Detects anomalous authentication activity such as sign-ins from impossible geolocations or legacy protocols from high-privileged accounts.
| Data Component | Name | Channel |
|---|---|---|
| User Account Authentication (DC0002) | azure:signinlogs | Sign-in activity |
| Logon Session Metadata (DC0088) | saas:okta | user.authentication.sso |
| Field | Description |
|---|---|
| AnomalousLocationThreshold | Defines geographic separation (e.g., impossible travel) considered suspicious. |
| ProtocolType | Filter based on legacy or deprecated authentication mechanisms. |
Detects cloud account use for API calls that exceed normal scope, such as IAM changes or access to services never used before.
| Data Component | Name | Channel |
|---|---|---|
| User Account Authentication (DC0002) | AWS:CloudTrail | ConsoleLogin, AssumeRole, ListAccessKeys, CreateUser |
| Logon Session Creation (DC0067) | gcp:audit | admin.googleapis.com |
| Field | Description |
|---|---|
| ServiceInteractionBaseline | Custom list of expected service interactions per user or role. |
| RoleSwitchRateThreshold | Frequency of assume-role operations that triggers an alert. |
Detects unexpected access or usage of cloud productivity tools (e.g., downloading large numbers of files, creating external shares) by internal users.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | m365:unified | FileAccessed, SharingSet |
| User Account Authentication (DC0002) | gcp:audit | drive.activity |
| Field | Description |
|---|---|
| FileDownloadThreshold | Defines excessive access based on number or size of downloads. |
| SharingPolicyViolationThreshold | Defines external sharing behaviors that violate policy. |
Detects login and usage patterns deviating from typical Microsoft 365 or Google Workspace user profiles.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | m365:signin | UserLogin |
| User Account Authentication (DC0002) | gcp:audit | login.event |
| Field | Description |
|---|---|
| BusinessHours | Used to identify logins outside of expected work times. |
| OfficeProductivityToolBaseline | Defines expected application usage per department or role. |