Sagan informational stable other

[AIRTABLES] changePassword event detected

[AIRTABLES] changePassword event detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AIRTABLES] changePassword event detected"; program:airtable_audit_log_data; json_content:".action","changePassword"; json_map: "src_ip", ".origin.ipAddress"; json_map: "src_ip",".origin.ipAddress"; classtype:system-event; reference:url,airtable.com/developers/web/api/audit-log-event-types; sid:5013620; rev:2; metadata:updated_on 2024_04_19;)

Field Validations

Loading…

Comments (0)

Loading comments...