Authomize_v2_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index

---

Attribute	Value
Custom Log V1	Yes 🔶 — uses type-suffixed column names
Ingestion API Supported	✓ Yes

Contents

• Schema
• Solutions
• Connectors
• Content Items

Schema (30 columns)

Source: KQL validation test schema

Column Name	Type
app_s	string
assigneeId_s	string
availability_Value_d	real
Category	string
compliance_s	string
createdAt_t	datetime
critical_Threshold_d	real
description_s	string
duration_d	real
entities_s	string
ID_g	guid
id_s	string
IsActive_s	string
isResolved_b	bool
measurement_Name_s	string
performance_Value_d	real
policy_id_s	string
policy_name_s	string
policy_templateId_s	string
policyId_s	string
recommendation_s	string
severity_s	string
slot_ID_d	real
status_s	string
tactics_s	string
techniques_s	string
TimeGenerated	datetime
updatedAt_t	datetime
url_s	string
warning_Threshold_d	real

Solutions (1)

This table is used by the following solutions:

• Authomize

Connectors (1)

This table is ingested by the following connectors:

Connector	Selection Criteria
Authomize Data Connector

---

Content Items Using This Table (28)

Analytic Rules (21)

In solution Authomize:

Analytic Rule	Selection Criteria
AWS role with admin privileges
AWS role with shadow admin privileges
Access to AWS without MFA
Admin SaaS account detected
Admin password not updated in 30 days
Detect AWS IAM Users
Empty group with entitlements
IaaS admin detected
IaaS policy not attached to any identity
IaaS shadow admin detected
Lateral Movement Risk - Role Chain Length
New direct access policy was granted against organizational policy
New service account gained access to IaaS resource
Password Exfiltration over SCIM application
Privileged Machines Exposed to the Internet
Refactor AWS policy based on activities in the last 60 days
Stale AWS policy attachment to identity
Stale IAAS policy attachment to role
Unused IaaS Policy
User assigned to a default admin role
User without MFA

Hunting Queries (6)

In solution Authomize:

Hunting Query	Selection Criteria
Admin SaaS account detected
IaaS admin detected
IaaS shadow admin detected
Password Exfiltration over SCIM application
Privileged Machines Exposed to the Internet
ateral Movement Risk - Role Chain Length

Workbooks (1)

In solution Authomize:

Workbook	Selection Criteria
Authomize

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Tables Index