Sunturai
Back to results
HighMicrosoft Sentinel analytics

User deletes items in bulk

This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and report the total…

Description

This will alert you if a user deletes items in bulk, namely, more than 10 items or in the span of 10 minutes. If a mix of bulk and one-off deletions were performed, this will group all actions and report the total number of items deleted.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSLinuxmacOSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
nordpass
Log source service
nordpasseventlogs_cl

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice