100210,100211 ^(?:policy_updated|organization_data_governance_policy_updated)$ Audit or data-governance policy changed. decisionterrain_detection, 100210,100211 ^(?:evidence_revealed|export_created|export_downloaded|investigation_evidence_used|audit_explanation_evidence_requested|audit_explanation_evidence_used|audit_explanation_revealed|security_audit_exported|organization_portable_export_requested)$ Audit evidence revealed or exported. decisionterrain_detection, 100210,100211 ^(?:siem_destination_stop|siem_destination_pause|siem_destination_retire|siem_installation_forwarding_changed|siem_installation_eligibility_changed|siem_installation_storage_limits_changed)$ SIEM forwarding stopped or restricted. decisionterrain_detection, 100210,100211 ^(?:organization_api_key_created|scim_token_created|scim_token_rotated|machine_identity_created|machine_identity_version_activated|security_service_identity_created|security_service_credential_rotated|native_integration_credentials_created)$ Credential or machine identity issued. decisionterrain_detection, 100210,100211 ^(?:organization_member_role_updated|scim_group_mapping_updated|scim_default_role_updated|organization_access_policy_updated|organization_invite_created)$ Role mapping or access policy changed. decisionterrain_detection, 100210,100211 ^(?:connection_deactivated|recovery_enforcement_relaxed|recovery_kit_created|recovery_kit_rotated|recovery_session_started|identity_unlinked)$ SSO enforcement weakened or recovery used. decisionterrain_detection, 100210,100211 ^(?:security_rule_halt_accepted|external_security_halt_accepted|internal_security_halt_accepted|security_halt_batch_started)$ Agent security hold placed. decisionterrain_detection, 100210,100211 ^(?:agent_emergency_.*|sandbox_emergency_.*)$ ^(?:failed)$ Emergency control step failed. decisionterrain_detection, 100210,100211 ^(?:member_login_failed)$ Repeated failed sign-ins for one account. decisionterrain_detection, 100236 ResourceId Repeated failed sign-ins for one account. decisionterrain_detection, 100210,100211 ^(?:api_key_authentication_failed|service_credential_authentication_failed)$ Repeated rejected API key or service credential. decisionterrain_detection, 100238 ResourceId Repeated rejected API key or service credential. decisionterrain_detection, 100212,100213 ^(?:security_rule_evaluated|sandbox_network_request)$ ^(?:denied)$ Agent repeatedly denied by policy. decisionterrain_detection, 100240 AgentId Agent repeatedly denied by policy. decisionterrain_detection,