Cortex RBAC Role Created
Detects the creation of a new role-based access control (RBAC) role within the Cortex management plane. This activity is significant as new roles can define access to sensitive administrative and security capabilities and should be reviewed to ensure alignment with least-privilege principles and authorized access-management requirements.
Microsoft Sentinel (KQL)

