Threat Findings
Threat Findings
Favorite
Favorite
Priority
Priority
Severity
Severity
Finding
Finding
SLA
SLA
Data Source
Data Source
Finding Source
Finding Source
Created At
Created At
Principal Name
Principal Name
Status
Status
Assignee
Assignee
Account
Account
Mitre Tactic
Mitre Tactic
Mitre Technique
Mitre Technique
Exaforce Tags
Exaforce Tags
Recommendation
Recommendation
Workflows
Workflows
Signals are the potential threats that are detected in the findings.
Threat signals are indicators or patterns that suggest a potential security risk, attack, or vulnerability in a system, network, or organization. These signals can come from various sources and help security teams detect, prevent, and respond to cyber threats
Signal Name
Signal Name
Signal Description
Signal Description
Data Source
Data Source
# Findings
# Findings
N/A
N/A
N/A
N/A
1
1
Sensitive Action Performed
Sensitive Action Performed
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
2
2
Suspicious IP
Suspicious IP
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
2
2
Operation Anomaly
Operation Anomaly
Unusual patterns in API operations, including anomalous read/write operations, activities by root accounts, long-term credential usage, and new types of actions.
Unusual patterns in API operations, including anomalous read/write operations, activities by root accounts, long-term credential usage, and new types of actions.
14
14
Location Anomaly
Location Anomaly
Access detected from a new or previously unseen geographic location, including access through external identity providers.
Access detected from a new or previously unseen geographic location, including access through external identity providers.
1
1
Client Attribute Anomaly
Client Attribute Anomaly
Anomalies in client characteristics such as user agent strings, indicating access from unusual client applications or configurations.
Anomalies in client characteristics such as user agent strings, indicating access from unusual client applications or configurations.
7
7
Dormant Principal Anomaly
Dormant Principal Anomaly
Activity detected from identities or credentials that have been inactive for an extended period, indicating unexpected reactivation of dormant accounts.
Activity detected from identities or credentials that have been inactive for an extended period, indicating unexpected reactivation of dormant accounts.
2
2
IP Anomaly
IP Anomaly
Access from IP addresses not previously associated with the identity or authentication method, indicating new access patterns.
Access from IP addresses not previously associated with the identity or authentication method, indicating new access patterns.
4
4
Impossible Travel
Impossible Travel
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
1
1
Location Anomaly
Location Anomaly
Access detected from a new or previously unseen geographic location, including access through external identity providers.
Access detected from a new or previously unseen geographic location, including access through external identity providers.
1
1
Suspicious IP
Suspicious IP
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
1
1
N/A
N/A
N/A
N/A
3
3
Impossible Travel
Impossible Travel
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
2
2
ASN Anomaly
ASN Anomaly
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
1
1
Sensitive Action Performed
Sensitive Action Performed
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
1
1
Sensitive Action Performed
Sensitive Action Performed
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
4
4
Location Anomaly
Location Anomaly
Access detected from a new or previously unseen geographic location, including access through external identity providers.
Access detected from a new or previously unseen geographic location, including access through external identity providers.
1
1
Impossible Travel
Impossible Travel
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
1
1
Impossible Travel
Impossible Travel
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
Access attempts from different locations where the time between access events makes physical travel impossible, indicating potential credential sharing or compromise.
1
1
Sensitive Action Performed
Sensitive Action Performed
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
Indicates the execution of a high-privilege sensitive action that could impact your organization security posture or system configuration.
3
3
ASN Anomaly
ASN Anomaly
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
2
2
N/A
N/A
N/A
N/A
1
1
N/A
N/A
N/A
N/A
1
1
Suspicious IP
Suspicious IP
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
Access from IP addresses that are known threats or first-time VPN usage, indicating potentially malicious access attempts.
1
1
ASN Anomaly
ASN Anomaly
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
Unusual network routing patterns detected, including unexpected ASN changes and deviations in cloud/non-cloud network paths.
1
1
Exabot Search
Exabot Search