LoFP LoFP / t1213

t1213

TitleTags
a self-hosted runner is automatically removed from github if it has not connected to github actions for more than 14 days.
allowed self-hosted runners changes in the environment.
an ephemeral self-hosted runner is automatically removed from github if it has not connected to github actions for more than 1 day.
approved automation that uses chatgpt's slack connector for triage or knowledge lookup. raise the distinct-query threshold if those roles remain noisy.
approved mcp apps such as slack or ticketing connectors generate routine traffic during normal work. first-seen alerts are common during onboarding when a user first uses an approved app.
approved rollout of codex plugins such as slack, gmail, or google drive for engineering or support teams. confirm the plugin against your workspace connector inventory and change process before escalating.
automated scripts or processes that retrieve secrets or keys for legitimate purposes, such as secret rotation or application configuration, may also lead to false positives.
azure arc system components may create or update secrets and configmaps in the azure-arc and azure-arc-release namespaces during normal cluster management. filter by namespace to exclude these.
developers testing new applications or oauth flows in non-production tenants may generate alerts during development cycles.
engineers enable approved codex mcp connectors for github, slack, ticketing, and internal tools during normal development. validate the tool name, connector, and whether the integration matches an approved workflow.
gitleaks is a legitimate open-source tool used by security professionals and developers to search for sensitive information, such as passwords, api keys, and other secrets, within code repositories. it is commonly employed during security assessments and code reviews to identify potential vulnerabilities.
helm operations managed through arc may create release secrets (prefixed with sh.helm.release.v1). these are normal arc lifecycle operations.
hr or finance personnel legitimately searching for employee or financial records.
hr, legal, finance, or ir users who legitimately search gmail for attachments, payroll, or contract terms via chatgpt.
hr, legal, finance, or vendor-management workflows that legitimately search drive for payroll, nda, or contract terms across several queries. validate the query values and business context before escalating.
incident responders, support engineers, or community managers who run many slack search refinements in a short window. validate the query values and business context before escalating.
it administrators searching for configuration or infrastructure documentation.
it administrators using pnp powershell for site management, migration, or backup operations.
legal teams searching for contract or privileged documents.
legitimate automation scripts using powershell to interact with sharepoint or onedrive for business purposes.
legitimate nfs root squashing misconfiguration, administrative automation, or backup appliances may present uid 0 from known infrastructure. confirm the source ip against approved nfs client inventories before closing.
legitimate user activity.
legitimate users may export dynamodb tables for various reasons, such as data analysis or backup purposes. ensure that the user has the necessary permissions and that the exporttabletopointintime operation is authorized before taking action.
legitimate users may scan dynamodb tables for various reasons, such as data analysis or application functionality. ensure that the user has the necessary permissions and that the scan operation is authorized before taking action.
new legitimate applications or integrations recently deployed in the environment may trigger this detection during initial setup or rollout phases.
power users and legitimate multi-connector codex workflows (for example slack + github + google drive in one session) can approach these thresholds. raise `esql.gen_ai_tool_name_count_distinct` or `esql.connector_id_count_distinct` above your baseline before broad enablement.
power users iterating many related document titles in one session. raise the distinct-query or sensitive-query thresholds if approved roles remain noisy.
security or compliance teams using ediscovery or content search for legitimate investigations.
security teams performing routine audits or assessments that involve retrieving keys or secrets from key vaults may trigger this rule if they perform multiple retrievals in a short time frame.
service accounts or applications that frequently access azure key vault for configuration or operational purposes may trigger this rule.
snapshot exports may be performed by administrators, automation pipelines, or data engineering workflows. confirm whether the export was expected and initiated by an authorized user, role, or automation process. snapshot exports by unfamiliar principals or from unexpected networks should be investigated. if known behavior causes false positives, it can be exempted from the rule.
third-party saas applications with sharepoint integration may appear as new app ids when users first authorize access.
unlikely
users exporting or reviewing many drive files through chatgpt during approved research, ediscovery, or migration work.
validate the actor if permitted to access the repo.
validate the deletion activity is permitted. the \"actor\" field need to be validated.
validate the multifactor authentication changes.