Browse Rules

Search and filter across all detection sources

284 rules

sagan critical other

[SNORT] Successful User Privilege Gain

[SNORT] Successful User Privilege Gain
sagan informational other

[AWS-SIGNIN] Successful User login without MFA

[AWS-SIGNIN] Successful User login without MFA
sagan critical other

[IMAPD] Successful login

[IMAPD] Successful login
sagan critical other

[KNOCKD] Open Sesame

[KNOCKD] Open Sesame
sagan critical other

[PPTP] Connection established

[PPTP] Connection established
sagan critical other

[CONFLUENT] Kafka Successful Authentication

[CONFLUENT] Kafka Successful Authentication
sagan critical other

[CYLANCE] AuditLog - Device Edit

[CYLANCE] AuditLog - Device Edit
sagan critical other

[HORDEIMP] IMP successful login

[HORDEIMP] IMP successful login
sagan critical other

[WATCHGUARD] VPN - User login

[WATCHGUARD] VPN - User login
sagan critical other

[MCAS] ALERT_ANUBIS_DETECTION_VELOCITY

[MCAS] ALERT_ANUBIS_DETECTION_VELOCITY
sagan critical other

[NETWRIX] Active Directory User Added

[NETWRIX] Active Directory User Added
sagan critical other

[WINDOWS-AUTH] User account created

[WINDOWS-AUTH] User account created
sagan critical other

[WINDOWS-AUTH] User account created

[WINDOWS-AUTH] User account created
sagan critical other

[WINDOWS-AUTH] User account deleted

[WINDOWS-AUTH] User account deleted
sagan critical other

[WINDOWS-AUTH] User account deleted

[WINDOWS-AUTH] User account deleted
sagan critical other

[XINETD] POP3S [SSL] User login

[XINETD] POP3S [SSL] User login
sagan critical other

[ZEEK] SSH Watched_Country_Login

[ZEEK] SSH Watched_Country_Login
sagan critical other

[CISCO-BLUEDOT] VPN Login from Tor

[CISCO-BLUEDOT] VPN Login from Tor
sagan critical other

[CONFLUENT] Authorization to create Kafka Cluster

[CONFLUENT] Authorization to create Kafka Cluster
sagan critical other

[COURIER-BLUEDOT] Timeout from suspicious source

[COURIER-BLUEDOT] Timeout from suspicious source
sagan critical other

[COURIER-CORRELATED] Timeout after exploit attempt

[COURIER-CORRELATED] Timeout after exploit attempt
sagan critical other

[COURIER-CORRELATED] Timeout after honeypot activity

[COURIER-CORRELATED] Timeout after honeypot activity
sagan critical other

[COURIER-CORRELATED] Timeout after recon activity

[COURIER-CORRELATED] Timeout after recon activity
sagan critical other

[COURIER] Courierpassd|Poppassd - Changed user password

[COURIER] Courierpassd|Poppassd - Changed user password
sagan critical other

[FORTINET] L2TP/PPTP/PPPoE Authentication success

[FORTINET] L2TP/PPTP/PPPoE Authentication success