Browse Rules

Search and filter across all detection sources

27,365 rules

sagan low other

AWS Detective detected

AWS Detective detected

sagan low other

Asterisk Phone system detected detected

Asterisk Phone system detected detected

sagan high other

[CROWDSTRIKE] DetectionSummaryEvent - Nessus Activity Detected

[CROWDSTRIKE] DetectionSummaryEvent - Nessus Activity Detected

wazuh informational xml

Detect: Connection was detected by Interspect.

Detect: Connection was detected by Interspect.

sagan medium other

[SONICWALL] Intrusion Detection - Suspicious Application detected

[SONICWALL] Intrusion Detection - Suspicious Application detected

sagan medium other

[SONICWALL] Intrusion Detection - Suspicious Application detected

[SONICWALL] Intrusion Detection - Suspicious Application detected

sentinel high kql

ApexOne - Attack Discovery Detection

'Detects Attack Discovery Detection events.'

sagan medium other

[CROWDSTRIKE] EPP detection summary event (Malware) - Detected

[CROWDSTRIKE] EPP detection summary event (Malware) - Detected

sagan medium other

[DYNAMIC] AWS Detective logs detected via program.

[DYNAMIC] AWS Detective logs detected via program.

sagan unknown other

[SONICWALL] Intrusion Detection - Probable port scan detected

[SONICWALL] Intrusion Detection - Probable port scan detected

sagan medium other

[SONICWALL] Possible Intrusion detection - Anti-Spyware detected

[SONICWALL] Possible Intrusion detection - Anti-Spyware detected

sagan medium other

[SONICWALL] Possible Intrusion detection - Anti-Spyware detected

[SONICWALL] Possible Intrusion detection - Anti-Spyware detected

sentinel informational kql

Malware Detection Session Finished

Detects when malware detection session finishes.

bertjanp unknown kql

Follina Detection

Follina Detection

sentinel high kql

Malware Detection Settings Updated

Detects when malware detection settings are updated.

sagan high other

[SONICWALL] Intrusion Detection - Possible DNS rebind attack detected

[SONICWALL] Intrusion Detection - Possible DNS rebind attack detected

sagan unknown other

[SONICWALL] Intrusion Detection - Probable TCP FIN scan detected

[SONICWALL] Intrusion Detection - Probable TCP FIN scan detected

sagan unknown other

[SONICWALL] Intrusion Detection - Probable TCP NULL scan detected

[SONICWALL] Intrusion Detection - Probable TCP NULL scan detected

sagan unknown other

[SONICWALL] Intrusion Detection - Probable TCP XMAS scan detected

[SONICWALL] Intrusion Detection - Probable TCP XMAS scan detected

sagan unknown other

[SNORT] Executable code was detected

[SNORT] Executable code was detected

sagan low other

Applocker detected

Applocker detected

sagan low other

Bit9 detected

Bit9 detected

sagan low other

Centrify detected

Centrify detected

sagan low other

DigitalPersona detected

DigitalPersona detected

sagan low other

Dovecot detected

Dovecot detected