Search and filter across all detection sources
1,427 rules
OSSEC process monitoring rules.
RKMA Monitoring device detected
Performance monitoring cannot be initialized
Monitored: A security event was monitored; however, it was not blocked, due to the current configuration.
Auth0 Attack Protection Monitoring Disabled
An attack protection monitoring configuration was changed.
[CyberArk] Monitor Session End Failed
[CyberArk] Monitor Session Start Failed
[FORTINET] Admin Monitor login Successful
[TRENDMICRO] Behavior Monitoring Logs Detected
Process Monitor Driver Creation By Non-Sysinternals Binary
Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.
Microsoft Exchange Active Monitoring device detected
[WINDOWS-CLIPBOARD] Disable Realtime Monitoring Command
Trust Monitor Event
'This query identifies when a new trust monitor event is detected.'
[FORTINET] DNS Request to Monitored Domain Detected
[JAMF-PROTECT] Process Monitoring Event Detected (high)
[JAMF-PROTECT] Process Monitoring Event Detected (medium)
Cisco SDWAN - Monitor Critical IPs
'This analytic rule will monitor critical IPs in Syslog and Netflow Data.'
Cyble Vision Alerts Social Media Monitoring
'Detects and CybleVision 'social_media_monitoring' alerts into a single incident.'
Windows application monitor event.
monitor_tool_pos [malware]