Browse Rules

Vuls integration event.

Vuls integration event.

VirusTotal integration messages.

VirusTotal integration messages.

[TRIPWIRE] Integrity Check failed

[TRIPWIRE] Integrity Check failed

Auth0 Integration Installed

An Auth0 integration was installed from the auth0 action library.

SAP BTP - Cloud Integration artifact deployment

Identifies deployment and undeployment of integration artifacts in SAP Cloud Integration. Integration flows are executable code that can process, transform, and route data between systems. Unauthorized artifact deployment could indicate: - Attacker deploying malicious integration flows for data exfiltration - Deployment of rogue code for persistent access - Undeployment of critical integrations causing denial of service

Snowflake Create Integration [snowflake-database_query_history]

Creates a new integration in the system or replaces an existing integration. An integration is a Snowflake object that provides an interface between Snowflake and third-party services.

Wiz Integration Updated Or Deleted

This rule detects updates and deletions of Wiz integrations.

Anthropic Integration Connected

Tracks when a user connects an external integration (e.g., GitHub, Google Drive) to their Anthropic account. Logged for compliance visibility into external data pathways. The integration_type field identifies which service was connected.

Snowflake Alter Integration [snowflake-database_query_history]

Modifies the properties for an existing integration.

Duo Admin New Admin API App Integration

Identifies creation of new Admin API integrations for Duo.

[WINDOWS-AUTH] DC - Integrity check on decrypted

[WINDOWS-AUTH] DC - Integrity check on decrypted

[WINDOWS-AUTH] DC - Integrity check on decrypted

[WINDOWS-AUTH] DC - Integrity check on decrypted

Duo Admin App Integration Secret Key Viewed

An administrator viewed a Secret Key for an Application Integration

Wiz Image Integrity Validator Updated Or Deleted

This rule detects updates and deletions of image integrity validators.

Disabling Hypervisor-protected Code Integrity via Registry

Identifies registry modifications to disable Hypervisor-protected Code Integrity. HVCI enforces code integrity in the kernel and allows only signed code to be executed.

Tailscale Premium: Posture integration disabled or removed

Identifies when a device-posture integration is disabled or removed from the tailnet. Posture integrations enforce device compliance - removal weakens fleet posture and is a possible defense-evasion step.

IPsec dropped an inbound packet that failed an integrity check

IPsec dropped an inbound packet that failed an integrity check

SAP BTP - Cloud Integration package import or transport

Identifies import and transport operations for integration packages and artifacts in SAP Cloud Integration. Packages contain integration flows, mappings, scripts, and other artifacts that can be imported from external sources or transported between tenants. Unauthorized package operations could indicate: - Supply chain attack through malicious package import - Lateral movement between environments via artifact transport - Introduction of backdoors or rogue integration logic

SAP BTP - Cloud Integration access policy tampering

Identifies changes to access policies in SAP Cloud Integration. Access policies control authorization for integration artifacts, defining which users and roles can access specific integration flows and related content. Unauthorized access policy manipulation could indicate: - Attacker granting themselves access to sensitive integration artifacts - Removal of security controls to enable further malicious activity - Defense evasion by modifying artifact references to hide unauthorized access

Github Organization App Integration Installed

An application integration was installed to your organization's Github account by someone in your organization.

[WINDOWS-SECURITY] IPsec dropped an inbound packet that failed an integrity check

[WINDOWS-SECURITY] IPsec dropped an inbound packet that failed an integrity check

[WINDOWS-SECURITY] IPsec dropped an inbound packet that failed an integrity check

[WINDOWS-SECURITY] IPsec dropped an inbound packet that failed an integrity check

[WINDOWS-SECURITY] RPC detected an integrity violation while decrypting an incoming message

[WINDOWS-SECURITY] RPC detected an integrity violation while decrypting an incoming message

Guardian- Security Integrity Checks Prompt Injection Policy Violation Detection

'This alert creates an incident when Security Integrity Checks Prompt Injection Policy Violation detected from the Guardian.'

System Integrity Protection (SIP) Disabled

Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.