Browse Rules

Search and filter across all detection sources

13,087 rules

wazuh low xml

sendmail: Sendmail rejected message.

sendmail: Sendmail rejected message.

wazuh informational xml

Serv-U: Server started

Serv-U: Server started

sagan medium other

[WINDOWS-SECURITY] A security setting was updated on the OCSP Responder Service

[WINDOWS-SECURITY] A security setting was updated on the OCSP Responder Service

sagan medium other

[WINDOWS-SECURITY] A security setting was updated on the OCSP Responder Service

[WINDOWS-SECURITY] A security setting was updated on the OCSP Responder Service

sagan critical other

[WINDOWS-SECURITY] Meshagent Remote Session Interaction Service Installed

[WINDOWS-SECURITY] Meshagent Remote Session Interaction Service Installed

wazuh informational xml

The Windows Search Service started

The Windows Search Service started

panther informational python

AWS CloudTrail SES Check SES Sending Enabled

Detect when a user inquires whether SES Sending is enabled.

sagan informational other

[WINDOWS-SECURITY] IPsec Services failed to initialize RPC server

[WINDOWS-SECURITY] IPsec Services failed to initialize RPC server

sagan informational other

[WINDOWS-SECURITY] IPsec Services failed to initialize RPC server

[WINDOWS-SECURITY] IPsec Services failed to initialize RPC server

sagan informational other

[WINDOWS-SECURITY] The security permissions for Certificate Services changed

[WINDOWS-SECURITY] The security permissions for Certificate Services changed

sagan informational other

[WINDOWS-SECURITY] The security permissions for Certificate Services changed

[WINDOWS-SECURITY] The security permissions for Certificate Services changed

wazuh informational xml

The Windows Search Service removed the old search index successfully

The Windows Search Service removed the old search index successfully

sagan informational other

[WINDOWS-SECURITY] The certificate manager settings for Certificate Services changed

[WINDOWS-SECURITY] The certificate manager settings for Certificate Services changed

sagan informational other

[WINDOWS-SECURITY] The certificate manager settings for Certificate Services changed

[WINDOWS-SECURITY] The certificate manager settings for Certificate Services changed

wazuh low xml

The Windows Search Service attempted to remove the old search index

The Windows Search Service attempted to remove the old search index

wazuh low xml

Failed to set the security attributes on the MS DTC service

Failed to set the security attributes on the MS DTC service

panther medium python

Wiz Rotate Service Account Secret

This rule detects service account secrets rotations.

sagan informational other

[GCP] Multiple SecretManager Secrets Deleted

[GCP] Multiple SecretManager Secrets Deleted

sagan high other

[WINDOWS-SECURITY] Disable Windows Security

[WINDOWS-SECURITY] Disable Windows Security

sagan medium other

[WINDOWS-SECURITY] Role separation enabled:

[WINDOWS-SECURITY] Role separation enabled:

wazuh informational xml

The Windows Search Service stopped normally

The Windows Search Service stopped normally

wazuh informational xml

Jenkins: Severe message

Jenkins: Severe message

sagan informational other

[NETWRIX] Windows Server - System Service Added

[NETWRIX] Windows Server - System Service Added

sagan informational other

[NETWRIX] Windows Server - System Service Added

[NETWRIX] Windows Server - System Service Added

sagan critical other

[WINDOWS-SECURITY] Atera Stop/Delete Service

[WINDOWS-SECURITY] Atera Stop/Delete Service