Threat Findings
Threat Findings
Time Rangelast 30 days
False Positive Rate
False Positive Rate
4
Needs investigation
Benign
Exabots at work
False positive
Data Source by Severity
Data Source by Severity
12
Amazon AWS (20)
Amazon AWS (20)
Critical(1)
High(3)
Medium(10)
Low(6)
Exaforce (13)
Exaforce (13)
Critical(9)
High(4)
Google Workspace (11)
Google Workspace (11)
High(7)
Medium(4)
Okta (9)
Okta (9)
High(5)
Medium(4)
Azure (5)
Azure (5)
High(2)
Medium(3)
Google Cloud Platform (4)
Google Cloud Platform (4)
High(1)
Medium(1)
Low(2)
Atlassian (3)
Atlassian (3)
High(2)
Medium(1)
Slack (3)
Slack (3)
High(2)
Low(1)
OpenAI (2)
OpenAI (2)
High(1)
Medium(1)
Microsoft 365 (2)
Microsoft 365 (2)
Medium(2)
EKS (1)
EKS (1)
High(1)
Microsoft EDR (1)
Microsoft EDR (1)
Medium(1)
Threat Findings
i18n_d2ab282bf4a4c92c3ad632840c9488d8
74

Group by

SeverityData SourceFinding Source
  • Nothing was found
Favorite
Favorite
Priority
Priority
Severity
Severity
Finding
Finding
SLA
SLA
Data Source
Data Source
Finding Source
Finding Source
Created At
Created At
Principal Name
Principal Name
Status
Status
Assignee
Assignee
Account
Account
Mitre Tactic
Mitre Tactic
Mitre Technique
Mitre Technique
Exaforce Tags
Exaforce Tags
Recommendation
Recommendation
Workflows
Workflows
P1
High
High-Risk User API Token Rotation from New WeWork Location
ac7c86b2-9f7b-41c7-82a1-8fb042bdb04c
ac7c86b2-9f7b-41c7-82a1-8fb042bdb04c
ac7c86b2-9f7b-41c7-82a1-8fb042bdb04c
ac7c86b2-9f7b-41c7-82a1-8fb042bdb04c

1h 45m over

1h 45m over

Atlassian
Atlassian
Exaforce
Exaforce
USER
USER
8 hours ago
8 hours ago
Madhukar Nayakbomman
Madhukar Nayakbomman
Atlassian
•
user
Open
Select items...
0834f3f9-a0c0-4049-ab85-efc0eff1230b
0834f3f9-a0c0-4049-ab85-efc0eff1230b
exaforce-team-rqqk3tzs
exaforce-team-rqqk3tzs
Credential Access
Steal Application Access Token
Select items...
Needs Investigation
P2
Medium
High Risk Administrator Deleted User Account - Dima Semyushkin
96909ba5-62d1-45be-be69-5ec3c814a05c
96909ba5-62d1-45be-be69-5ec3c814a05c
96909ba5-62d1-45be-be69-5ec3c814a05c
96909ba5-62d1-45be-be69-5ec3c814a05c

5h 53m left

Google Workspace
Google Workspace
Exaforce
Exaforce
USER
USER
17 hours ago
17 hours ago
nuno@exaforce.com
nuno@exaforce.com
Google Workspace
•
user
Open
Select items...
C03f0zuwe
C03f0zuwe
Exaforce
Exaforce
Impact
Account Access Removal
Select items...
Needs Investigation
P1
High
Access from Blocked Country Detected - OpenAI Login from Latvia
23ce32e4-750d-49b9-8104-c14586c4d02a
23ce32e4-750d-49b9-8104-c14586c4d02a
23ce32e4-750d-49b9-8104-c14586c4d02a
23ce32e4-750d-49b9-8104-c14586c4d02a

15h 1m over

OpenAI
OpenAI
Exaforce
Exaforce
USER
USER
22 hours ago
22 hours ago
mallam@exaforce.com
mallam@exaforce.com
OpenAI
•
user
Open
Select items...
org-LUjMiiPr8rRrxb1OGIhrpeZR
org-LUjMiiPr8rRrxb1OGIhrpeZR
kwapik-exa
kwapik-exa
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Threat detected - Access from blocked country detected
350c5015-bbeb-4e7c-aeb5-cba8d624e562
350c5015-bbeb-4e7c-aeb5-cba8d624e562
350c5015-bbeb-4e7c-aeb5-cba8d624e562
350c5015-bbeb-4e7c-aeb5-cba8d624e562

58m left

Azure
Azure
Exaforce
Exaforce
USER
USER
22 hours ago
22 hours ago
mallam@exaforce.com
mallam@exaforce.com
Azure
•
EntraIDUser
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
exaforce.com
exaforce.com
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Access from Blacklisted Country (Latvia) via VPN and Mobile Network Geolocation False Positive
fa2e0e39-8ead-4b84-9844-cb02864979e3
fa2e0e39-8ead-4b84-9844-cb02864979e3
fa2e0e39-8ead-4b84-9844-cb02864979e3
fa2e0e39-8ead-4b84-9844-cb02864979e3

2h 22m over

2h 22m over

Okta
Okta
Exaforce
Exaforce
USER
USER
1 day ago
1 day ago
mallam@exaforce.com
mallam@exaforce.com
Okta
•
user
Open
Select items...
exaforce
exaforce
exaforce
exaforce
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
High
Atlassian: Admin API Keys Created from TOR Network with Okta Risk Detection
3c02d2bb-b176-45ba-b9df-9fd5d56019a5
3c02d2bb-b176-45ba-b9df-9fd5d56019a5
3c02d2bb-b176-45ba-b9df-9fd5d56019a5
3c02d2bb-b176-45ba-b9df-9fd5d56019a5

3h 1m over

Atlassian
Atlassian
Exaforce
Exaforce
USER
USER
1 day ago
1 day ago
Chirag Patel
Chirag Patel
Atlassian
•
user
Open
Select items...
d9b00056-b87b-4533-b6f7-23c56092cb60
d9b00056-b87b-4533-b6f7-23c56092cb60
exaforce-jira
exaforce-jira
Credential Access
Unsecured Credentials
Select items...
Needs Investigation
P0
Critical
High-Risk User Systematically Disabling CloudTrail Logging and Preparing Data Exfiltration Infrastructure
fbb240c9-71e0-4cd7-9a79-70e220715ace
fbb240c9-71e0-4cd7-9a79-70e220715ace
•
Attack Chains: 4
Attack Chains: 4

1d 20h over

1d 20h over

Exaforce
Exaforce
Exaforce
Exaforce
1 day ago
1 day ago
bproko
bproko
IDCUser
IDCUser
Open
Select items...

N/A

N/A

Defense Evasion
Impair Defenses
Select items...
Needs Investigation
P1
High
High-Risk User Conducts Multi-Account Reconnaissance and Defense Evasion Attack
3c1a0ee3-a1b4-4d14-814c-f3cdaea42524
3c1a0ee3-a1b4-4d14-814c-f3cdaea42524
•
Attack Chains: 5
Attack Chains: 5

1d 16h over

1d 16h over

Exaforce
Exaforce
Exaforce
Exaforce
1 day ago
1 day ago
bproko
bproko
IDCUser
IDCUser
Open
Select items...

N/A

N/A

Defense Evasion
Impair Defenses
Select items...
Needs Investigation
P2
Medium
AWS CloudTrail Trail Deletion Detected - thesplunktrail deleted in demo-account
83cbba8a-6eca-43ca-95e7-fbd7d0d9317c@...ble@@83cbba8a6eca43ca95e7fbd7d0d9317c
83cbba8a-6eca-43ca-95e7-fbd7d0d9317c@@notable@@83cbba8a6eca43ca95e7fbd7d0d9317c
83cbba8a-6eca-43ca-95e7-fbd7d0d9317c@@notable@@83cbba8a6eca43ca95e7fbd7d0d9317c
83cbba8a-6eca-43ca-95e7-fbd7d0d9317c@@notable@@83cbba8a6eca43ca95e7fbd7d0d9317c

1d 26m over

Amazon AWS
Amazon AWS
Splunk
Splunk
SESSION
SESSION
2 days ago
2 days ago
bproko
bproko
Amazon AWS
•
IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Defense Evasion
Impair Defenses
Select items...
Needs Investigation
P0
Critical
Credential Compromise: User mallam accessing AWS from Latvia datacenter with impossible travel
30980482-527e-4fe3-b736-1b0ab25978d2
30980482-527e-4fe3-b736-1b0ab25978d2
•
Attack Chains: 2
Attack Chains: 2

2d 11h over

2d 11h over

Exaforce
Exaforce
Exaforce
Exaforce
2 days ago
2 days ago
mallam
mallam
IDCUser
IDCUser
Open
Select items...

N/A

N/A

Discovery
Cloud Service Discovery
Select items...
Needs Investigation
P1
High
Sensitive kubectl exec operations performed on snowconnect pods in EKS cluster
0f1472cb-6433-46ec-924d-be3d16b7f900
0f1472cb-6433-46ec-924d-be3d16b7f900
0f1472cb-6433-46ec-924d-be3d16b7f900
0f1472cb-6433-46ec-924d-be3d16b7f900

2d 18h over

2d 18h over

EKS
EKS
Exaforce
Exaforce
USER
USER
3 days ago
3 days ago
vdvorak
vdvorak
EKS
•
user
Open
Select items...
913524906762
913524906762
Exaforce Demo
Exaforce Demo
Execution
Container Administration Command
Select items...
Needs Investigation
P2
Low
High-Risk User Andres Ruiz: Location Anomaly Detected - New City Neuenhof via Sunrise Mobile Network
e3170dac-8bf5-4fcf-a441-bd9c01b54fcc
e3170dac-8bf5-4fcf-a441-bd9c01b54fcc
e3170dac-8bf5-4fcf-a441-bd9c01b54fcc
e3170dac-8bf5-4fcf-a441-bd9c01b54fcc

2d 9h over

2d 9h over

Amazon AWS
Amazon AWS
Exaforce
Exaforce
SESSION
SESSION
3 days ago
3 days ago
andres
andres
Amazon AWS
•
IDCUser
Open
Select items...
157206707803
157206707803
exaforce
exaforce
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
High-risk user bproko assumes administrator role for first time and attempts anomalous Organizations API call from residential network
60d85790-4141-4376-9c7e-902ed12125df
60d85790-4141-4376-9c7e-902ed12125df
60d85790-4141-4376-9c7e-902ed12125df
60d85790-4141-4376-9c7e-902ed12125df

2d 9h over

2d 9h over

Amazon AWS
Amazon AWS
Exaforce
Exaforce
SESSION
SESSION
3 days ago
3 days ago
bproko
bproko
Amazon AWS
•
IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Discovery
Account Discovery
Select items...
Needs Investigation
P0
Critical
Multi-Platform Attack Chain: Endpoint Credential Theft, AWS Infrastructure Manipulation, and Cross-Cloud Persistence Establishment
0949c564-a827-45a9-83b3-5090b6b49659
0949c564-a827-45a9-83b3-5090b6b49659
•
Attack Chains: 5
Attack Chains: 5

3d 5h over

3d 5h over

Exaforce
Exaforce
Exaforce
Exaforce
3 days ago
3 days ago
bproko
bproko
IDCUser
IDCUser
+ 2
Open
Select items...

N/A

N/A

Persistence
Account Manipulation
Select items...
Needs Investigation
P2
Low
Persistence: Service Account Key Created
8bde8967eb6a443fb7c82b0e8fb05b5b
8bde8967eb6a443fb7c82b0e8fb05b5b
8bde8967eb6a443fb7c82b0e8fb05b5b
8bde8967eb6a443fb7c82b0e8fb05b5b

2d 10h over

2d 10h over

Google Cloud Platform
Google Cloud Platform
SCC
SCC
SESSION
SESSION
3 days ago
3 days ago
jpavlik@exaforce.com
jpavlik@exaforce.com
Google Cloud Platform
•
User
Open
Select items...
854659176896
854659176896
g-exaforce-demo-ute3ytnc
g-exaforce-demo-ute3ytnc
Persistence
Account Manipulation
Select items...
Needs Investigation
P2
Medium
BucketVolumeAnomaly: 3086 S3 GetObject operations on demo-exports bucket by ohudek
72b55b79-a84d-4b77-8376-9de606ae2f6b
72b55b79-a84d-4b77-8376-9de606ae2f6b
72b55b79-a84d-4b77-8376-9de606ae2f6b
72b55b79-a84d-4b77-8376-9de606ae2f6b

2d 17h over

2d 17h over

Amazon AWS
Amazon AWS
Exaforce
Exaforce
SESSION
SESSION
3 days ago
3 days ago
ohudek
ohudek
Amazon AWS
•
IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Collection
Data from Cloud Storage
Select items...
Needs Investigation
P0
Critical
Suspected AWS Session Hijacking - Multi-Node TOR Reconnaissance Following Legitimate India Session
cd0ab46a-1bff-4703-935b-78bd47608f46
cd0ab46a-1bff-4703-935b-78bd47608f46
•
Attack Chains: 13
Attack Chains: 13

3d 17h over

3d 17h over

Exaforce
Exaforce
Exaforce
Exaforce
3 days ago
3 days ago
skumar
skumar
IDCUser
IDCUser
Open
Select items...

N/A

N/A

Reconnaissance
Active Scanning
Select items...
Needs Investigation
P2
Medium
Access from Blocked Country Detected - User Login from Latvia
53830ed5-9a70-4d86-9207-d9460eaa7624
53830ed5-9a70-4d86-9207-d9460eaa7624
53830ed5-9a70-4d86-9207-d9460eaa7624
53830ed5-9a70-4d86-9207-d9460eaa7624

2d 23h over

Atlassian
Atlassian
Exaforce
Exaforce
USER
USER
3 days ago
3 days ago
Chandra Sekhar Reddy Mallam
Chandra Sekhar Reddy Mallam
Atlassian
•
user
Open
Select items...
0834f3f9-a0c0-4049-ab85-efc0eff1230b
0834f3f9-a0c0-4049-ab85-efc0eff1230b
exaforce-team-rqqk3tzs
exaforce-team-rqqk3tzs
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Access from blocked country detected - Latvia
431c6ae8-b5f0-45a0-8c61-43e79e266b39
431c6ae8-b5f0-45a0-8c61-43e79e266b39
431c6ae8-b5f0-45a0-8c61-43e79e266b39
431c6ae8-b5f0-45a0-8c61-43e79e266b39

3d 1h over

3d 1h over

Azure
Azure
Exaforce
Exaforce
USER
USER
4 days ago
4 days ago
mallam@exaforce.com
mallam@exaforce.com
Azure
•
EntraIDUser
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
exaforce.com
exaforce.com
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Access from blocked country detected - User successfully logged in from Latvia
46f4621c-c65b-46f9-bf45-2927fec940ee
46f4621c-c65b-46f9-bf45-2927fec940ee
46f4621c-c65b-46f9-bf45-2927fec940ee
46f4621c-c65b-46f9-bf45-2927fec940ee

3d 2h over

3d 2h over

OpenAI
OpenAI
Exaforce
Exaforce
USER
USER
4 days ago
4 days ago
mallam@exaforce.com
mallam@exaforce.com
OpenAI
•
user
Open
Select items...
org-LUjMiiPr8rRrxb1OGIhrpeZR
org-LUjMiiPr8rRrxb1OGIhrpeZR
kwapik-exa
kwapik-exa
Initial Access
Valid Accounts
Select items...
Needs Investigation
P1
High
Dormant Machine Identity Accessed Cross-Account Secret from Internal Network
02ac5104-4535-3ad3-ac92-62a13fe4a353
02ac5104-4535-3ad3-ac92-62a13fe4a353
02ac5104-4535-3ad3-ac92-62a13fe4a353
02ac5104-4535-3ad3-ac92-62a13fe4a353

4d 10m over

4d 10m over

Amazon AWS
Amazon AWS
Exaforce
Exaforce
SESSION
SESSION
4 days ago
4 days ago
AROAXB35XCQOCC7H7SPAZ
AROAXB35XCQOCC7H7SPAZ
Amazon AWS
•
AWSAccount
Open
Select items...
485058090012
485058090012
Credential Access
Credentials from Password Stores
Select items...
Needs Investigation
P1
High
High-risk user session with IP anomaly and security group modification detected
fecbea6b-03dd-4541-a21c-d20cef73f1c8
fecbea6b-03dd-4541-a21c-d20cef73f1c8
fecbea6b-03dd-4541-a21c-d20cef73f1c8
fecbea6b-03dd-4541-a21c-d20cef73f1c8

4d 1h over

Amazon AWS
Amazon AWS
Exaforce
Exaforce
SESSION
SESSION
4 days ago
4 days ago
ahuq
ahuq
Amazon AWS
•
IDCUser
Open
Select items...
934477340168
934477340168
demo-account
demo-account
Discovery
File and Directory Discovery
Select items...
Needs Investigation
P2
Medium
ASN Anomaly Detection: Microsoft 365 Administrative Operations from Cloud Infrastructure
a25db47e-7922-4f5f-8b49-dcbdbbd9e73f
a25db47e-7922-4f5f-8b49-dcbdbbd9e73f
a25db47e-7922-4f5f-8b49-dcbdbbd9e73f
a25db47e-7922-4f5f-8b49-dcbdbbd9e73f

3d 16h over

3d 16h over

Microsoft 365
Microsoft 365
Exaforce
Exaforce
USER
USER
4 days ago
4 days ago
madhukar@exaforce.com
madhukar@exaforce.com
Microsoft 365
•
user
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
jpavlikexafor...microsoft.com
jpavlikexaforce.onmicrosoft.com
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Access from blocked country detected - Latvia
ace8ed5e-e621-41db-a9f9-464eebf5186c
ace8ed5e-e621-41db-a9f9-464eebf5186c
ace8ed5e-e621-41db-a9f9-464eebf5186c
ace8ed5e-e621-41db-a9f9-464eebf5186c

3d 21h over

Google Workspace
Google Workspace
Exaforce
Exaforce
USER
USER
4 days ago
4 days ago
mallam@exaforce.com
mallam@exaforce.com
Google Workspace
•
user
Open
Select items...
C03f0zuwe
C03f0zuwe
Exaforce
Exaforce
Initial Access
Valid Accounts
Select items...
Needs Investigation
P2
Medium
Microsoft 365 Access from TOR Network - Suspicious IP Detection
287fe03a-1324-4485-b7da-483993a1aefe
287fe03a-1324-4485-b7da-483993a1aefe
287fe03a-1324-4485-b7da-483993a1aefe
287fe03a-1324-4485-b7da-483993a1aefe

5d 2h over

5d 2h over

Microsoft 365
Microsoft 365
Exaforce
Exaforce
USER
USER
6 days ago
6 days ago
chithra@exaforce.com
chithra@exaforce.com
Microsoft 365
•
user
Open
Select items...
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
7c86bd1f-6161-48e1-ae9c-9cd406835b6f
jpavlikexafor...microsoft.com
jpavlikexaforce.onmicrosoft.com
Initial Access
Valid Accounts
Select items...
Needs Investigation

of 3

Category by Data Source
i18n_64b3ed37f507fbfeb1bbfcfd25a4b9b1
Less
More
 (3)
 (20)
 (5)
 (1)
 (13)
 (4)
 (11)
 (2)
 (1)
 (9)
 (2)
 (3)
 Data (6)
0
5
0
0
0
0
0
1
0
0
0
0
 Endpoint (2)
0
0
0
0
0
1
0
0
1
0
0
0
 Identity (50)
3
10
5
0
11
2
4
1
0
9
2
3
 Kubernetes (5)
0
2
0
1
2
0
0
0
0
0
0
0
 Malware (1)
0
0
0
0
0
1
0
0
0
0
0
0
 Network (1)
0
1
0
0
0
0
0
0
0
0
0
0
 Phishing (7)
0
0
0
0
0
0
7
0
0
0
0
0
 Secret (2)
0
2
0
0
0
0
0
0
0
0
0
0
Exabot Search

Hello, Taylor

Exabot can make mistakes. Verify before making decisions.
Use shift+enter for new line

What workflows are running in the saas_resource_test_fxDi repository and when were they last executed?

Code

Show me all events performed on eni-009dd600f67fa98b0 in the last 30 days

Cloud Resources

What permissions does Sagar Gala have on S3 and are they being used?

Identities

Which resources were accessed in session 9dffb2a6-3e39-4332-9042-8e5e3e72d06b?

Sessions
Exabot Search

Nov 21 2025, 04:00 PM

Needs investigation

2

Benign

0

Exabots at work

0

False positive

0