Browse Rules

Endpoint Security (Elastic Defend)

Generates a detection alert each time an Elastic Defend alert is received. Enabling this rule allows you to immediately begin investigating your Endpoint alerts.

My First Rule

This rule helps you test and practice using alerts with Elastic Security as you get set up. It’s not a sign of threat activity.

Unauthorized Access to an Okta Application

Identifies unauthorized access attempts to Okta applications.

Azure Resource Group Deleted

Identifies the deletion of a resource group in Azure, which includes all resources within the group. Deletion is permanent and irreversible. An adversary may delete a resource group in an attempt to evade defenses or intentionally destroy data.

Container Workload Protection

Generates a detection alert each time a 'Container Workload Protection' alert is received. Enabling this rule allows you to immediately begin triaging and investigating these alerts.

External Alerts

Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.

GitHub App Deleted

Detects the deletion of a GitHub app either from a repo or an organization.

Web Application Suspicious Activity: Unauthorized Method

A request to a web application returned a 405 response, which indicates the web application declined to process the request because the HTTP method is not allowed for the resource.

CrowdStrike External Alerts

Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app.

Splunk External Alerts

Generates a detection alert for each Splunk alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Splunk alerts in the app.

Okta FastPass Phishing Detection

Detects when Okta FastPass prevents a user from authenticating to a phishing website.

SentinelOne Alert External Alerts

Generates a detection alert for each SentinelOne alert written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne alerts in the app.

SentinelOne Threat External Alerts

Generates a detection alert for each SentinelOne threat written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne threat alerts in the app.

Linux Group Creation

Identifies attempts to create a new group. Attackers may create new groups to establish persistence on a system.

Linux User Account Creation

Identifies attempts to create new users. Attackers may add new users to establish persistence on a system.

Elastic Security External Alerts

Generates a detection alert for each Elastic Security alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Elastic Security alerts in the app.

Google SecOps External Alerts

Generates a detection alert for each Google SecOps alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Google SecOps alerts in the app.

Microsoft Sentinel External Alerts

Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Microsoft Sentinel alerts in the app.

IBM QRadar External Alerts

Generates a detection alert for each IBM QRadar offense written to the configured indices. Enabling this rule allows you to immediately begin investigating IBM QRadar offense alerts in the app.

Malware - Detected - Elastic Endgame

Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Malware - Prevented - Elastic Endgame

Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Ransomware - Detected - Elastic Endgame

Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Ransomware - Prevented - Elastic Endgame

Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Remote SSH Login Enabled via systemsetup Command

Detects use of the systemsetup command to enable remote SSH Login.

New Okta Authentication Behavior Detected

Detects events where Okta behavior detection has identified a new authentication behavior.