FilesExpand file tree

develop

/

cloud

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

cloud

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
abnormally_high_cloud_instances_destroyed.yml		abnormally_high_cloud_instances_destroyed.yml
abnormally_high_cloud_instances_launched.yml		abnormally_high_cloud_instances_launched.yml
abnormally_high_number_of_cloud_infrastructure_api_calls.yml		abnormally_high_number_of_cloud_infrastructure_api_calls.yml
abnormally_high_number_of_cloud_security_group_api_calls.yml		abnormally_high_number_of_cloud_security_group_api_calls.yml
amazon_eks_kubernetes_cluster_scan_detection.yml		amazon_eks_kubernetes_cluster_scan_detection.yml
amazon_eks_kubernetes_pod_scan_detection.yml		amazon_eks_kubernetes_pod_scan_detection.yml
aws_cross_account_activity_from_previously_unseen_account.yml		aws_cross_account_activity_from_previously_unseen_account.yml
aws_detect_attach_to_role_policy.yml		aws_detect_attach_to_role_policy.yml
aws_detect_permanent_key_creation.yml		aws_detect_permanent_key_creation.yml
aws_detect_role_creation.yml		aws_detect_role_creation.yml
aws_detect_sts_assume_role_abuse.yml		aws_detect_sts_assume_role_abuse.yml
aws_detect_sts_get_session_token_abuse.yml		aws_detect_sts_get_session_token_abuse.yml
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml		aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
aws_detect_users_with_kms_keys_performing_encryption_s3.yml		aws_detect_users_with_kms_keys_performing_encryption_s3.yml
aws_network_access_control_list_created_with_all_open_ports.yml		aws_network_access_control_list_created_with_all_open_ports.yml
aws_network_access_control_list_deleted.yml		aws_network_access_control_list_deleted.yml
cloud_api_calls_from_previously_unseen_user_roles.yml		cloud_api_calls_from_previously_unseen_user_roles.yml
cloud_compute_instance_created_by_previously_unseen_user.yml		cloud_compute_instance_created_by_previously_unseen_user.yml
cloud_compute_instance_created_in_previously_unused_region.yml		cloud_compute_instance_created_in_previously_unused_region.yml
cloud_compute_instance_created_with_previously_unseen_image.yml		cloud_compute_instance_created_with_previously_unseen_image.yml
cloud_compute_instance_created_with_previously_unseen_instance_type.yml		cloud_compute_instance_created_with_previously_unseen_instance_type.yml
cloud_instance_modified_with_previously_unseen_user.yml		cloud_instance_modified_with_previously_unseen_user.yml
cloud_network_access_control_list_deleted.yml		cloud_network_access_control_list_deleted.yml
cloud_provisioning_from_previously_unseen_city.yml		cloud_provisioning_from_previously_unseen_city.yml
cloud_provisioning_from_previously_unseen_country.yml		cloud_provisioning_from_previously_unseen_country.yml
cloud_provisioning_from_previously_unseen_ip_address.yml		cloud_provisioning_from_previously_unseen_ip_address.yml
cloud_provisioning_from_previously_unseen_region.yml		cloud_provisioning_from_previously_unseen_region.yml
detect_api_activity_from_users_without_mfa.yml		detect_api_activity_from_users_without_mfa.yml
detect_aws_api_activities_from_unapproved_accounts.yml		detect_aws_api_activities_from_unapproved_accounts.yml
detect_aws_console_login_by_new_user.yml		detect_aws_console_login_by_new_user.yml
detect_aws_console_login_by_user_from_new_city.yml		detect_aws_console_login_by_user_from_new_city.yml
detect_aws_console_login_by_user_from_new_country.yml		detect_aws_console_login_by_user_from_new_country.yml
detect_aws_console_login_by_user_from_new_region.yml		detect_aws_console_login_by_user_from_new_region.yml
detect_gcp_storage_access_from_a_new_ip.yml		detect_gcp_storage_access_from_a_new_ip.yml
detect_new_api_calls_from_user_roles.yml		detect_new_api_calls_from_user_roles.yml
detect_new_open_gcp_storage_buckets.yml		detect_new_open_gcp_storage_buckets.yml
detect_new_open_s3_buckets.yml		detect_new_open_s3_buckets.yml
detect_new_user_aws_console_login.yml		detect_new_user_aws_console_login.yml
detect_s3_access_from_a_new_ip.yml		detect_s3_access_from_a_new_ip.yml
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml		detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml		detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
detect_spike_in_s3_bucket_deletion.yml		detect_spike_in_s3_bucket_deletion.yml
detect_spike_in_security_hub_alerts_for_user.yml		detect_spike_in_security_hub_alerts_for_user.yml
gcp_detect_accounts_with_high_risk_roles_by_project.yml		gcp_detect_accounts_with_high_risk_roles_by_project.yml
gcp_detect_gcploit_framework.yml		gcp_detect_gcploit_framework.yml
gcp_detect_high_risk_permissions_by_resource_and_account.yml		gcp_detect_high_risk_permissions_by_resource_and_account.yml
gcp_detect_oauth_token_abuse.yml		gcp_detect_oauth_token_abuse.yml
gcp_gcr_container_uploaded.yml		gcp_gcr_container_uploaded.yml
gcp_kubernetes_cluster_pod_scan_detection.yml		gcp_kubernetes_cluster_pod_scan_detection.yml
gcp_kubernetes_cluster_scan_detection.yml		gcp_kubernetes_cluster_scan_detection.yml
high_number_of_login_failures_from_a_single_source.yml		high_number_of_login_failures_from_a_single_source.yml
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml		kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
kubernetes_aws_detect_rbac_authorizations_by_account.yml		kubernetes_aws_detect_rbac_authorizations_by_account.yml
kubernetes_aws_detect_sensitive_object_access.yml		kubernetes_aws_detect_sensitive_object_access.yml
kubernetes_aws_detect_sensitive_role_access.yml		kubernetes_aws_detect_sensitive_role_access.yml
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml		kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
kubernetes_aws_detect_suspicious_kubectl_calls.yml		kubernetes_aws_detect_suspicious_kubectl_calls.yml
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml		kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
kubernetes_azure_detect_rbac_authorization_by_account.yml		kubernetes_azure_detect_rbac_authorization_by_account.yml
kubernetes_azure_detect_sensitive_object_access.yml		kubernetes_azure_detect_sensitive_object_access.yml
kubernetes_azure_detect_sensitive_role_access.yml		kubernetes_azure_detect_sensitive_role_access.yml
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml		kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
kubernetes_azure_detect_suspicious_kubectl_calls.yml		kubernetes_azure_detect_suspicious_kubectl_calls.yml
kubernetes_azure_pod_scan_fingerprint.yml		kubernetes_azure_pod_scan_fingerprint.yml
kubernetes_azure_scan_fingerprint.yml		kubernetes_azure_scan_fingerprint.yml
kubernetes_gcp_detect_RBAC_authorizations_by_account.yml		kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml		kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
kubernetes_gcp_detect_sensitive_object_access.yml		kubernetes_gcp_detect_sensitive_object_access.yml
kubernetes_gcp_detect_sensitive_role_access.yml		kubernetes_gcp_detect_sensitive_role_access.yml
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml		kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
kubernetes_gcp_detect_suspicious_kubectl_calls.yml		kubernetes_gcp_detect_suspicious_kubectl_calls.yml
new_container_uploaded_to_aws_ecr.yml		new_container_uploaded_to_aws_ecr.yml
o365_disable_mfa.yml		o365_disable_mfa.yml
o365_excessive_authentication_failures_alert.yml		o365_excessive_authentication_failures_alert.yml
o365_pst_export_alert.yml		o365_pst_export_alert.yml
o365_suspicious_admin_email_forwarding.yml		o365_suspicious_admin_email_forwarding.yml
o365_suspicious_rights_delegation.yml		o365_suspicious_rights_delegation.yml
o365_suspicious_user_email_forwarding.yml		o365_suspicious_user_email_forwarding.yml
View all files