Rules Contributing to OCI Discovery Activity Alert

This topic covers a feature that is not available for all customers yet. See Early Access Program Features and Topics Under Development.
The following rules are used to identify suspicious discovery activity in OCI. Any one or more of these will trigger the OCI Discovery Activity Alert. Details for each rule can be viewed by clicking the More Details link in the description.
Title |
Description |
||||||||
---|---|---|---|---|---|---|---|---|---|
OCI Discovery Activity |
Detects possible discovery activity. More details
![]() Rule IDQuery{'selection': {'eventName|startswith': ['get', 'list']}, 'condition': 'selection | count() by CreatedBy > 20', 'timeframe': '10m'} Log SourceStellar Cyber OCI configured. Rule SourceDeveloped internally by Stellar Cyber Tactics, Techniques, and ProceduresReferences
N/A
Severity50 Suppression Logic Based On
Additional Information
|