| Radiflow - Exploit Detected |
High |
📦 Radiflow |
| Radiflow - Network Scanning Detected |
High |
📦 Radiflow |
| Radiflow - New Activity Detected |
Medium |
📦 Radiflow |
| Radiflow - Platform Alert |
Medium |
📦 Radiflow |
| Radiflow - Policy Violation Detected |
Medium |
📦 Radiflow |
| Radiflow - Suspicious Malicious Activity Detected |
High |
📦 Radiflow |
| Radiflow - Unauthorized Command in Operational Device |
Medium |
📦 Radiflow |
| Radiflow - Unauthorized Internet Access |
Medium |
📦 Radiflow |
| Ransom Protect Detected a Ransomware Attack |
High |
📦 CTERA |
| Ransom Protect User Blocked |
High |
📦 CTERA |
| Ransomware Attack Detected |
High |
📦 Nasuni |
| Ransomware Client Blocked |
High |
📦 Nasuni |
| Rare and potentially high-risk Office operations |
Low |
📦 Microsoft 365 |
| Rare application consent |
Medium |
📦 Microsoft Entra ID |
| Rare client observed with high reverse DNS lookup count |
Medium |
📦 Windows Server DNS |
| Rare client observed with high reverse DNS lookup count - Anomaly based (ASIM DNS Solution) |
Medium |
📦 DNS Essentials |
| Rare client observed with high reverse DNS lookup count - Static threshold based (ASIM DNS Solution) |
Medium |
📦 DNS Essentials |
| Rare Process as a Service |
Medium |
📦 Microsoft Defender XDR |
| Rare RDP Connections |
Medium |
📄 Standalone Content |
| Rare subscription-level operations in Azure |
Low |
📦 Azure Activity |
| RDP Nesting |
Medium |
📄 Standalone Content |
| Recorded Future Alerts Incident Creation |
Medium |
📦 Recorded Future |
| Recorded Future Identity - Credential Exposure Detected |
High |
📦 Recorded Future Identity |
| Recorded Future Playbook Alerts Incident Creation |
Medium |
📦 Recorded Future |
| Recorded Future Sandbox - Malicious Email Attachment |
High |
📦 Recorded Future |
| Recorded Future Sandbox - Malicious File in Storage Account |
Medium |
📦 Recorded Future |
| RecordedFuture Threat Hunting Domain All Actors |
Medium |
📦 Recorded Future |
| RecordedFuture Threat Hunting Hash All Actors |
Medium |
📦 Recorded Future |
| RecordedFuture Threat Hunting IP All Actors |
Medium |
📦 Recorded Future |
| RecordedFuture Threat Hunting Url All Actors |
Medium |
📦 Recorded Future |
| Recovery Token Deleted |
Low |
📦 Veeam |
| Red Canary Threat Detection ⚠️ |
High |
📦 Red Canary |
| Red Sift - Email with URL to previously unseen domain |
Medium |
📦 Red Sift |
| Red Sift - Login from previously unseen IP address |
Medium |
📦 Red Sift |
| Red Sift - MFA disabled on account |
High |
📦 Red Sift |
| Red Sift - New email with URL from previously unseen sender |
Medium |
📦 Red Sift |
| Red Sift - New email with URL from previously unseen source |
Medium |
📦 Red Sift |
| Refactor AWS policy based on activities in the last 60 days |
High |
📦 Authomize |
| Registries Alerts for Prancer |
High |
📦 Prancer PensuiteAI Integration |
| Registry Persistence via AppCert DLL Modification |
Medium |
📦 Endpoint Threat Protection Essentials |
| Registry Persistence via AppInit DLLs Modification |
Medium |
📦 Endpoint Threat Protection Essentials |
| Regsvr32 Rundll32 Image Loads Abnormal Extension |
High |
📦 Microsoft Defender XDR |
| Regsvr32 Rundll32 with Anomalous Parent Process |
High |
📦 Microsoft Defender XDR |
| Remote Desktop Network Brute force (ASIM Network Session schema) |
Medium |
📦 Network Session Essentials |
| Remote Desktop Protocol - SharpRDP |
Medium |
📦 FalconFriday |
| Remote File Creation with PsExec |
High |
📦 Microsoft Defender XDR |
| Removable storage ONLINE event from secRMM |
High |
📦 Squadra Technologies SecRmm |
| Rename System Utilities |
Medium |
📦 FalconFriday |
| Request for single resource on domain ⚠️ |
Low |
📦 Zscaler Internet Access |
| Response rows stateful anomaly on database |
Medium |
📦 Azure SQL Database solution for sentinel |
| Restore Point Marked as Clean |
Informational |
📦 Veeam |
| Restore Point Marked as Infected |
High |
📦 Veeam |
| Risky user signin observed in non-Microsoft network device |
Medium |
📄 Standalone Content |
| RSA ID Plus - Locked Administrator Account Detected |
Medium |
📦 RSAIDPlus_AdminLogs_Connector |
| Rubrik Critical Anomaly |
Medium |
📦 RubrikSecurityCloud |
| Rubrik Threat Monitoring |
Medium |
📦 RubrikSecurityCloud |
| RunningRAT request parameters |
High |
📄 Standalone Content |