Cloud MFA Violation IOMs
This query outputs all identified indicators of misconfigurations (IOMs) related to MFA violations.
CQL · Falcon Next-Gen SIEMCopy query
CloudService="IAM" | in(field="policy_id", values=["188", "10", "189", "602", "187", "539"])
| groupBy([PolicyStatement])
| #type != "KGHOST_Gametime"cloud_mfa_violation_ioms.yml
CrowdStrike
Monitoring
Cloud
CSPM / ASPM / DSPM
2025-08-26
2025-11-01
