Browse Rules

Search and filter across all detection sources

39 rules

wazuh low xml

osquery: $(osquery.pack) query result

osquery: $(osquery.pack) query result

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Browser plugin $(osquery.columns.name) is enabled

osquery: $(osquery.pack) $(osquery.subquery): Browser plugin $(osquery.columns.name) is enabled

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Browser plugin $(osquery.columns.name) is disabled

osquery: $(osquery.pack) $(osquery.subquery): Browser plugin $(osquery.columns.name) is disabled

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX version $(osquery.columns.version)

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX version $(osquery.columns.version)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX version $(osquery.columns.version)

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX version $(osquery.columns.version)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

osquery: $(osquery.pack) $(osquery.subquery): Shared NFS $(osquery.columns.share) options $(osquery.columns.options)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): Keychain $(osquery.columns.label) path is $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Integrity protection flag $(osquery.columns.config_flag) is enabled

osquery: $(osquery.pack) $(osquery.subquery): Integrity protection flag $(osquery.columns.config_flag) is enabled

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Integrity protection flag $(osquery.columns.config_flag) is disabled

osquery: $(osquery.pack) $(osquery.subquery): Integrity protection flag $(osquery.columns.config_flag) is disabled

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): OS kernel version $(osquery.columns.version), path $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): OS kernel version $(osquery.columns.version), path $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Homebrew package $(osquery.columns.name) version is $(osquery.columns.version)

osquery: $(osquery.pack) $(osquery.subquery): Homebrew package $(osquery.columns.name) version is $(osquery.columns.version)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Windows device $(osquery.columns.device_name) driver is being used

osquery: $(osquery.pack) $(osquery.subquery): Windows device $(osquery.columns.device_name) driver is being used

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX service exceptions path $(osquery.columns.path)

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX service exceptions path $(osquery.columns.path)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Windows patch $(osquery.columns.hotfix_id) is installed on the system

osquery: $(osquery.pack) $(osquery.subquery): Windows patch $(osquery.columns.hotfix_id) is installed on the system

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Device $(osquery.columns.name) encryption status is $(osquery.columns.encryption_status)

osquery: $(osquery.pack) $(osquery.subquery): Device $(osquery.columns.name) encryption status is $(osquery.columns.encryption_status)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.process) has explicit authorization for Application Layer Firewall OSX

osquery: $(osquery.pack) $(osquery.subquery): Process $(osquery.columns.process) has explicit authorization for Application Layer Firewall OSX

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX service $(osquery.columns.service) state $(osquery.columns.state)

osquery: $(osquery.pack) $(osquery.subquery): Application Layer Firewall for OSX service $(osquery.columns.service) state $(osquery.columns.state)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Mount point $(osquery.columns.path) at with $(osquery.columns.blocks_free) free blocks

osquery: $(osquery.pack) $(osquery.subquery): Mount point $(osquery.columns.path) at with $(osquery.columns.blocks_free) free blocks

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Windows program $(osquery.columns.name) $(osquery.columns.version) is installed on the system

osquery: $(osquery.pack) $(osquery.subquery): Windows program $(osquery.columns.name) $(osquery.columns.version) is installed on the system

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

osquery: $(osquery.pack) $(osquery.subquery): Portage package $(osquery.columns.package) $(osquery.columns.version) USE flags $(osquery.columns.flags)

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): OS X Application $(osquery.columns.name) version $(osquery.columns.bundle_version) is installed

osquery: $(osquery.pack) $(osquery.subquery): OS X Application $(osquery.columns.name) version $(osquery.columns.bundle_version) is installed

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): RPM package $(osquery.columns.name) version $(osquery.columns.version) is installed on the system

osquery: $(osquery.pack) $(osquery.subquery): RPM package $(osquery.columns.name) version $(osquery.columns.version) is installed on the system

wazuh low xml

osquery: $(osquery.pack) $(osquery.subquery): RPM package $(osquery.columns.name) version $(osquery.columns.version) is installed on the system

osquery: $(osquery.pack) $(osquery.subquery): RPM package $(osquery.columns.name) version $(osquery.columns.version) is installed on the system