CustomAgentInlineContentCustomAgentSpansCustom Command Capable Mcp Tool InvocationDavid Alonso•Oct 29, 2026
CustomAgentInlineContentCustomAgentSpansCustom Exploit Intent Mcp Command ChainDavid Alonso•Oct 29, 2026
CustomAgentInlineContentCustomAgentSpansCustom Guardrail Evaluation UnavailableDavid Alonso•Oct 29, 2026
CustomAgentInlineContentCustomAgentSpansCustom Unapproved Mcp Server ExecutionDavid Alonso•Oct 29, 2026
DeviceInfoDeviceTvmSoftwareInventory+1Php2shell Review PHP Versions Selected In Our ApplicationsSergio Albea•Oct 28, 2026
SecurityAlert AlertInfo AlertEvidence SecurityIncident BehaviorAnalytics Anomalies SentinelHealthAlerts Behaviors QueriesDavid Alonso•Oct 27, 2026
SigninLogs AADNonInteractiveUserSignInLogs AADServicePrincipalSignInLogs AADManagedIdentitySignInLogs CloudAppEvents AuditLogs AADUserRiskEvents IdentityInfo IdentityLogonEvents IdentityQueryEvents IdentityDirectoryEvents MicrosoftGraphActivityLogsApps Identity QueriesDavid Alonso•Oct 27, 2026
AlertInfo AlertEvidence DeviceProcessEvents DeviceEvents DeviceLogonEvents DeviceNetworkEvents DeviceRegistryEventsMDE Endpoint QueriesDavid Alonso•Oct 27, 2026
EmailEvents AlertInfo AlertEvidence CloudAppEvents EmailUrlInfo EmailAttachmentInfo SigninLogs AADNonInteractiveUserSignInLogsMDO BEC Ai TM QueriesDavid Alonso•Oct 27, 2026
DeviceRegistryEventsSuspicious Windows Policy And Security Registry TamperingBenjamin Zulliger•Oct 22, 2026
_GetWatchlistSigninLogs+1Multiple Suspicious Authentication Session From Unfamiliar LocationJose Sebastián Canós•Oct 22, 2026
DeviceProcessEventsDeviceLogonEvents+2Win RM Child Process With Inbound Network LogonBenjamin Zulliger•Oct 22, 2026
DeviceNetworkEventsDeviceImageLoadEventsMultiple Uncommon Loaded Image Connection To Suspicious DomainJose Sebastián Canós•Oct 22, 2026
DeviceNetworkEventsDevice Network Events Uncommon Process Connection To Suspicious DomainJose Sebastián Canós•Oct 22, 2026
BehaviorAnalyticsUEBA High Priority Activity From MCP Client User AgentsBenjamin Zulliger•Oct 15, 2026
DeviceProcessEventsInfostealer Browser Kill And Verify Sweep From Single ProcessBenjamin Zulliger•Oct 15, 2026
CloudKeyVaultEventsKey Vault Secret Access From New IP Address Per IdentityBenjamin Zulliger•Oct 13, 2026
CloudKeyVaultEventsAzure Key Vault Mass Secret Retrieval By Single ActorBenjamin Zulliger•Oct 13, 2026
DeviceProcessEventsDeviceFileCertificateInfoRenamed System And Third Party Binaries With Signature ContextBenjamin Zulliger•Oct 13, 2026
DeviceProcessEventsDeviceFileEventsBrowser Cache Smuggling Payload Extraction And ExecutionBenjamin Zulliger•Oct 13, 2026
EntraIdSignInEventsCloudKeyVaultEventsRisky Sign In Followedby Key Vault ActivityBert-Jan Pals•Oct 13, 2026
