Cloud Compute Instance Created By Previously Unseen User

Description

This search looks for cloud compute instances created by users who have not created them before.

   Help

Cloud Compute Instance Created By Previously Unseen User Help

You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users.

   Search

Open in Search

   Baseline Generation Searches

This detection relies on the following searches to generate the baseline lookup.

  • Previously Seen Cloud Compute Creations By User - Initial
  • Previously Seen Cloud Compute Creations By User - Update