detection.wiki

Admin Data Action

eventNameDescriptionSampleRule
anySource-only rules that filter on applicationName 'admin_data_action' without specifying an eventName attribute here.NN
SENSITIVE_AUDIT_EVENTS_ACCESSEDViewed sensitive content: sensitive parameters in audit events have been retrieved or reviewed.NN
SENSITIVE_AUDIT_EVENTS_HIDDENRemoved sensitive content: sensitive parameters in audit events have been obscured.NN
SENSITIVE_AUDIT_EVENTS_UNHIDDENRestored sensitive content: sensitive parameters in audit events have been made visible again.NN

any: Admin Data Action (any event)

#
ApplicationName
admin_data_action

Description

Source-only rules that filter on applicationName 'admin_data_action' without specifying an eventName attribute here.

References #

SENSITIVE_AUDIT_EVENTS_ACCESSED: Sensitive Audit Events Accessed

#
ApplicationName
admin_data_action

Description

Viewed sensitive content: sensitive parameters in audit events have been retrieved or reviewed.

References #

SENSITIVE_AUDIT_EVENTS_HIDDEN: Sensitive Audit Events Hidden

#
ApplicationName
admin_data_action

Description

Removed sensitive content: sensitive parameters in audit events have been obscured.

References #

SENSITIVE_AUDIT_EVENTS_UNHIDDEN: Sensitive Audit Events Unhidden

#
ApplicationName
admin_data_action

Description

Restored sensitive content: sensitive parameters in audit events have been made visible again.

References #