Browse Rules

Search and filter across all detection sources

65 rules

sentinel medium kql

Box - Abmormal user activity

'Detects spikes (deviations from avarage) in user activity.'

sagan medium other

[EXTRAHOP] Microsoft 365 Risky User Activities

[EXTRAHOP] Microsoft 365 Risky User Activities
sagan informational other

[NETWRIX] User Activity (Video) - Activated Elevated Window

[NETWRIX] User Activity (Video) - Activated Elevated Window
sagan informational other

[NETWRIX] User Activity (Video) - Activated Elevated Window

[NETWRIX] User Activity (Video) - Activated Elevated Window
sagan critical other

[NETWRIX] User Activity (Video) - Activated Window - Powershell

[NETWRIX] User Activity (Video) - Activated Window - Powershell
sagan informational other

[NETWRIX] User Activity (Video) - Activated Window - Powershell

[NETWRIX] User Activity (Video) - Activated Window - Powershell
sagan informational other

[NETWRIX] User Activity (Video) - Activated Window - COM Surrogate

[NETWRIX] User Activity (Video) - Activated Window - COM Surrogate
sagan informational other

[NETWRIX] User Activity (Video) - Activated Window - COM Surrogate

[NETWRIX] User Activity (Video) - Activated Window - COM Surrogate
sagan unknown other

[BOX] Device Trust check failed

[BOX] Device Trust check failed
sagan unknown other

[PRISMA] Prisma Access User Registered

[PRISMA] Prisma Access User Registered
sagan unknown other

[AWS] S3 Enumeration (Multiple ListBuckets Events)

[AWS] S3 Enumeration (Multiple ListBuckets Events)
sagan unknown other

[AWS] S3 Enumeration (Multiple ListObects Events)

[AWS] S3 Enumeration (Multiple ListObects Events)
sagan unknown other

[AWS] S3 Enumeration (Multiple ListObectsv2 Events)

[AWS] S3 Enumeration (Multiple ListObectsv2 Events)
sagan unknown other

[BOX] Multifactor authentication has been disabled

[BOX] Multifactor authentication has been disabled
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (CreateEventDataStore)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (CreateEventDataStore)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (CreateTrail)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (CreateTrail)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteEventDataStore)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteEventDataStore)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteTrail)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (DeleteTrail)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (PutEventSelectors)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (PutEventSelectors)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (PutInsightSelectors)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (PutInsightSelectors)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (RemoveTags)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (RemoveTags)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (RestoreEventDataStore)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (RestoreEventDataStore)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (StartQuery)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (StartQuery)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (UpdateEventDataStore)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (UpdateEventDataStore)
sagan unknown other

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (UpdateTrail)

[AWS-CLOUDTRAIL] AWS Cloudtrail event detected (UpdateTrail)