Elastic low stable eql
Rare Azure Activity Logs Event Failures
A machine learning job detected an unusual failure in an Azure Activity Logs message. These can be byproducts of attempted or successful persistence, privilege escalation, defense evasion, discovery, lateral movement, or collection.
Detection Logic
False Positives
- ⚠ Rare and unusual failures may indicate an impending service failure state. Rare and unusual user failure activity can also be due to manual troubleshooting or reconfiguration attempts by insufficiently privileged users, bugs in cloud automation scripts or workflows, or changes to IAM privileges.
Field Validations
Loading…
Comments (0)
Loading comments...