json .+ Dependably: record from $(dependably.instance). 100100 ^audit$ Dependably: $(dependably.action) on $(dependably.instance). dependably_audit, 100101 ^login\.failure$ ^true$ Dependably: failed login ($(dependably.detail_reason)). authentication_failed,dependably_auth_fail, 100101 ^login\.failure$ ^false$ Dependably: failed login, backfilled history ($(dependably.detail_reason)). dependably_history, 100110 Dependably: repeated failed logins - possible brute force or password spray. authentication_failures, 100101 ^login\.success$ ^true$ Dependably: login by $(dependably.actor_id) via $(dependably.detail_method). authentication_success, 100101 ^login\.success$ ^false$ Dependably: login, backfilled history - $(dependably.actor_id). dependably_history, authentication_success dependably_auth_fail Dependably: successful login straight after a run of failures - possible brute-force success. authentication_success,attacks, 100101 ^lockout\. Dependably: account lockout triggered. authentication_failures, 100101 (scope_denied|_denied|role_mapping_blocked)$ Dependably: authorization denied - $(dependably.detail_raw) dependably_authz,access_denied, 100124 dependably.actor_id Dependably: repeated authorization denials - possible capability probing. dependably_authz,access_denied, 100101 ^auth\.saml\.role Dependably: SAML role change - $(dependably.action). dependably_privilege, 100101 ^saml\.(config_|signing_cert_|metadata_) Dependably: SAML configuration changed - $(dependably.action). dependably_config, 100101 ^mfa\. Dependably: MFA lifecycle - $(dependably.action) by $(dependably.actor_id). dependably_credentials, 100129 ^mfa\.(disabled|recovery_code_used)$ Dependably: MFA WEAKENED - $(dependably.action) by $(dependably.actor_id). dependably_credentials,dependably_privilege, 100101 ^system_admin\. Dependably: instance-operator action - $(dependably.action). dependably_privilege, 100101 ^token\.created$ Dependably: API token created by $(dependably.actor_id). dependably_credentials, 100101 ^token\.revoked$ Dependably: API token revoked by $(dependably.actor_id). dependably_credentials, 100101 ^(rbac\.|auth\.saml\.role) Dependably: privilege change - $(dependably.action). dependably_privilege, 100101 ^user\.(password_changed|password_reset|email_changed)$ Dependably: credential change - $(dependably.action). dependably_credentials, 100101 ^tenant\.setting\.change$ Dependably: setting $(dependably.detail_key) changed from $(dependably.detail_prior_value) to $(dependably.detail_new_value). dependably_config, 100150 (policy|enforcement|block|verify|overwrite|anonymous|retention|quota|mfa|sso) Dependably: SECURITY setting $(dependably.detail_key) changed from $(dependably.detail_prior_value) to $(dependably.detail_new_value). dependably_config, 100101 ^tenant\.(created|restored|status_changed|quota_changed)$ Dependably: tenant lifecycle - $(dependably.action). dependably_config, 100101 ^tenant\.(deleted|hard_deleted)$ Dependably: tenant DELETED - $(dependably.action). dependably_config, 100100 ^activity$ Dependably: $(dependably.action) refused for $(dependably.purl). dependably_activity, 100102 ^blocked_(malicious|malicious_live|kev|kev_ransomware|ssvc_exploitation)$ Dependably: BLOCKED known-malicious/actively-exploited package - $(dependably.action) on $(dependably.purl). dependably_activity,dependably_supplychain, 100102 ^blocked_(epss|epss_percentile|vuln_score)$ Dependably: blocked on vulnerability score - $(dependably.action) on $(dependably.purl). dependably_activity,dependably_supplychain, 100102 ^blocked_(license|provenance|deprecated|install_script|revoked|manual|release_age)$ Dependably: blocked by policy - $(dependably.action) on $(dependably.purl). dependably_activity, 100102 dependably.actor_id Dependably: repeated policy refusals from one actor - possible probing. dependably_activity,access_denied, 100100 ^poller_error$ Dependably: SIEM poller failed at stage $(dependably.stage) - $(dependably.message). dependably_health,