user[.]emailDomain
Reported by 2 independent sources · first reported by Elastic Security Labs · last reported
Last reported 2 months ago
What the reports say
6 reports, newest first · the exact sentence from each-
Inside Elastic's agentic SOC: How we took AI alert triage from 60% to 92% accuracy“We look up user details in Workday using the user[.]email field from the alert.”
-
How a team of entity maintainers monitors, connects and scores entities in Elastic Security“| User (identity provider) | user[.]email, then user.id, then user.name@domain, then user.name | user:[email redacted]@okta | Provider name: okta, entra_id, microsoft_365, active_directory |”
-
Inside Elastic InfoSec's agentic SOC: cutting alert triage from 30 minutes to under 3“| KEEP @timestamp, source.ip, user[.]email, event.action”
-
Detection Engineering at Scale: One Step Closer (part one)“user[.]email: '*'”
-
Getting started with Detection-as-Code and Sekoia Platform“git config --global user[.]email "[email redacted]"”
-
Monitoring Claude Code/Cowork at scale with OTel in Elastic“Every event includes user identity (user[.]email, organization.id), session context (session.id, prompt.id, event.sequence), and cost/token fields on API request events.”
Indicators reported together
named in the same reports- allsafecyber[.]comin 1 report
- requests[.]postin 1 report
- file[.]readin 1 report
- elastic[.]comin 1 report
- logs-endpoint[.]eventsin 1 report
- organization[.]idin 1 report
- session[.]idin 1 report
- prompt[.]idin 1 report
- attributes.event[.]namein 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.