Browse Rules

Search and filter across all detection sources

15 rules

wazuh informational xml

Active response: $(script) - $(type)

Active response: $(script) - $(type)
wazuh informational xml

Host Blocked by $(script) Active Response

Host Blocked by $(script) Active Response
wazuh informational xml

Host Unblocked by $(script) Active Response

Host Unblocked by $(script) Active Response
wazuh informational xml

Host Blocked by firewall-drop.sh Active Response

Host Blocked by firewall-drop.sh Active Response
wazuh informational xml

Host Unblocked by firewall-drop.sh Active Response

Host Unblocked by firewall-drop.sh Active Response
wazuh informational xml

Host Blocked by host-deny.sh Active Response

Host Blocked by host-deny.sh Active Response
wazuh informational xml

Host Unblocked by host-deny.sh Active Response

Host Unblocked by host-deny.sh Active Response
wazuh low xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh medium xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh high xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh informational xml

Palo Alto TRAFFIC: session started log on $(device_name)

Palo Alto TRAFFIC: session started log on $(device_name)
wazuh informational xml

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)

Palo Alto SYSTEM: $(severity) severity log on $(device_name): $(description)
wazuh informational xml

Palo Alto TRAFFIC: session ended on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason)

Palo Alto TRAFFIC: session ended on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason)
wazuh low xml

Palo Alto TRAFFIC: session dropped on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason). Action: $(action).

Palo Alto TRAFFIC: session dropped on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason). Action: $(action).
wazuh low xml

Palo Alto TRAFFIC: session dropped on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason). Action: $(action).

Palo Alto TRAFFIC: session dropped on $(device_name) from $(src_ip) to $(dst_ip). Reason: $(session_end_reason). Action: $(action).