Browse Rules

1Password Login From CrowdStrike Unmanaged Device

Detects 1Password Logins from IP addresses not found in CrowdStrike''s AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor.

A backdoored version of XZ or liblzma is vulnerable to CVE-2024-3094

Detects vulnerable versions of XZ and liblzma on Linux and MacOS using Osquery logs. Versions 5.6.0 and 5.6.1 of xz and liblzma are most likely vulnerable to backdoor exploit. Vuln management pack must be enabled: https://github.com/osquery/osquery/blob/master/packs/vuln-management.conf

A CloudTrail Was Created or Updated

A CloudTrail Trail was created, updated, or enabled.

A Login from Outside the Corporate Office

A system has been logged into from a non approved IP space.

A long-lived cert was created

An unusually long-lived Teleport certificate was created

A More Friendly Name

An optional Description

A More Friendly Name

An optional Description

A SAML Connector was created or modified

A SAML connector was created or modified

A Teleport Lock was created

A Teleport Lock was created

A Teleport Role was modified or created

A Teleport Role was modified or created

A user authenticated with SAML, but from an unknown company domain

A user authenticated with SAML, but from an unknown company domain

A User from the company domain(s) Logged in without SAML

A User from the company domain(s) Logged in without SAML

A User Role with Sensitive Permissions has been Created

A Panther user role has been created that contains admin level permissions.

A User's Panther Account was Modified

A Panther user's role has been modified. This could mean password, email, or role has changed for the user.

Account Security Configuration Changed

An account wide security configuration was changed.

Action Performed by Netskope Personnel

An action was performed by Netskope personnel.

Admin logged out because of successive login failures

An admin was logged out because of successive login failures.

Admin Role Assigned

Assigning an admin role manually could be a sign of privilege escalation

Amazon Machine Image (AMI) Modified to Allow Public Access

An Amazon Machine Image (AMI) was modified to allow it to be launched by anyone. Any sensitive configuration or application data stored in the AMI's block devices is at risk.

An administrator account was created, deleted, or modified.

An administrator account was created, deleted, or modified.

Anthropic Admin API Key Created

Detects when a new admin API key is created. Admin API keys have elevated privileges and their creation should be verified as authorized. The admin_api_key_id and scopes fields identify the key and its permissions.

Anthropic Admin API Key Deleted

Detects when an admin API key is deleted. Unauthorized deletion could indicate an attacker revoking legitimate credentials to disrupt operations or covering tracks after using a compromised key.

Anthropic Artifact Shared Publicly

Detects when an artifact's sharing audience is changed to public. Public artifacts are accessible to anyone with the link, which could expose sensitive content outside the organization.

Anthropic Excessive Chat Access Failures

Detects when a single actor generates more than 50 chat access failures within a 10-minute window. Could indicate automated chat enumeration or unauthorized bulk access attempts. The claude_chat_id field identifies which chats were targeted — sequential or patterned IDs suggest scripted enumeration, while scattered IDs suggest shared-link browsing.

Anthropic Integration Connected

Tracks when a user connects an external integration (e.g., GitHub, Google Drive) to their Anthropic account. Logged for compliance visibility into external data pathways. The integration_type field identifies which service was connected.