AWS Suspicious Provisioning Activities

• AWS Cloud Provisioning From Previously Unseen City :
  endpoint AWS Instance 2024-11-14 version:5
  This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.


• AWS Cloud Provisioning From Previously Unseen IP Address :
  endpoint AWS Instance 2024-11-14 version:5
  This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.


• AWS Cloud Provisioning From Previously Unseen Region :
  endpoint AWS Instance 2024-11-14 version:4
  This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.


• AWS Cloud Provisioning From Previously Unseen Country :
  endpoint AWS Instance 2024-11-14 version:5
  This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.