Every published rule

This rule detects a login attempt in Google Workspace flagged as a potential attack by a government-backed threat actor

This rule detects potentially anomalous events involving "GetSigninToken". An adversary using the "aws_consoler" tool can abuse this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.

This rule detects two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.

This rule detects suggests that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.

This rule detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts.