Cloud Instance Modified By Previously Unseen User

The analytic identifies cloud instances being modified by users who have not previously modified them. This activity is significant because it can indicate unauthorized or suspicious changes by potentially compromised or malicious users. If confirmed malicious, this could lead to unauthorized access, configuration changes, or potential disruption of cloud services, posing a significant risk to the organization's cloud infrastructure.