Browse Rules

TI Map Domain entity to DnsEvents

Identifies a match in DnsEvents from any Domain IOC from TI

TI map Domain entity to DnsEvents

Identifies a match in DnsEvents from any Domain IOC from TI

M365 Exchange Federated Domain Created or Modified

Identifies a new or modified federation domain, which can be used to create a trust between O365 and an external identity provider.

TI Map Domain entity to EmailEvents

Identifies a match in EmailEvents table from any Domain IOC from TI

TI map Domain entity to EmailEvents

Identifies a match in EmailEvents table from any Domain IOC from TI

TI Map Domain entity to EmailUrlInfo

'Identifies a match in EmailUrlInfo table from any Domain IOC from TI.'

TI map Domain entity to EmailUrlInfo

'Identifies a match in EmailUrlInfo table from any Domain IOC from TI.'

TI Map Domain entity to SecurityAlert

'Identifies a match in SecurityAlert table from any Domain IOC from TI'

TI map Domain entity to SecurityAlert

'Identifies a match in SecurityAlert table from any Domain IOC from TI'

TI Map Domain entity to Syslog

Identifies a match in Syslog table from any Domain IOC from TI

TI map Domain entity to Syslog

Identifies a match in Syslog table from any Domain IOC from TI

Azure Domain Federation Settings Modified

Identifies when an user or application modified the federation settings on the domain.

Cisco Umbrella Domain Name Fuzzy Matching

Identify lookups to suspicious domains that could indicate a phishing attack.

Threat Connect TI map Domain entity to DnsEvents

Identifies a match in DnsEvents from any ThreatConnect Domain IOC from TI

TI Map Domain entity to PaloAlto CommonSecurityLog

Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI

TI map Domain entity to PaloAlto CommonSecurityLog

Identifies a match in PaloAlto CommonSecurityLog table from any Domain IOC from TI

TI Map Domain entity to PaloAlto

'Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI'

TI map Domain entity to PaloAlto

'Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI'

GSA - TI Domain Entity

This query identifies Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in GSA NetworkAccessTraffic.

TI Map Domain entity to Cloud App Events

'Identifies compromises and attacks and detect malicious activities in one's domain entity from TI.'

Preview - TI map Domain entity to Cloud App Events

'Identifies compromises and attacks and detect malicious activities in one's domain entity from TI.'

TI Map Domain Entity to DeviceNetworkEvents

'This query identifies any Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents.'

TI Map Domain Entity to DeviceNetworkEvents

'This query identifies any Domain indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in DeviceNetworkEvents.'

Correlated Alerts on Similar User Identities

This rule correlates alerts from multiple integrations and event categories that involve different user.name values which may represent the same real-world identity. It uses an LLM-based similarity analysis to evaluate whether multiple user identifiers (e.g. naming variations, formats, aliases, or domain differences) likely belong to the same person.

Domain Computers Enumeration via LDAP Search

Identifies a list of suspicious LDAP queries often used by reconnaissance tools to enumerate domain computers.