Browse Rules

Search and filter across all detection sources

85 rules

sagan critical other

[FORTINET] L2TP/PPTP/PPPoE Authentication success

[FORTINET] L2TP/PPTP/PPPoE Authentication success
sagan critical other

[FORTINET] L2TP/PPTP/PPPoE Authentication success

[FORTINET] L2TP/PPTP/PPPoE Authentication success
sagan critical other

[FORTINET-BLUEDOT] Admin authentication success suspicious source

[FORTINET-BLUEDOT] Admin authentication success suspicious source
sagan critical other

[OPENSSH-AETAS] Authentication success at suspicious time

[OPENSSH-AETAS] Authentication success at suspicious time
sagan critical other

[OPENSSH] Authentication success from outside HOME_COUNTRY

[OPENSSH] Authentication success from outside HOME_COUNTRY
sagan critical other

[OPENSSH-BLUEDOT] Authentication success from suspicious source

[OPENSSH-BLUEDOT] Authentication success from suspicious source
sagan high other

[OPENSSH-CORRELATED] Authentication success after exploit attempt

[OPENSSH-CORRELATED] Authentication success after exploit attempt
sagan high other

[OPENSSH-CORRELATED] Authentication success after honeypot activity

[OPENSSH-CORRELATED] Authentication success after honeypot activity
sagan high other

[OPENSSH-CORRELATED] Authentication success after recon activity

[OPENSSH-CORRELATED] Authentication success after recon activity
sagan critical other

[PROFTPD-AETAS] Authentication success at suspicious time

[PROFTPD-AETAS] Authentication success at suspicious time
sagan critical other

[PROFTPD-BLUEDOT] Authentication success from suspicious source

[PROFTPD-BLUEDOT] Authentication success from suspicious source
sagan high other

[FORTINET-CORRELATED] Admin authentication success after brute force

[FORTINET-CORRELATED] Admin authentication success after brute force
sagan high other

[FORTINET-CORRELATED] Admin authentication success after exploit attempt

[FORTINET-CORRELATED] Admin authentication success after exploit attempt
sagan high other

[FORTINET-CORRELATED] Admin authentication success after honeypot activity

[FORTINET-CORRELATED] Admin authentication success after honeypot activity
sagan high other

[FORTINET-CORRELATED] Admin authentication success after recon activity

[FORTINET-CORRELATED] Admin authentication success after recon activity
sagan critical other

[FORTINET-GEOIP] Admin authentication success outside HOME_COUNTRY

[FORTINET-GEOIP] Admin authentication success outside HOME_COUNTRY
sagan high other

[OPENSSH-CORRELATED] Authentication success after brute force activity

[OPENSSH-CORRELATED] Authentication success after brute force activity
sagan critical other

[PROFTPD-GEOIP] Authentication success from outside HOME_COUNTRY

[PROFTPD-GEOIP] Authentication success from outside HOME_COUNTRY
sagan critical other

[VSFTPD-BLUEDOT] Authentication successful from a suspicious IP

[VSFTPD-BLUEDOT] Authentication successful from a suspicious IP
sagan critical other

[VSFTPD-GEOIP] Authentication successful from outside HOME_COUNTRY

[VSFTPD-GEOIP] Authentication successful from outside HOME_COUNTRY
sagan critical other

[SSH-TECTIA-SERVER-AETAS] Authentication success at suspicious time

[SSH-TECTIA-SERVER-AETAS] Authentication success at suspicious time
sagan high other

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after exploit attempt

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after exploit attempt
sagan high other

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after honeypot activity

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after honeypot activity
sagan high other

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after recon activity

[SSH-TECTIA-SERVER-CORRELATED] Authentication success after recon activity
wazuh informational xml

ASA: AAA (VPN) authentication successful.

ASA: AAA (VPN) authentication successful.