You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Observes for a user performing a specific API call for the first time. This may be suspicious if a user begins interacting with systems they do not typically.
Additional Details
Detail
Value
Type
First Seen
Category
Execution
Apply Risk to Entities
user_username
Signal Name
First Seen AWS API Call: {{action}} from User
Summary Expression
User: {{user_username}} observed executing API Call: {{action}} for service: {{application}}