Our Sponsors ❤️
AuditLogs
MCP Server Registered To Entra
StorageBlobLogs
Anonymous Retrieval Of Azure Blob Versions
AzureActivityAuditLogs
Unauthorized Federated Credential Added To Managed Identity
AuditLogs
Service Principal Adds Client Secret To Target Application
StorageFileLogs
Successful Azure Storage File Access From Unauthorized Geo Location
AuditLogs
Privileged Role Assignment Outside Of PIM
AuditLogs
Service Principal Added To Global Administrator Role
AuditLogs
Granting Of High Risk Privilege Escalation Permissions To Service Principal
StorageBlobLogs
Potential Storage Enumeration Or Brute Force Attack
MicrosoftGraphActivityLogs
Azurekid Blackcat Security Module Activity
AADServicePrincipalSignInLogs
Service Principal Sign In From New Country
MicrosoftGraphActivityLogs
Service Principal Enumeration Of App Role Assignments
DeviceProcessEvents
Notepad Chrysalis Backdoor Gupexe Spawned Binaries Excluding Known Good Notepad Hashes
DeviceNetworkEvents
Notepad Chrysalis Backdoor Gupexe Detection
DeviceProcessEventsDeviceNetworkEvents
Notepad Chrysalis Backdoor Spawned Binaries Network Connections Correlation
DeviceInfoDeviceTvmInfoGatheringDeviceEvents
Windows Trigger Full Scan For Devices That Have Not Completed One Windows Clients Only
IdentityLogonEventsIdentityInfo
Auto Disable High Risk AD User
AuditLogs
Azure RBAC Elevation Via User Access Admin Toggle
SigninLogs
Emergency Access Usage Alert
DeviceTvmInfoGatheringDeviceEvents
Windows Trigger Full Scan For Devices That Have Not Completed One
DeviceTvmInfoGatheringDeviceEvents
Windows Recent Devices Missing Full Scan
DeviceInfoDeviceFileEvents
Linux File Activity Baseline
DeviceInfoDeviceEventsDeviceProcessEvents+3
Linux Action Type Inventory All Tables
DeviceInfoDeviceNetworkEvents
Linux Server Public Egress Baseline High Fidelity
DeviceInfoDeviceEvents
Linux Script Activity Script Content
DeviceInfoDeviceProcessEvents
Linux LO Lbin Downloads To Temporary Directories
DeviceNetworkEvents
Linux Network Fanout From The Upload Process
DeviceProcessEventsDeviceNetworkEvents
Linux Archive Command Followed By Upload Egress
DeviceProcessEvents
Linux User Activity Leading Up To Exfiltration
DeviceInfoDeviceNetworkEvents
Linux Desktop Public Egress Baseline Low Noise
DeviceInfoDeviceNetworkEvents
Linux Network Events Baseline Report Id Dedupe
DeviceInfoDeviceEvents
Linux Antivirus Activity
DeviceInfoDeviceFileEvents
Linux Suspicious Cron Persistence
DeviceInfoDeviceLogonEvents
Linux Logon Activity
DeviceNetworkEvents
Notepad Chrysalis Backdoor Network IO Cs
DeviceFileEvents
Notepad Chrysalis Backdoor File Hash IO Cs
DeviceInfoDeviceProcessEvents
Linux Telemetry Validation Test Process
DeviceTvmSoftwareInventory
Microsoft Office Security Feature Bypass Vulnerability CVE 2026 21509
IdentityInfoExposureGraphNodes
Hunt Accounts With Leaked Credentials
EntraIdSignInEventsAuditLogs
Authenticator Device Enrollment Country Risk Baseline
EntraIdSignInEvents
Sign In Risk Analysis
EmailUrlInfoEmailEvents
IA Threat Intelligence Feed Evaluation Based On URL IO Cs
EmailAttachmentInfoEmailEvents
IA Threat Intelligence Feed Evaluation Based On File Hashes IO Cs
EmailUrlInfoEmailEvents
IA Threat Intelligence Feed Evaluation Based On Domains IO Cs
EmailEventsUrlClickEventsSigninLogs
Suspicious Sign In After Phishing Link Click
DeviceImageLoadEventsDeviceFileCertificateInfo
Monitor DL Ls By Signer
IdentityInfoSecurityEvent
Certificate Issued To Privileged User
DeviceProcessEventsDeviceNetworkEvents
Detect Unkown Process Launched Via Win RM
AuditLogsAADUserRiskEventsCloudAppEvents
Detect PIM Elevation With User Risk
SigninLogsAADNonInteractiveUserSignInLogsAADUserRiskEvents