LoFP LoFP / t1578

t1578

TitleTags
legitimate aad health ad fs service instances being deleted in a tenant
legitimate ad fs servers added to an aad health ad fs service instance
legitimate manual or automated snapshots created for backups can trigger this rule. ensure that the snapshots are authorized and align with your organization's policies.
restoring db instances may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. instance restoration by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
storage bucket configuration may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.