Browse Rules

Search and filter across all detection sources

31 rules

wazuh informational xml

firewalld grouping

firewalld grouping
wazuh low xml

pfSense firewall drop event.

pfSense firewall drop event.
wazuh low xml

Firewall drop event.

Firewall drop event.
wazuh low xml

Fortigate: IP Sec DPD Failed.

Fortigate: IP Sec DPD Failed.
wazuh low xml

Windows Defender error event

Windows Defender error event
wazuh informational xml

Windows Firewall With Advanced Security informational event

Windows Firewall With Advanced Security informational event
wazuh informational xml

Windows Firewall With Advanced Security warning event

Windows Firewall With Advanced Security warning event
wazuh medium xml

Multiple Windows Firewall With Advanced Security warning events

Multiple Windows Firewall With Advanced Security warning events
wazuh low xml

Windows Firewall With Advanced Security: Windows Defender Firewall enabled.

Windows Firewall With Advanced Security: Windows Defender Firewall enabled.
wazuh low xml

Windows Firewall With Advanced Security: Windows Defender Firewall disabled.

Windows Firewall With Advanced Security: Windows Defender Firewall disabled.
wazuh medium xml

Multiple Windows Firewall With Advanced Security error events

Multiple Windows Firewall With Advanced Security error events
wazuh medium xml

Netscreen Erase sequence started.

Netscreen Erase sequence started.
wazuh low xml

Netscaler: Firewall: DOS\DDOS error

Netscaler: Firewall: DOS\DDOS error
wazuh low xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh medium xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh high xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh informational xml

Palo Alto TRAFFIC: session started log on $(device_name)

Palo Alto TRAFFIC: session started log on $(device_name)
wazuh medium xml

Multiple pfSense firewall blocks events from same source.

Multiple pfSense firewall blocks events from same source.
wazuh informational xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh low xml

Fortigate: Multiple Firewall drop events from same source.

Fortigate: Multiple Firewall drop events from same source.
wazuh medium xml

Multiple Firewall drop events from same source.

Multiple Firewall drop events from same source.
wazuh low xml

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been added to the Windows Defender Firewall exception list.

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been added to the Windows Defender Firewall exception list.
wazuh low xml

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been modified in the Windows Defender Firewall exception list.

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been modified in the Windows Defender Firewall exception list.
wazuh low xml

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been deleted in the Windows Defender Firewall exception list.

Windows Firewall With Advanced Security: $(win.eventdata.ruleId) rule has been deleted in the Windows Defender Firewall exception list.
wazuh informational xml

Netscaler: Firewall violation

Netscaler: Firewall violation