Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
CloudHSM control plane and audit V-038
Finds hardware security module clusters, HSMs and backups deleted, copied out, restored or reshared by anyone but the deployer.
Checks
| Checks | Needs |
|---|---|
| Checks that no cluster, HSM or backup is deleted, copied out, restored or reshared by anyone but the deployer. | Live events: hsm_control |
Coverage
Could not read anything this run
Run history
No run has recorded this rule yet.
Findings
No open findings.
What it fed
No case has used a finding of this rule in the last 30 days.
Techniques
None mapped.
How to fix
LookupEvents replay for the scope, warden show (receipt) → raise the budget, fix delegation or the spoke trust by PR; read-only