Browse Rules

Search and filter across all detection sources

1,373 rules

sagan medium other

[FORTINET] Configuration change

[FORTINET] Configuration change
sagan medium other

[FORTINET] Configuration change

[FORTINET] Configuration change
sagan medium other

[CISCO-IOS] Configuration from console

[CISCO-IOS] Configuration from console
sagan medium other

[CISCO-IOS] IOS configuration changed

[CISCO-IOS] IOS configuration changed
sagan medium other

[CONFLUENT] Kafka Configuration Altered/Updated

[CONFLUENT] Kafka Configuration Altered/Updated
wazuh low xml

Missing directory configuration

Missing directory configuration
sagan medium other

[CONFLUENT] Kafka Broker Dynamic Configuration Altered

[CONFLUENT] Kafka Broker Dynamic Configuration Altered
sagan medium other

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (ACL)

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (ACL)
sagan medium other

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (SuperUser)

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (SuperUser)
wazuh informational xml

Auditd: Configuration changed

Auditd: Configuration changed
wazuh low xml

sshd: configuration error (moduli).

sshd: configuration error (moduli).
wazuh low xml

sshd: configuration error (AuthorizedKeysCommand)

sshd: configuration error (AuthorizedKeysCommand)
wazuh informational xml

racoon: Roadwarrior configuration (ignored error).

racoon: Roadwarrior configuration (ignored error).
wazuh informational xml

racoon: Roadwarrior configuration (ignored warning).

racoon: Roadwarrior configuration (ignored warning).
wazuh informational xml

Security Configuration Assessment: check event

Security Configuration Assessment: check event
wazuh low xml

SQL Shadow Copy configuration error

SQL Shadow Copy configuration error
wazuh low xml

AWS Config - Snapshot Compliance [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)] [$(aws.configuration.configRuleList.configRuleName)]: $(aws.resourceId) ($(aws.configurationItemStatus)) $(aws.configuration.complianceType)

AWS Config - Snapshot Compliance [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)] [$(aws.configuration.configRuleList.configRuleName)]: $(aws.resourceId) ($(aws.configurationItemStatus)) $(aws.configuration.complianceType)
wazuh informational xml

Zeus: Configuration warning (ignored).

Zeus: Configuration warning (ignored).
wazuh low xml

The configuration data registry key, sub key or configuration data cache folder were not secured properly

The configuration data registry key, sub key or configuration data cache folder were not secured properly
hayabusa high sigma

Windows Defender Configuration Changes

Detects suspicious changes to the Windows Defender configuration
sagan informational other

[CyberArk] Get LDAP configuration data

[CyberArk] Get LDAP configuration data
sagan informational other

[CyberArk] LDAP Configuration Refresh failed

[CyberArk] LDAP Configuration Refresh failed
sagan informational other

[GCP] Instance - Access Configuration Added

[GCP] Instance - Access Configuration Added
sagan informational other

[GCP] Instance - Access Configuration Deleted

[GCP] Instance - Access Configuration Deleted
sigma high sigma

Auditing Configuration Changes on Linux Host

Detect changes in auditd configuration files