LoFP LoFP / t1578

t1578

TitleTags
legitimate aad health ad fs service instances being deleted in a tenant
legitimate ad fs servers added to an aad health ad fs service instance
restoring snapshots may be done by a system or network administrator. verify whether the user identity, user agent, and/or hostname should be making changes in your environment. snapshot restoration by unfamiliar users or hosts should be investigated. if known behavior is causing false positives, it can be exempted from the rule.
storage bucket configuration may be modified by system administrators. verify that the configuration change was expected. exceptions can be added to this rule to filter expected behavior.