure Blob Container Access Level Modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-blob-container-access-level-modification)
* \[Informational] [Azure Event Hub Authorization rule creation/modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-event-hub-authorization-rule-creation-modification)
* \[Informational] [Azure Key Vault Secrets were modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-key-vault-secrets-were-modified)
* \[Informational] [Azure Key Vault modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-key-vault-modification)
* \[Informational] [Azure Kubernetes events were deleted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-kubernetes-events-were-deleted)
* \[Informational] [Azure Resource Group Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-resource-group-deletion)
* \[Informational] [Azure Service principal/Application creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-service-principal-application-creation)
* \[Informational] [Azure Storage Account key generated](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-storage-account-key-generated)
* \[Informational] [Azure conditional access policy creation or modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-conditional-access-policy-creation-or-modification)
* \[Informational] [Azure diagnostic configuration deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-diagnostic-configuration-deletion)
* \[Informational] [Azure enumeration activity using Microsoft Graph API](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-enumeration-activity-using-microsoft-graph-api)
* \[Informational] [Azure group creation/deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-group-creation-deletion)
* \[Informational] [Azure mailbox rule creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-mailbox-rule-creation)
* \[Informational] [Azure storage account cross-tenant object replication was enabled](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-storage-account-cross-tenant-object-replication-was-enabled)
* \[Informational] [Azure user creation/deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-user-creation-deletion)
* \[Informational] [Azure virtual machine commands execution](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/azure-virtual-machine-commands-execution)
* \[Informational] [Cloud Organizational policy was created or modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-organizational-policy-was-created-or-modified)
* \[Informational] [Cloud Watch alarm deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-watch-alarm-deletion)
* \[Informational] [Cloud email sending was enabled](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-email-sending-was-enabled)
* \[Informational] [Cloud email service activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-email-service-activity)
* \[Informational] [Cloud identity reached a throttling API rate](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-identity-reached-a-throttling-api-rate)
* \[Informational] [Cloud resource logging was disabled](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-resource-logging-was-disabled)
* \[Informational] [Cloud storage object discovery](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [Cloud user performed multiple actions that were denied](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied)
* \[Informational] [Credentials were added to Azure application](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/credentials-were-added-to-azure-application)
* \[Informational] [Denied API call by a Kubernetes service account](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/denied-api-call-by-a-kubernetes-service-account)
* \[Informational] [EBS snapshots were created from an EC2 instance](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/ebs-snapshots-were-created-from-an-ec2-instance)
* \[Informational] [EC2 snapshot attribute has been modified](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)
* \[Informational] [External user invitation to Azure tenant](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/external-user-invitation-to-azure-tenant)
* \[Informational] [GCP Firewall Rule Modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-firewall-rule-modification)
* \[Informational] [GCP Firewall Rule creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-firewall-rule-creation)
* \[Informational] [GCP IAM Role Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-iam-role-deletion)
* \[Informational] [GCP IAM Service Account Key Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-iam-service-account-key-deletion)
* \[Informational] [GCP Logging Bucket Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-logging-bucket-deletion)
* \[Informational] [GCP Pub/Sub Subscription Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-pub-sub-subscription-deletion)
* \[Informational] [GCP Pub/Sub Topic Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-pub-sub-topic-deletion)
* \[Informational] [GCP Service Account Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-service-account-deletion)
* \[Informational] [GCP Service Account Disable](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-service-account-disable)
* \[Informational] [GCP Service Account creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-service-account-creation)
* \[Informational] [GCP Service Account key creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-service-account-key-creation)
* \[Informational] [GCP Storage Bucket Configuration Modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-storage-bucket-configuration-modification)
* \[Informational] [GCP Storage Bucket Permissions Modification](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-storage-bucket-permissions-modification)
* \[Informational] [GCP Storage Bucket deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-storage-bucket-deletion)
* \[Informational] [GCP VPC Firewall Rule Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-vpc-firewall-rule-deletion)
* \[Informational] [GCP Virtual Private Cloud (VPC) Network Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-virtual-private-cloud-vpc-network-deletion)
* \[Informational] [GCP Virtual Private Network Route Creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-virtual-private-network-route-creation)
* \[Informational] [GCP Virtual Private Network Route Deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-virtual-private-network-route-deletion)
* \[Informational] [GCP administrative role granted to a cloud identity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-administrative-role-granted-to-a-cloud-identity)
* \[Informational] [GCP logging sink deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-logging-sink-deletion)
* \[Informational] [GCP service account impersonation attempt](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-service-account-impersonation-attempt)
* \[Informational] [GCP set IAM policy activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/gcp-set-iam-policy-activity)
* \[Informational] [Granting Access to an Account](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/granting-access-to-an-account)
* \[Informational] [Kubernetes Pod Created With Sensitive Volume](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-pod-created-with-sensitive-volume)
* \[Informational] [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace)
* \[Informational] [Kubernetes Pod created with host process ID (PID) namespace](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace)
* \[Informational] [Kubernetes Privileged Pod Creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-privileged-pod-creation)
* \[Informational] [Kubernetes admission controller activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-admission-controller-activity)
* \[Informational] [Kubernetes pod creation with host network](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-pod-creation-with-host-network)
* \[Informational] [Kubernetes service account activity outside the cluster](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster)
* \[Informational] [MFA device was removed/deactivated from an IAM user](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/mfa-device-was-removed-deactivated-from-an-iam-user)
* \[Informational] [Mailbox enumeration activity by Azure application](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/mailbox-enumeration-activity-by-azure-application)
* \[Informational] [Microsoft OneDrive enumeration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/microsoft-onedrive-enumeration-activity)
* \[Informational] [Microsoft OneNote enumeration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/microsoft-onenote-enumeration-activity)
* \[Informational] [Microsoft SharePoint enumeration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/microsoft-sharepoint-enumeration-activity)
* \[Informational] [Microsoft Teams enumeration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/microsoft-teams-enumeration-activity)
* \[Informational] [Modification or Deletion of an Azure Application Gateway Detected](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/modification-or-deletion-of-an-azure-application-gateway-detected)
* \[Informational] [Multi region enumeration activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/multi-region-enumeration-activity)
* \[Informational] [Multiple cloud snapshots export](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/multiple-cloud-snapshots-export)
* \[Informational] [Multiple failed logins from a single IP](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/multiple-failed-logins-from-a-single-ip)
* \[Informational] [OneDrive file download](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/onedrive-file-download)
* \[Informational] [OneDrive file upload](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/onedrive-file-upload)
* \[Informational] [OneDrive folder creation](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/onedrive-folder-creation)
* \[Informational] [Owner was added to Azure application](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/owner-was-added-to-azure-application)
* \[Informational] [Port Scan](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/port-scan)
* \[Informational] [Potential spoofing of internal domain spotted](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/potential-spoofing-of-internal-domain-spotted)
* \[Informational] [Privileged role used by Azure application](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/privileged-role-used-by-azure-application)
* \[Informational] [Remote usage of AWS Lambda's role](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/remote-usage-of-aws-lambda-s-role)
* \[Informational] [Remote usage of VM Service Account token](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/remote-usage-of-vm-service-account-token)
* \[Informational] [Remote usage of an App engine Service Account token](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/remote-usage-of-an-app-engine-service-account-token)
* \[Informational] [Remote usage of an Azure Service Principal token](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/remote-usage-of-an-azure-service-principal-token)
* \[Informational] [S3 configuration deletion](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/s3-configuration-deletion)
* \[Informational] [SES Production Access Requested](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/ses-production-access-requested)
* \[Informational] [Soft delete of cloud storage configuration was disabled](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/soft-delete-of-cloud-storage-configuration-was-disabled)
* \[Informational] [Suspicious cloud compute instance SSH keys modification attempt](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt)
* \[Informational] [Suspicious secrets dump activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/suspicious-secrets-dump-activity)
* \[Informational] [Uncommon increase in Azure Microsoft Graph API request sizes](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/uncommon-increase-in-azure-microsoft-graph-api-request-sizes)
* \[Informational] [Unusual IAM enumeration activity by a non-user Identity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-iam-enumeration-activity-by-a-non-user-identity)
* \[Informational] [Unusual access to Microsoft 365 storage services](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-access-to-microsoft-365-storage-services)
* \[Informational] [Unusual certificate management activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-certificate-management-activity)
* \[Informational] [Unusual exec into a Kubernetes Pod](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-exec-into-a-kubernetes-pod)
* \[Informational] [Unusual key management activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-key-management-activity)
* \[Informational] [Unusual resource access by Azure application](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-resource-access-by-azure-application)
* \[Informational] [Unusual secret management activity](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/unusual-secret-management-activity)
* \[Informational] [Upload pattern that resembles Peer to Peer traffic](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/alerts-by-name/upload-pattern-that-resembles-peer-to-peer-traffic)

### Modified Metadata

* \[Medium -> Informational] [Reverse shell using PowerShell](https://app.gitbook.com/o/r4DIGbR5VLvkZy3gAYsu/s/5O67gr80iLneA56jiuO2/)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2026-05-06.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.