Detection rules › By catalog entry

Defender-CloudAppEvents

Catalog entry	Rules
any	13

any

13 detection rules reference this catalog entry. View catalog entry.

Kusto (13)

Detect PIM elevation with user risk T1548
Hunt for AI Agent activity with Agent Info
Hunt for local AI Agent activity with Agent Info
Mass Download & copy to USB device by single user severity medium T1052
Preview - TI map Domain entity to Cloud App Events severity medium T1071
Preview - TI map Email entity to Cloud App Events severity medium T1566
Preview - TI map IP entity to Cloud App Events severity medium T1071
Preview - TI map URL entity to Cloud App Events severity medium T1071
TI Map Domain entity to Cloud App Events severity medium T1071
TI Map Email entity to Cloud App Events severity medium T1566
TI Map IP entity to Cloud App Events severity medium T1071
TI Map URL entity to Cloud App Events severity medium T1071
Unusual Volume of file deletion by users severity high T1485

Back to all Defender-CloudAppEvents catalog entries