Browse Rules

Search and filter across all detection sources

2,494 rules

sentinel high kql

OCI - Insecure metadata endpoint

'Detects insecure metadata endpoint.'

sagan low other

Carbon Black Endpoint Server detected

Carbon Black Endpoint Server detected
sigma low sigma

AWS Glue Development Endpoint Activity

Detects possible suspicious glue development endpoint activity.
wazuh low xml

sshd: transport endpoint is not connected

sshd: transport endpoint is not connected
sagan medium other

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Start Success
sagan informational other

[CISCO-SECUREENDPOINT] Endpoint Isolation Stop Success

[CISCO-SECUREENDPOINT] Endpoint Isolation Stop Success
sagan medium other

[DYNAMIC] Microsoft Defender Endpoint Logs Detected

[DYNAMIC] Microsoft Defender Endpoint Logs Detected
sagan medium other

[FORESCOUT-COUNTERACT] Unknown Wireless Endpoint Detected

[FORESCOUT-COUNTERACT] Unknown Wireless Endpoint Detected
sentinel medium kql

Bitglass - The SmartEdge endpoint agent was uninstalled

'Detects when SmartEdge endpoint agent was uninstalled.'

sagan informational other

[CROWDSTRIKE] Quarantined Files In Endpoint Protection Platform

[CROWDSTRIKE] Quarantined Files In Endpoint Protection Platform
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Collection High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Collection High Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Collection Informational Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Collection Informational Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Collection Low Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Collection Low Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] Collection Medium Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] Collection Medium Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl High Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Informational Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Informational Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Low Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Low Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Medium Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CommandAndControl Medium Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess High Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Informational Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Informational Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Low Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Low Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Medium Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] CredentialAccess Medium Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion High Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion High Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion Informational Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion Informational Alert Detected
sagan medium other

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion Low Alert Detected

[MICROSOFT_DEFENDER_ENDPOINT] DefenseEvasion Low Alert Detected