2026.08.12
Release date: 23-August-2026
Summary
Added
4 Detectors: 4 Informational
15 Variations: 5 Medium, 5 Low, 5 Informational
Modified Logic
42 Detectors: 1 High, 11 Low, 30 Informational
28 Variations: 1 High, 6 Medium, 13 Low, 8 Informational
Modified Metadata
1 Detector: 1 Medium
1 Variation: 1 Medium
Added
[Informational] Possible Brute Force in universal authentication
[Medium] Possible Brute Force in universal authentication on a honey user
[Medium] Suspicious Brute Force in universal authentication
[Low] Brute Force in universal authentication
[Informational] Abnormal Possible Brute Force in universal authentication
[Informational] Possible Password Spray in universal authentication
[Medium] Possible Password Spray in universal authentication Involving a Honey User
[Medium] Suspicious Password Spray in universal authentication
[Low] Password Spray in universal authentication
[Informational] Possible Password Spray in universal authentication with successful authentication
[Informational] Successful universal authentication with suspicious features
[Medium] Successful universal authentication sign-in from a TOR exit node
[Low] Successful universal authentication from a suspicious tunnel operator
[Informational] Successful universal authentication from a new country in organization
[Informational] Suspicious successful universal authentication from ASN
[Informational] An inactive user attempted to authenticate
[Low] An inactive user attempted to authenticate from a risky IP address
[Low] Successful authentication by an inactive user from a risky IP address
[Informational] Successful authentication by an inactive user
Modified Logic
[High] AWS S3 bucket was exposed to public access containing sensitive information - Modified Metadata
[Informational] AWS S3 bucket was exposed to public access by admin cloud identity - Modified Logic
[Medium] Okta FastPass reported phishing attack suspected from a suspicious IP - Modified Logic
[Medium] Abnormal SSO authentication by a honey user - Modified Logic
[Medium] SSO authentication by a machine account from a suspicious IP - Modified Logic
[Medium] First time SSO authentication by a service account - Modified Logic
[Low] SSO authentication by a service account via a suspicious IP - Modified Logic
[Medium] Uncommon reverse SOCKS proxy SSH tunnel to external domain/ip - Added
[Medium] Uncommon reverse SSH tunnel to external domain/ip to a sensitive port via a non-default bind port - Added
[Low] Uncommon reverse SSH tunnel to external domain/ip using a sensitive port - Modified Metadata
[Informational] A disabled user attempted to authenticate via SSO
[Low] A disabled user attempted to authenticate via SSO from a suspicious IP - Modified Logic
[Informational] A possible risky login to Azure
[Low] Azure Risky Login with Suspicious Characteristics - Modified Logic
[Informational] A user connected from a new country
[Low] A user connected from a new country via a suspicious IP - Modified Logic
[Informational] First SSO Resource Access in the Organization
[Low] Abnormal first access to a resource via SSO in the organization - Modified Logic
[Informational] First SSO access from ASN for user
[Low] First SSO access from ASN for user - suspicious characteristics detected - Modified Logic
[Informational] Google Workspace - First SSO access from ASN for user - Modified Logic
[Informational] First SSO access from ASN in organization
[Low] First SSO access from ASN in organization via a suspicious IP - Modified Logic
[Informational] Google Workspace - First SSO access from ASN in organization - Modified Logic
[Informational] First connection from a country in organization
[Low] First connection from a country in organization via a suspicious IP - Modified Logic
[Informational] First successful SSO connection from a country in organization - Modified Logic
[Informational] Suspicious Azure AD interactive sign-in using PowerShell
[Low] Unusual Azure AD interactive sign-in using PowerShell - Modified Logic
[Informational] Suspicious SSO access from ASN
[Low] Suspicious SSO access from ASN via a suspicious IP - Modified Logic
[Informational] Google Workspace - Suspicious SSO access from ASN - Modified Logic
[Informational] User attempted to connect from a suspicious country
[Low] User attempted to connect from a suspicious country via a suspicious IP - Modified Logic
[Low] User successfully connected from a suspicious country - Modified Logic
[Informational] A user accessed multiple unusual resources via SSO
[Informational] A user logged in at an unusual time via SSO
[Informational] Google Workspace - A user logged in at an unusual time via SSO - Modified Logic
[Informational] AWS SSM parameters retrieval
[Informational] Unusual AWS SSM parameters retrieval - Removed
[Informational] Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert
[Informational] Analytics enhanced NGFW Threat Alert - Rare Internal Firewall Vulnerability Threat Alert Categorized as code-execution/info-leak - Modified Logic
[Informational] Bucket's object ownership controls were modified
[Informational] IP Rotation Pattern in SSO Spray
[Informational] Intense SSO failures
[Informational] Invalid SAML Detected
[Informational] Multiple Okta MFA requests sent to a user
[Informational] Possible Impossible Travel Pattern - SSO
[Informational] SSO Brute Force
[Informational] SSO Password Spray
[Informational] SSO with abnormal operating system
[Informational] SSO with abnormal user agent
[Informational] SSO with new operating system
[Informational] Suspicious brand affiliation detected
[Informational] Unrecognized internal address (AAD mismatch)
[Informational] Unusual Kubernetes service account file read
[Informational] Unusual URL(s) sent by a brand were observed in the email
Modified Metadata
[Medium] Windows LOLBIN executable utilizing known port to connect to a rare external host - Modified Metadata
Was this helpful?