Security controls and monitoring
This category groups related risk explanations. A finding is a reason to review the activity and its context, not proof that a breach occurred.
Risk types
Section titled “Risk types”- Sandbox and permission configuration changes
A call contains a recognized pattern associated with agent sandbox or permission changes.
- Monitoring configuration access and removal
A call touches selected Omnodex paths or resembles removing, stopping, or changing monitoring.
Event categories
Section titled “Event categories”These event category values map to this library category: sandbox_disable, self_protection. Use the rule index to find the explanation for a specific rule ID.