Idira - Sensitive Safe/Permission/Entitlement Changes (with customData)

Alerts on control-plane modifications: safes, permissions, roles, entitlements, policy changes. Leverages customData fields such as changeType/role/permission/policy/entitlement to reduce misses.

Detection logic

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

Detection rules

Idira - Sensitive Safe/Permission/Entitlement Changes (with customData)

Detection logic

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules