Panther has hundreds of detections ready to use out-of-the-box. Use the filtered search above to find detections based on keyword or log type.
| Detection | Log Type | Type | Description |
|---|---|---|---|
| 1Password Login From CrowdStrike Unmanaged Device | Crowdstrike.AIDMaster OnePassword.SignInAttempt | Scheduled Rule | Detects 1Password Logins from IP addresses not found in CrowdStrike's AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor. |
| 1Password Login From CrowdStrike Unmanaged Device Query | Crowdstrike.AIDMaster OnePassword.SignInAttempt | Scheduled Query | Looks for OnePassword Logins from IP Addresses that aren't seen in CrowdStrike's AIP List. |
| 1Password Login From CrowdStrike Unmanaged Device Query (crowdstrike_fdrevent table) | Crowdstrike.FDREvent OnePassword.SignInAttempt | Scheduled Query | Looks for OnePassword Logins from IP Addresses that aren't seen in CrowdStrike's AIP List. (crowdstrike_fdrevent table) |
| A CloudTrail Was Created or Updated | AWS.CloudTrail | Rule | A CloudTrail Trail was created, updated, or enabled. |
| A Login from Outside the Corporate Office | Osquery.Differential | Rule | A system has been logged into from a non approved IP space. |
| A User Role with Sensitive Permissions has been Created | Panther.Audit | Rule | A Panther user role has been created that contains admin level permissions. |
| A User's Panther Account was Modified | Panther.Audit | Rule | A Panther user's role has been modified. This could mean password, email, or role has changed for the user. |
| Account Security Configuration Changed | AWS.CloudTrail | Rule | An account wide security configuration was changed. |
| Admin Role Assigned | Asana.Audit Atlassian.Audit GCP.AuditLog GSuite.Reports GitHub.Audit OneLogin.Events Zendesk.Audit | Rule | Attaching an audit role manually could be a sign of privilege escalation |
| Amazon Machine Image (AMI) Modified to Allow Public Access | AWS.CloudTrail | Rule | An Amazon Machine Image (AMI) was modified to allow it to be launched by anyone. Any sensitive configuration or application data stored in the AMI's block devices is at risk. |
| Anomalous AccessDenied Requests | AWS.CloudTrail | Scheduled Query | ARNs with a high Access Denied error rate could indicate an error or compromised credentials attempting to perform reconnaissance. |
| Asana Service Account Created | Asana.Audit | Rule | An Asana service account was created by someone in your organization. |
| Asana Team Privacy Public | Asana.Audit | Rule | An Asana team's privacy setting was changed to public to the organization (not public to internet) |
| Asana Workspace Default Session Duration Never | Asana.Audit | Rule | An Asana workspace's default session duration (how often users need to re-authenticate) has been changed to never. |
| Asana Workspace Email Domain Added | Asana.Audit | Rule | A new email domain has been added to an Asana workspace. Reviewer should validate that the new domain is a part of the organization. |
| Asana Workspace Form Link Auth Requirement Disabled | Asana.Audit | Rule | An Asana Workspace Form Link is a unique URL that allows you to create a task directly within a specific Workspace or Project in Asana, using a web form. Disabling authentication requirements may allow unauthorized users to create tasks. |
| Asana Workspace Guest Invite Permissions Anyone | Asana.Audit | Rule | Typically inviting guests to Asana is permitted by few users. Enabling anyone to invite guests can potentially lead to unauthorized users gaining access to Asana. |
| Asana Workspace New Admin | Asana.Audit | Rule | Asana Workspace New Admin |
| Asana Workspace Org Export | Asana.Audit | Rule | An Asana user started an org export. |
| Asana Workspace Password Requirements Simple | Asana.Audit | Rule | An asana user made your organization's password requirements less strict. |
| Asana Workspace Require App Approvals Disabled | Asana.Audit | Rule | An Asana user turned off app approval requirements for an application type for your organization. |
| Asana Workspace SAML Optional | Asana.Audit | Rule | An Asana user made SAML optional for your organization. |
| Atlassian admin impersonated another user | Atlassian.Audit | Rule | Reports when an Atlassian user logs in (impersonates) another user. |
| Auth0 Custom Role Created | Auth0.Events | Rule | An Auth0 User created a role in your organization's tenant. |
| Auth0 Integration Installed | Auth0.Events | Rule | An Auth0 integration was installed from the auth0 action library. |
| Auth0 mfa factor enabled | Auth0.Events | Rule | An Auth0 user enabled an mfa factor in your organization's mfa settings. |
| Auth0 MFA Policy Disabled | Auth0.Events | Rule | An Auth0 User disabled MFA for your organization's tenant. |
| Auth0 MFA Policy Enabled | Auth0.Events | Rule | An Auth0 User enabled MFA Policy for your organization's tenant. |
| Auth0 MFA Risk Assessment Disabled | Auth0.Events | Rule | An Auth0 User disabled the mfa risk assessment setting for your organization's tenant. |
| Auth0 MFA Risk Assessment Enabled | Auth0.Events | Rule | An Auth0 User enabled the mfa risk assessment setting for your organization's tenant. |
| Auth0 Post Login Action Flow Updated | Auth0.Events | Rule | An Auth0 User updated a post login action flow for your organization's tenant. |
| Auth0 User Joined Tenant | Auth0.Events | Rule | User accepted invitation from Auth0 member to join an Auth0 tenant. |
| AWS Access Key Rotation | AWS.IAM.RootUser AWS.IAM.User | Policy | This policy validates that AWS IAM account access keys are rotated every 90 days. Rotating access keys will reduce the window of opportunity for an access key that is associated with a compromised or terminated account to be used. |
| AWS Access Key Uploaded to Github | AWS.CloudTrail | Rule | A users static AWS API key was uploaded to a public github repo. |
| AWS Access Keys At Account Creation | AWS.IAM.RootUser AWS.IAM.User | Policy | This policy validates that AWS IAM user accounts do not have access keys that were created during account creation. This results in excess keys being generated, and unnecessary management work in auditing and rotating these keys. |
| AWS ACM Certificate Expiration | AWS.ACM.Certificate | Policy | When a certificate is 60 days away from expiration, ACM automatically attempts to renew it every hour. |
| AWS ACM Certificate Status | AWS.ACM.Certificate | Policy | This policy checks if an ACM certificate renewal is pending or has failed and is in use by any other resources within the account. |
| AWS ACM Secure Algorithms | AWS.ACM.Certificate | Policy | This policy validates that all ACM certificates are using secure key and signature algorithms. |
| AWS AMI Sharing | AWS.EC2.AMI | Policy | This policy ensures that AMIs you have created are not configured to allow public access, which could result in accidental data loss. AMI's that you use but do not own are not evaluated by this policy. |
| AWS Application Load Balancer Web ACL | AWS.ELBV2.ApplicationLoadBalancer | Policy | This policy validates that all application load balancers have an associated Web ACl to enforce protections against various web attacks. |
| AWS Authentication from CrowdStrike Unmanaged Device | AWS.CloudTrail Crowdstrike.AIDMaster | Scheduled Query | Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List |
| AWS Authentication From CrowdStrike Unmanaged Device | AWS.CloudTrail Crowdstrike.AIDMaster | Scheduled Rule | Detects AWS Logins from IP addresses not found in CrowdStrike's AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor. |
| AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) | AWS.CloudTrail Crowdstrike.FDREvent | Scheduled Query | Detects AWS Authentication events with IP Addresses not found in CrowdStrike's AIP List |
| AWS CDE EC2 Volume Encryption | AWS.EC2.Volume | Policy | This policy ensures that all EC2 volumes that contain CDE are encrypted. Be sure to configure CDE definitions before enabling this policy. |
| AWS CloudFormation Stack Drift | AWS.CloudFormation.Stack | Policy | A stack has drifted from its defined configuration. |
| AWS CloudFormation Stack IAM Service Role | AWS.CloudFormation.Stack | Policy | Associating IAM roles with CloudFormation stacks ensures least privilege when making changes to your account. |
| AWS CloudFormation Stack Termination Protection | AWS.CloudFormation.Stack | Policy | Protects a CloudFormation stack from accidentally being deleted. If you attempt to delete a stack with termination protection enabled, the deletion fails and the stack, including its status, will remain unchanged. |
| AWS CloudTrail Account Discovery | AWS.CloudTrail | Rule | Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior. |
| AWS CloudTrail CloudWatch Logs | AWS.CloudTrail | Policy | CloudTrail supports sending data and management events to CloudWatch Logs. This setup can be used for real-time processing of all CloudTrail data events. |
| AWS CloudTrail Least Privilege Access | AWS.IAM.Group | Policy | Users with permissions to disable or reconfigure CloudTrail should be limited. |
| AWS CloudTrail Log Encryption | AWS.CloudTrail | Policy | This policy validates that CloudTrail Logs are encrypted at rest with customer managed KMS key. |
| AWS CloudTrail Log Validation | AWS.CloudTrail | Policy | This policy ensures that CloudTrail logs have file integrity validation enabled. |
| AWS CloudTrail Management Events Enabled | AWS.CloudTrail.Meta | Policy | This policy ensures that at least one CloudTrail has management (control plane) operations logged. |
| AWS CloudTrail S3 Bucket Access Logging | AWS.CloudTrail | Policy | This policy validates that the bucket receiving CloudTrail Logs is configured with S3 Access Logging. This audits all creation, modification, or deletion to CloudTrail audit logs. |
| AWS CloudTrail S3 Bucket Public | AWS.CloudTrail | Policy | This policy validates that CloudTrail S3 buckets are not publicly accessible. |
| AWS CloudWatch Log Encryption | AWS.CloudWatch.LogGroup | Policy | AWS automatically performs server-side encryption of logs, but you can encrypt with your own CMK to protect extra sensitive log data. |
| AWS CloudWatch Logs Data Retention | AWS.CloudWatch.LogGroup | Policy | By default, logs are kept indefinitely and never expire. You can adjust the retention policy for each log group, keeping the indefinite retention, or choosing a specific retention period. |
| AWS command executed on the command line | Osquery.Differential | Rule | An AWS command was executed on a Linux instance |
| AWS Config Global Resources | AWS.Config.Recorder.Meta | Policy | You can have AWS Config record supported types of global resources, such as IAM users, groups, roles, and customer managed policies. |
| AWS Config Recording Status | AWS.Config.Recorder | Policy | This policy ensures that the config recorder is operational and capturing changes to your account without error. |
| AWS Config Records All Resource Types | AWS.Config.Recorder | Policy | This policy ensurers that you have a comprehensive configuration audit in place for all resource types in AWS. |
| AWS Config Service Created | AWS.CloudTrail | Rule | An AWS Config Recorder or Delivery Channel was created |
| AWS Config Service Disabled | AWS.CloudTrail | Rule | An AWS Config Recorder or Delivery Channel was disabled or deleted |
| AWS Config Status | AWS.Config.Recorder | Policy | This policy ensures that the config recorder is operational and capturing changes to your account. |
| AWS DNS Crypto Domain | AWS.VPCDns | Rule | Identifies clients that may be performing DNS lookups associated with common currency mining pools. |
| AWS DynamoDB Table Autoscaling | AWS.DynamoDB.Table | Policy | DynamoDB Auto Scaling can dynamically adjust provisioned throughput capacity in response to traffic patterns. This enables a table to increase its provisioned read and write capacity to handle sudden increases in traffic |
| AWS DynamoDB Table Autoscaling Configuration | AWS.DynamoDB.Table | Policy | DynamoDB Auto Scaling can dynamically adjust provisioned throughput capacity in response to traffic patterns. This enables a table to increase its provisioned read and write capacity to handle sudden increases in traffic |
| AWS DynamoDB Table TTL | AWS.DynamoDB.Table | Policy | This policy validates that all DynamoDB tables have a TTL field configured. |
| AWS EC2 AMI Approved Host | AWS.EC2.Instance | Policy | Checks that AWS EC2 AMI's are only launched on approved dedicated hosts. |
| AWS EC2 AMI Approved Instance Type | AWS.EC2.Instance | Policy | This policy ensures that the EC2 instance is running with an instance type approved for its AMI. |
| AWS EC2 AMI Approved Tenancy | AWS.EC2.Instance | Policy | This policy ensures that the EC2 instance was launched with a tenancy approved for its AMI. |
| AWS EC2 EBS Encryption Disabled | AWS.CloudTrail | Rule | Identifies disabling of default EBS encryption. Disabling default encryption does not change the encryption status of existing volumes. |
| AWS EC2 Image Monitoring | AWS.CloudTrail | Rule | Checks CloudTrail for occurrences of EC2 Image Actions. |
| AWS EC2 Instance Approved AMI | AWS.EC2.Instance | Policy | This policy ensures the given EC2 instance is running an AMI from the approved list of AMI's. |
| AWS EC2 Instance Approved Host | AWS.EC2.Instance | Policy | This policy ensures the given EC2 Instance is running on an approved dedicated host. |
| AWS EC2 Instance Approved Instance Type | AWS.EC2.Instance | Policy | This policy ensures that the EC2 instance is running on one of the approved instance types. |
| AWS EC2 Instance Approved Tenancy | AWS.EC2.Instance | Policy | This policy ensures the given EC2 Instance is running with an approved tenancy option. The possible tenancy options are dedicated, host, and default. |
| AWS EC2 Instance Approved VPC | AWS.EC2.Instance | Policy | This policy ensures that the given EC2 Instance is running in an approved VPC. |
| AWS EC2 Instance Detailed Monitoring | AWS.EC2.Instance | Policy | This policy ensures that the AWS Instance has Detailed Monitoring Enabled |
| AWS EC2 Instance EBS Optimization | AWS.EC2.Instance | Policy | This policy ensures EBS optimization is enabled for the given EC2 instance, if applicable. |
| AWS EC2 Manual Security Group Change | AWS.CloudTrail | Rule | An EC2 security group was manually updated without abiding by the organization's accepted processes. This rule expects organizations to either use the Console, CloudFormation, or Terraform, configurable in the rule's ALLOWED_USER_AGENTS. |
| AWS EC2 Startup Script Change | AWS.CloudTrail | Rule | Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up. |
| AWS EC2 Traffic Mirroring | AWS.CloudTrail | Rule | This rule captures multiple traffic mirroring events in AWS Cloudtrail. |
| AWS EC2 Volume Encryption | AWS.EC2.Volume | Policy | You can encrypt both the boot and data volumes of an EC2 instance. |
| AWS EC2 Volume Snapshot Encryption | AWS.EC2.Volume | Policy | You can encrypt the snapshot of an EC2 volume to protect against accidental data loss |
| AWS ECR Events | AWS.CloudTrail | Rule | An ECR event occurred outside of an expected account or region |
| AWS ELB SSL Policies | AWS.ELBV2.ApplicationLoadBalancer | Policy | Ensures that deprecated TLS versions are not supported in internet-facing load balancers |
| AWS Enforces SSL Policies | AWS.ELBV2.ApplicationLoadBalancer | Policy | This policy validates that ELBV2 load balancer listeners are using an SSL policy. |
| AWS GuardDuty Enabled | AWS.GuardDuty.Detector.Meta | Policy | GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. |
| AWS GuardDuty High Severity Finding | AWS.GuardDuty | Rule | A high-severity GuardDuty finding has been identified. |
| AWS GuardDuty Low Severity Finding | AWS.GuardDuty | Rule | A low-severity GuardDuty finding has been identified. |
| AWS GuardDuty Master Account | AWS.GuardDuty.Detector | Policy | Ensure that all GuardDuty logs are sending into a single Master account. This is a best practice for centralizing detection logic and useful data during an investigation. |
| AWS GuardDuty Medium Severity Finding | AWS.GuardDuty | Rule | A medium-severity GuardDuty finding has been identified. |
| AWS IAM Group Read Only Events | AWS.CloudTrail | Rule | This rule captures multiple read/list events related to IAM group management in AWS Cloudtrail. |
| AWS IAM Group Users | AWS.IAM.Group | Policy | This Policy ensures that all IAM groups have at least one IAM user. If they are vacant, they should be deleted. |
| AWS IAM Password Unused | AWS.IAM.User | Policy | This policy validates IAM users with console passwords have logged in within the past 90 days. |
| AWS IAM Policy Administrative Privileges | AWS.IAM.Policy | Policy | This policy validates that there are no IAM policies that grant full administrative privileges to IAM users or groups. |
| AWS IAM Policy Assigned to User | AWS.IAM.User | Policy | This policy validates that there are no IAM policies assigned directly to users. Best practice suggests assigning to an IAM group and placing users within that group. |
| AWS IAM Policy Blocklist | AWS.IAM.Group AWS.IAM.Role AWS.IAM.User | Policy | This detects the usage of highly permissive IAM Policies that should only be assigned to a small number of users, roles, or groups. |
| AWS IAM Policy Does Not Grant Any Administrative Access | AWS.IAM.Policy | Policy | This policy validates that no IAM policies grant admin access. This should be combined with suppressions on the legitimate IAM admin policies in your account so that it only fires when new and unexpected policies granting admin access are created. |
| AWS IAM Policy Does Not Grant Network Admin Access | AWS.IAM.Policy | Policy | This policy validates that no IAM policies grant admin privileges on network resources. This should be used in conjunction with suppressions for the legitimate network admin policies in your account. |
| AWS IAM Policy Role Mapping | AWS.IAM.Policy | Policy | This policy validates that policies that have been explicitly configured to be set to certain roles are still attached to those roles. |
| AWS IAM Resource Does Not Have Inline Policy | AWS.IAM.Group AWS.IAM.User | Policy | This policy validates that no IAM entities have inline policies assigned. Inline policies are more difficult to administer and audit, and may lead to access that lasts longer than intended. |
| AWS IAM Role Grants (permission) to Non-organizational Account | AWS.IAM.Role | Policy | This policy validates that IAM roles that grant the (specified) permission do not allow accounts outside the organization to assume them. |
| AWS IAM Role Restricts Usage | AWS.IAM.Role | Policy | This policy validates that IAM roles in the account are restrictive in what entities may assume them. This can help prevent malicious actors from assuming roles they should not be assuming. |
| AWS IAM User MFA | AWS.IAM.User | Policy | This policy validates that all AWS IAM users with access to the AWS Console have Multi-Factor Authentication (MFA) enabled. |
| AWS IAM User Not In Conflicting Groups | AWS.IAM.User | Policy | This policy validates that IAM users are not in IAM groups that are considered mutually exclusive. For example, in some workflows developers are responsible for dev environments and sysadmins are responsible for prod environments. In this situation no (or very few) users should be in both sysadmin and developer groups. This is in following with the principle of least privilege. |
| AWS KMS CMK Key Rotation | AWS.KMS.Key | Policy | This policy validates that customer master keys (CMKs) have automatic key rotation enabled. |
| AWS KMS Key Restricts Usage | AWS.KMS.Key | Policy | This policy validates that KMS Keys restrict what entities can use them and how. This is to ensure that encryption keys are limited in who can use them in order to prevent unapproved decryption. |
| AWS Macie Disabled/Updated | AWS.CloudTrail | Rule | Amazon Macie is a data security and data privacy service to discover and protect sensitive data. Security teams use Macie to detect open S3 Buckets that could have potentially sensitive data in it along with policy violations, such as missing Encryption. If an attacker disables Macie, it could potentially hide data exfiltration. |
| AWS Modify Cloud Compute Infrastructure | AWS.CloudTrail | Rule | Detection when EC2 compute infrastructure is modified outside of expected automation methods. |
| AWS Network ACL Overly Permissive Entry Created | AWS.CloudTrail | Rule | A Network ACL entry that allows access from anywhere was added. |
| AWS Network ACL Restricts Inbound Traffic | AWS.EC2.NetworkACL | Policy | This policy validates that Network ACLs restrict inbound traffic in some way. |
| AWS Network ACL Restricts Insecure Protocols | AWS.EC2.NetworkACL | Policy | This policy validates that Network ACLs block the usage of ports typically associated with insecure or unencrypted protocols. |
| AWS Network ACL Restricts Outbound Traffic | AWS.EC2.NetworkACL | Policy | This policy validates that Network ACLs have some restrictions on outbound traffic. |
| AWS Network ACL Restricts SSH | AWS.EC2.NetworkACL | Policy | SSH access should only be granted from protected network CIDR ranges. |
| AWS Password Policy Complexity Guidelines | AWS.PasswordPolicy | Policy | This policy validates that the account password policy enforces the recommended password complexity requirements. |
| AWS Password Policy Password Age Limit | AWS.PasswordPolicy | Policy | This policy validates that the account password policy enforces a maximum password age of 90 days or less. |
| AWS Password Policy Password Reuse | AWS.PasswordPolicy | Policy | This policy validates that the account password policy prevents users from re-using previous passwords, and prevents password reuse for 24 or more prior passwords. |
| AWS Public RDS Restore | AWS.CloudTrail | Rule | Detects the recovery of a new public database instance from a snapshot. It may be part of data exfiltration. |
| AWS RDS Instance Backup | AWS.RDS.Instance | Policy | This Policy ensures that RDS Instances have Backups enabled. Backups are an important aspect of disaster recovery that can protect sensitive data from destruction. |
| AWS RDS Instance Encryption | AWS.RDS.Instance | Policy | This policy validates that RDS instances have encryption enabled. |
| AWS RDS Instance Has Acceptable Backup Retention Period | AWS.RDS.Instance | Policy | This policy validates that RDS instances are configured with a backup retention period that is acceptable to company policy. This ensures for both compliance and security reasons that records are kept for a minimum period of time, and for compliance and performance reasons that records are not kept indefinitely. |
| AWS RDS Instance High Availability | AWS.RDS.Instance | Policy | This Policy ensures that RDS Instances have are running in High Availability mode to provide redundancy in the event of an operational failure. For Aurora, storage is replicated across all the Availability Zones and doesn't require this setting. |
| AWS RDS Instance Minor Version Upgrades | AWS.RDS.Instance | Policy | If you want Amazon RDS to upgrade the DB engine version of a database automatically, you can enable auto minor version upgrades for the database. |
| AWS RDS Instance Public Access | AWS.RDS.Instance | Policy | This Policy checks that an RDS Instance is not accessible from the public internet. |
| AWS RDS Instance Snapshot Public Access | AWS.RDS.Instance | Policy | This policy validates that RDS Instance snapshots are not publicly restorable. This would allow anyone to restore an old version of your database and have full access to its contents. |
| AWS RDS Master Password Updated | AWS.CloudTrail | Rule | A sensitive database operation that should be performed carefully or rarely |
| AWS Redshift Cluster Encryption | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Clusters have encryption enabled. |
| AWS Redshift Cluster Has Acceptable Snapshot Retention Period | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Cluster snapshot retention periods are set to an appropriate time. This ensures that records are kept long enough for compliance and security reasons, but no too long for compliance and performance reasons. |
| AWS Redshift Cluster Logging | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Cluster have logging enabled. This includes audit logs. |
| AWS Redshift Cluster Maintenance Window | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Clusters have the correct preferred maintenance window configured. |
| AWS Redshift Cluster Snapshot Retention | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Clusters have sufficient snapshot retention periods, so that snapshots are not lost before they are needed. |
| AWS Redshift Cluster Version Upgrade | AWS.Redshift.Cluster | Policy | This policy validates that Redshift Clusters automatically perform upgrades during scheduled maintenance windows. |
| AWS Resource Made Public | AWS.CloudTrail | Rule | Some AWS resource was made publicly accessible over the internet. Checks ECR, Elasticsearch, KMS, S3, S3 Glacier, SNS, SQS, and Secrets Manager. |
| AWS Resource Minimum Tags | AWS.EC2.Instance AWS.EC2.SecurityGroup AWS.EC2.VPC AWS.IAM.User | Policy | This policy ensures that applicable resources have a minimum number of tags set. |
| AWS Resource Required Tags | AWS.EC2.Instance AWS.EC2.SecurityGroup AWS.EC2.VPC AWS.IAM.User | Policy | This policy ensures that AWS resources have specific tags, dependent on their resource type. |
| AWS Root Account Access Keys | AWS.IAM.RootUser | Policy | This policy validates that no programmatic access keys exist for the root account. |
| AWS Root Account Hardware MFA | AWS.IAM.RootUser | Policy | This policy validates that a hardware MFA device is in use for access to the root account. |
| AWS Root Account MFA | AWS.IAM.RootUser | Policy | This policy validates that Multi Factor Authentication (MFA) is required for access to the root account. |
| AWS S3 Access Error | AWS.S3ServerAccess | Rule | Checks for errors during S3 Object access. This could be due to insufficient access permissions, non-existent buckets, or other reasons. |
| AWS S3 Access IP Allowlist | AWS.S3ServerAccess | Rule | Checks that the remote IP accessing the S3 bucket is in the IP allowlist. |
| AWS S3 Bucket Action Restrictions | AWS.S3.Bucket | Policy | Ensures that the S3 bucket policy does not allow any action on the bucket, in accordance with the principal of least privilege. |
| AWS S3 Bucket Encryption | AWS.S3.Bucket | Policy | Ensures that the S3 bucket has encryption enabled. |
| AWS S3 Bucket Lifecycle Configuration | AWS.S3.Bucket | Policy | Verifies that the S3 Bucket Object Lifecycle configuration expires data within 90 and 365 days. |
| AWS S3 Bucket Logging | AWS.S3.Bucket | Policy | Ensures that a logging policy is set for the S3 bucket. |
| AWS S3 Bucket MFA Delete | AWS.S3.Bucket | Policy | Ensures that MFA delete is enabled for a bucket so that all objects can only be deleted by users authenticated with MFA. |
| AWS S3 Bucket Name DNS Compliance | AWS.S3.Bucket | Policy | This policy validates that the AWS S3 bucket name is DNS compliant. |
| AWS S3 Bucket Object Lock Configured | AWS.S3.Bucket | Policy | This policy validates that S3 buckets have an Object Lock configuration enabled. This should be used with specific suppression lists to ensure it is applied only to appropriate S3 buckets, such as those containing CloudTrail or other auditable records. |
| AWS S3 Bucket Policy Allow With Not Principal | AWS.S3.Bucket | Policy | Prevents the use of a 'Not' principal in conjunction with an allow effect in an S3 bucket policy, which would allow global access for the resource besides the principals specified. |
| AWS S3 Bucket Policy Modified | AWS.CloudTrail | Rule | An S3 Bucket was modified. |
| AWS S3 Bucket Principal Restrictions | AWS.S3.Bucket | Policy | This policy validates that S3 Bucket access policies do not allow all users (Principal:"*") for a given action on the bucket, in accordance with the principle of least privilege. |
| AWS S3 Bucket Public Access Block | AWS.S3.Bucket | Policy | Ensures that a Public Access Block Configuration is set for the given S3 bucket. |
| AWS S3 Bucket Public Read | AWS.S3.Bucket | Policy | Ensures that the S3 bucket is not publicly readable. |
| AWS S3 Bucket Public Write | AWS.S3.Bucket | Policy | Ensures that the S3 bucket is not publicly writeable. |
| AWS S3 Bucket Secure Access | AWS.S3.Bucket | Policy | Ensures access to S3 buckets is forced to use a secure (HTTPS) connection. |
| AWS S3 Bucket Versioning | AWS.S3.Bucket | Policy | Checks that object versioning is enabled in the S3 bucket. |
| AWS S3 Insecure Access | AWS.S3ServerAccess | Rule | Checks if HTTP (unencrypted) was used to access objects in an S3 bucket, as opposed to HTTPS (encrypted). |
| AWS S3 Unauthenticated Access | AWS.S3ServerAccess | Rule | Checks for S3 access attempts where the requester is not an authenticated AWS user. |
| AWS S3 Unknown Requester | AWS.S3ServerAccess | Rule | Validates that proper IAM entities are accessing sensitive data buckets. |
| AWS SAML Activity | AWS.CloudTrail | Rule | Identifies when SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML. |
| AWS Security Group - Only DMZ Publicly Accessible | AWS.EC2.SecurityGroup | Policy | This policy validates that only Security Groups designated as DMZs allow inbound traffic from public IP space. This helps ensure no traffic is bypassing the DMZ. |
| AWS Security Group Administrative Ingress | AWS.EC2.SecurityGroup | Policy | This policy validates that AWS Security Groups don't allow unrestricted inbound traffic on port 3389 or 22, ports commonly used for the remote access protocols RDP and SSH respectively. |
| AWS Security Group Restricts Access To CDE | AWS.EC2.SecurityGroup | Policy | This policy validates that are considered part of the PCI CDE do not allow any access from public IP space. |
| AWS Security Group Restricts Inbound Traffic | AWS.EC2.SecurityGroup | Policy | This policy validates that Security Groups have some restrictions on inbound traffic. |
| AWS Security Group Restricts Inter-SG Traffic | AWS.EC2.SecurityGroup | Policy | This policy validates that Security Groups have restrictions on inter Security Group traffic. Administrators may assume there is an implicit level of trust between Security Groups in the same account, but this is not always a good assumption in cases one Security Group contains far more sensitive data that another. |
| AWS Security Group Restricts Outbound Traffic | AWS.EC2.SecurityGroup | Policy | This policy validates that Security Groups have some restrictions on outbound traffic. |
| AWS Security Group Restricts Traffic Leaving CDE | AWS.EC2.SecurityGroup | Policy | This policy validates that there are restrictions on what type of traffic may leave Security Groups that are considered with the scope of the PCI CDE. These restrictions help ensure that cardholder data does not leave the CDE. |
| AWS Security Group Tightly Restricts Inbound Traffic | AWS.EC2.SecurityGroup | Policy | This policy validates that Security Groups have restrictive permission sets that both limit the total number of open ports, as well as limiting ports typically associated with insecure protocols. |
| AWS Security Group Tightly Restricts Outbound Traffic | AWS.EC2.SecurityGroup | Policy | This policy validates that Security Groups have restrictive controls on outbound traffic. |
| AWS SecurityHub Finding Evasion | AWS.CloudTrail | Rule | Detections modification of findings in SecurityHub |
| AWS Snapshot Made Public | AWS.CloudTrail | Rule | An AWS storage snapshot was made public. |
| AWS Software Discovery | AWS.CloudTrail | Rule | A user is obtaining a list of security software, configurations, defensive tools, and sensors that are in AWS. |
| AWS Trusted IPSet Modified | AWS.CloudTrail | Rule | Detects creation and updates of the list of trusted IPs used by GuardDuty and WAF. Potentially to disable security alerts against malicious IPs. |
| AWS Unsuccessful MFA attempt | AWS.CloudTrail | Rule | Monitor application logs for suspicious events including repeated MFA failures that may indicate user's primary credentials have been compromised. |
| AWS Unused Access Key | AWS.IAM.User | Policy | This policy validates that IAM user access keys are used at least once every 90 days. |
| AWS User API Key Created | AWS.CloudTrail | Rule | Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. |
| AWS User Login Profile Modified | AWS.CloudTrail | Rule | An attacker with iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console. May be legitimate account administration. |
| AWS VPC Default Network ACL Restricts All Traffic | AWS.EC2.VPC | Policy | This policy validates that the default Network ACL for a given AWS VPC is restricting all inbound and outbound traffic. |
| AWS VPC Default Security Group Restrictions | AWS.EC2.VPC | Policy | This policy validates that the default Security Group for a given AWS VPC is restricting all inbound and outbound traffic. |
| AWS VPC Flow Logs | AWS.EC2.VPC | Policy | This policy validates that AWS VPCs (Virtual Private Clouds) have network flow logging enabled. |
| AWS VPC Healthy Log Status | AWS.VPCFlow | Rule | Checks for the log status `SKIP-DATA`, which indicates that data was lost either to an internal server error or due to capacity constraints. |
| AWS WAF Disassociation | AWS.CloudTrail | Rule | Detection to alert when a WAF disassociates from a source. |
| AWS WAF Has XSS Predicate | AWS.WAF.Regional.WebACL AWS.WAF.WebACL | Policy | This policy validates that all WAF's have at least one rule with a predicate matching on and blocking XSS attacks. |
| AWS WAF Rule Ordering | AWS.WAF.Regional.WebACL AWS.WAF.WebACL | Policy | This policy validates that all WAF's have the correct rule ordering. Incorrect rule ordering could lead to less restrictive rules being matched and allowing traffic through before more restrictive rules that should have blocked the traffic. |
| Azure Many Failed SignIns | Azure.Audit | Rule | This detection looks for a number of failed sign-ins for the same ServicePrincipalName or UserPrincipalName |
| Azure RiskLevel Passthrough | Azure.Audit | Rule | This detection surfaces an alert based on riskLevelAggregated, riskLevelDuringSignIn, and riskState.riskLevelAggregated and riskLevelDuringSignIn are only expected for Azure AD Premium P2 customers. |
| Azure SignIn via Legacy Authentication Protocol | Azure.Audit | Rule | This detection looks for Successful Logins that have used legacy authentication protocols |
| BETA - Sensitive 1Password Item Accessed | OnePassword.ItemUsage | Rule | Alerts when a user defined list of sensitive items in 1Password is accessed |
| Box Access Granted | Box.Event | Rule | A user granted access to their box account to Box technical support from account settings. |
| Box Content Workflow Policy Violation | Box.Event | Rule | A user violated the content workflow policy. |
| Box event triggered by unknown or external user | Box.Event | Rule | An external user has triggered a box enterprise event. |
| Box item shared externally | Box.Event | Rule | A user has shared an item and it is accessible to anyone with the share link (internal or external to the company). This rule requires that the boxsdk[jwt] be installed in the environment. |
| Box Large Number of Downloads | Box.Event | Rule | A user has exceeded the threshold for number of downloads within a single time frame. |
| Box Large Number of Permission Changes | Box.Event | Rule | A user has exceeded the threshold for number of folder permission changes within a single time frame. |
| Box New Login | Box.Event | Rule | A user logged in from a new device. |
| Box Shield Detected Anomalous Download Activity | Box.Event | Rule | A user's download activity has altered significantly. |
| Box Shield Suspicious Alert Triggered | Box.Event | Rule | A user login event or session event was tagged as medium to high severity by Box Shield. |
| Box Untrusted Device Login | Box.Event | Rule | A user attempted to login from an untrusted device. |
| Brute Force By IP | AWS.CloudTrail Asana.Audit Atlassian.Audit Box.Event GSuite.Reports Okta.SystemLog OneLogin.Events OnePassword.SignInAttempt | Rule | An actor user was denied login access more times than the configured threshold. |
| Cisco Umbrella Domain Blocked | CiscoUmbrella.DNS | Rule | Monitor blocked domains |
| Cisco Umbrella Domain Name Fuzzy Matching | CiscoUmbrella.DNS | Rule | Identify lookups to suspicious domains that could indicate a phishing attack. |
| Cisco Umbrella Suspicious Domains | CiscoUmbrella.DNS | Rule | Monitor suspicious or known malicious domains |
| Cloudflare Bot High Volume | Cloudflare.HttpRequest | Rule | Monitors for bots making HTTP Requests at a rate higher than 2req/sec |
| Cloudflare Bot High Volume GreyNoise | Cloudflare.HttpRequest | Rule | Monitors for high volume of likely automated HTTP Requests with GreyNoise enrichment |
| Cloudflare L7 DDoS | Cloudflare.Firewall | Rule | Layer 7 Distributed Denial of Service (DDoS) detected |
| Cloudflare Suspicious Event - GreyNoise | Cloudflare.Firewall | Rule | Monitors for non-blocked requests from Greynoise identified malicious IP Addresses |
| CloudTrail Password Spraying | AWS.CloudTrail | Scheduled Rule | Detect password spraying account using a scheduled query |
| CloudTrail Stopped | AWS.CloudTrail | Rule | A CloudTrail Trail was modified. |
| CodeBuild Project made Public | AWS.CloudTrail | Rule | An AWS CodeBuild Project was made publicly accessible |
| Configuration Required - Sensitive 1Password Item Accessed | OnePassword.ItemUsage | Rule | Alerts when a user defined list of sensitive items in 1Password is accessed |
| Confluence 0-Day Indicators of Compromise (IOCs) | AWS.ALB AWS.CloudTrail AWS.GuardDuty AWS.S3ServerAccess AWS.VPCFlow Apache.AccessCombined Apache.AccessCommon Cloudflare.Firewall Cloudflare.HttpRequest GCP.AuditLog Juniper.Access Nginx.Access | Rule | Detects IP addresses observed exploiting the 0-Day CVE-2022-26134 |
| Connection to Embargoed Country | Crowdstrike.FDREvent | Rule | Detection to alert when internal asset is communicating with an sanctioned destination. This detection leverages Panther UDM and IPInfo enrichment. |
| Crowdstrike Credential Dumping Tool | Crowdstrike.FDREvent | Rule | Detects usage of tools commonly used for credential dumping. |
| Crowdstrike Cryptomining Tools | Crowdstrike.FDREvent | Rule | Detects the execution of known crytocurrency mining tools. |
| Crowdstrike Detection Passthrough | Crowdstrike.DetectionSummary Crowdstrike.FDREvent | Rule | Crowdstrike Falcon has detected malicious activity on a host. |
| Crowdstrike FDR LOLBAS | Crowdstrike.FDREvent | Rule | Living off the land binaries and script usage |
| CrowdStrike Large Zip Creation | Crowdstrike.Unknown | Scheduled Query | Detects creation of large zip files, which can indicate attempts of exfiltration |
| CrowdStrike Large Zip Creation (crowdstrike_fdrevent table) | Crowdstrike.FDREvent | Scheduled Query | Detects creation of large zip files, which can indicate attempts of exfiltration (crowdstrike_fdrevent table) |
| CrowdStrike MacOS Added Trusted Cert | Crowdstrike.FDREvent | Rule | Detects attempt to install a root certificate on MacOS |
| CrowdStrike MacOS Osascript as Administrator | Crowdstrike.FDREvent | Rule | Detects usage of osascript with administrator privileges |
| CrowdStrike MacOS plutil Usage | Crowdstrike.FDREvent | Rule | Detects the usage of plutil to modify plist files. Plist files run on start up and are often used by attackers to maintain persistence. |
| Crowdstrike Real Time Response (RTS) Session | Crowdstrike.FDREvent Crowdstrike.Unknown | Rule | Alert when someone uses Crowdstrike’s RTR (real-time response) capability to access a machine remotely to run commands. |
| Crowdstrike Remote Access Tool Execution | Crowdstrike.FDREvent | Rule | Detects usage of common remote access tools. |
| Crowdstrike Reverse Shell Tool Executed | Crowdstrike.FDREvent | Rule | Detects usage of tools commonly used to to establish reverse shells on Windows machines. |
| Crowdstrike Systemlog Tampering | Crowdstrike.FDREvent | Rule | Detects when a user attempts to clear system logs. |
| Crowdstrike Unusual Parent Child Processes | Crowdstrike.FDREvent | Rule | Detects unusual parent child process pairings. |
| Crowdstrike WMI Query Detection | Crowdstrike.FDREvent | Rule | Detects execution of WMI queries involving information gathering or actions on remote systems, which could indicate reconnaissance or lateral movement. |
| Detect Reconnaissance from IAM Users | AWS.CloudTrail | Rule | An IAM user has a high volume of access denied API calls. |
| Detection content has been deleted from Panther | Panther.Audit | Rule | Detection content has been removed from Panther. |
| DNS Base64 Encoded Query | AWS.VPCDns CiscoUmbrella.DNS Crowdstrike.FDREvent | Rule | Detects DNS queries with Base64 encoded subdomains, which could indicate an attempt to obfuscate data exfil. |
| DNS request to denylisted domain | Crowdstrike.DNSRequest Crowdstrike.FDREvent | Rule | A DNS request was made to a domain on an explicit denylist |
| Dropbox Admin sign-in-as Session | Dropbox.TeamEvent | Rule | Alerts when an admin starts a sign-in-as session. |
| Dropbox Document/Folder Ownership Transfer | Dropbox.TeamEvent | Rule | Dropbox ownership of a document or folder has been transferred. |
| Dropbox External Share | Dropbox.TeamEvent | Rule | Dropbox item shared externally |
| Dropbox Linked Team Application Added | Dropbox.TeamEvent | Rule | An application was linked to your Dropbox Account |
| Dropbox Many Deletes | Dropbox.TeamEvent | Scheduled Query | Dropbox Many Deletes |
| Dropbox Many Deletes | Dropbox.TeamEvent | Scheduled Rule | Detects when a dropbox user deletes many documents. |
| Dropbox Many Downloads | Dropbox.TeamEvent | Scheduled Query | Dropbox Many Downloads |
| Dropbox Many Downloads | Dropbox.TeamEvent | Scheduled Rule | Detects when a dropbox user downloads many documents. |
| Dropbox User Disabled 2FA | Dropbox.TeamEvent | Rule | Dropbox user has disabled 2fa login |
| Duo Admin App Integration Secret Key Viewed | Duo.Administrator | Rule | An administrator viewed a Secret Key for an Application Integration |
| Duo Admin Bypass Code Created | Duo.Administrator | Rule | A Duo administrator created an MFA bypass code for an application. |
| Duo Admin Bypass Code Viewed | Duo.Administrator | Rule | An administrator viewed the MFA bypass code for a user. |
| Duo Admin Create Admin | Duo.Administrator | Rule | A new Duo Administrator was created. |
| Duo Admin Lockout | Duo.Administrator | Rule | Alert when a duo administrator is locked out of their account. |
| Duo Admin Marked Push Fraudulent | Duo.Administrator | Rule | A Duo push was marked fraudulent by an admin. |
| Duo Admin MFA Restrictions Updated | Duo.Administrator | Rule | Detects changes to allowed MFA factors administrators can use to log into the admin panel. |
| Duo Admin New Admin API App Integration | Duo.Administrator | Rule | Identifies creation of new Admin API integrations for Duo. |
| Duo Admin Policy Updated | Duo.Administrator | Rule | A Duo Administrator updated a Policy, which governs how users authenticate. |
| Duo Admin SSO SAML Requirement Disabled | Duo.Administrator | Rule | Detects when SAML Authentication for Administrators is marked as Disabled or Optional. |
| Duo Admin User MFA Bypass Enabled | Duo.Administrator | Rule | An Administrator enabled a user to authenticate without MFA. |
| Duo User Action Reported as Fraudulent | Duo.Authentication | Rule | Alert when a user reports a Duo action as fraudulent. |
| Duo User Auth Denied For Anomalous Push | Duo.Authentication | Rule | A Duo authentication was denied due to an anomalous 2FA push. |
| Duo User Bypass Code Used | Duo.Authentication | Rule | A Duo user's bypass code was used to authenticate |
| Duo User Denied For Endpoint Error | Duo.Authentication | Rule | A Duo user's authentication was denied due to a suspicious error on the endpoint |
| EC2 Network ACL Modified | AWS.CloudTrail | Rule | An EC2 Network ACL was modified. |
| EC2 Network Gateway Modified | AWS.CloudTrail | Rule | An EC2 Network Gateway was modified. |
| EC2 Route Table Modified | AWS.CloudTrail | Rule | An EC2 Route Table was modified. |
| EC2 Security Group Modified | AWS.CloudTrail | Rule | An EC2 Security Group was modified. |
| EC2 VPC Modified | AWS.CloudTrail | Rule | An EC2 VPC was modified. |
| ECR CRUD Actions | AWS.CloudTrail | Rule | Unauthorized ECR Create, Read, Update, or Delete event occurred. |
| EKS Audit Log based single sourceIP is generating multiple 403s | Amazon.EKS.Audit | Rule | This detection identifies if a public sourceIP is generating multiple 403s with the Kubernetes API server. |
| EKS Audit Log Reporting system Namespace is Used From A Public IP | Amazon.EKS.Audit | Rule | This detection identifies if an activity is recorded in the Kubernetes audit log where the user:username attribute begins with "system:" or "eks:" and the requests originating IP Address is a Public IP Address |
| Enabled Zendesk Support to Assume Users | Zendesk.Audit | Rule | User enabled or disabled zendesk support user assumption. |
| Exec into Pod | GCP.AuditLog | Rule | Alerts when users exec into pod. Possible to specify specific projects and allowed users. |
| Execution of Command Line Tool with Base64 Encoded Arguments | Crowdstrike.FDREvent | Rule | Detects the execution of common command line tools (e.g., PowerShell, cmd.exe) with Base64 encoded arguments, which could indicate an attempt to obfuscate malicious commands. |
| External GSuite File Share | GSuite.Reports | Rule | An employee shared a sensitive file externally with another organization |
| Failed Root Console Login | AWS.CloudTrail | Rule | A Root console login failed. |
| GCP Access Attempts Violating IAP Access Controls | GCP.HTTPLoadBalancer | Rule | GCP Access Attempts Violating IAP Access Controls |
| GCP Access Attempts Violating VPC Service Controls | GCP.AuditLog | Rule | An access attempt violating VPC service controls (such as Perimeter controls) has been made. |
| GCP BigQuery Large Scan | GCP.AuditLog | Rule | Detect any BigQuery query that is doing a very large scan (> 1 GB). |
| GCP Cloud Storage Buckets Modified Or Deleted | GCP.AuditLog | Rule | Detects GCP cloud storage bucket updates and deletes. |
| GCP Corporate Email Not Used | GCP.AuditLog | Rule | A Gmail account is being used instead of a corporate email |
| GCP Destructive Queries | GCP.AuditLog | Rule | Detect any destructive BigQuery queries or jobs such as update, delete, drop, alter or truncate. |
| GCP DNS Zone Modified or Deleted | GCP.AuditLog | Rule | Detection for GCP DNS zones that are deleted, patched, or updated. |
| GCP Firewall Rule Created | GCP.AuditLog | Rule | This rule detects creations of GCP firewall rules. |
| GCP Firewall Rule Deleted | GCP.AuditLog | Rule | This rule detects deletions of GCP firewall rules. |
| GCP Firewall Rule Modified | GCP.AuditLog | Rule | This rule detects modifications to GCP firewall rules. |
| GCP GCS IAM Permission Changes | GCP.AuditLog | Rule | Monitoring changes to Cloud Storage bucket permissions may reduce time to detect and correct permissions on sensitive Cloud Storage bucket and objects inside the bucket. |
| GCP IAM Role Has Changed | GCP.AuditLog | Rule | A custom role has been created, deleted, or updated. |
| GCP Log Bucket or Sink Deleted | GCP.AuditLog | Rule | This rule detects deletions of GCP Log Buckets or Sinks. |
| GCP Logging Settings Modified | GCP.AuditLog | Rule | Detects any changes made to logging settings |
| GCP Logging Sink Modified | GCP.AuditLog | Rule | This rule detects modifications to GCP Log Sinks. |
| GCP Org or Folder Policy Was Changed Manually | GCP.AuditLog | Rule | Alert if a GCP Org or Folder Policy Was Changed Manually. |
| GCP Permissions Granted to Create or Manage Service Account Key | GCP.AuditLog | Rule | Permissions granted to impersonate a service account. This includes predefined service account IAM roles granted at the parent project, folder or organization-level. |
| GCP Resource in Unused Region | GCP.AuditLog | Rule | Adversaries may create cloud instances in unused geographic service regions in order to evade detection. |
| GCP Service Account Access Denied | GCP.AuditLog | Rule | This rule detects deletions of GCP Log Buckets or Sinks. |
| GCP Service Account or Keys Created | GCP.AuditLog | Rule | Detects when a service account or key is created manually by a user instead of an automated workflow. |
| GCP SQL Config Changes | GCP.AuditLog | Rule | Monitoring changes to Sql Instance configuration changes may reduce time to detect and correct misconfigurations done on sql server. |
| GCP User Added to IAP Protected Service | GCP.AuditLog | Rule | A user has been granted access to a IAP protected service. |
| GCP VPC Flow Logs Disabled | GCP.AuditLog | Rule | VPC flow logs were disabled for a subnet. |
| GCS Bucket Made Public | GCP.AuditLog | Rule | Adversaries may access data objects from improperly secured cloud storage. |
| Geographically Improbable Okta Login | Okta.SystemLog | Rule | A user has subsequent logins from two geographic locations that are very far apart |
| GitHub Action Failed | GitHub.Audit | Rule | A monitored github action has failed. |
| GitHub Branch Protection Disabled | GitHub.Audit | Rule | Disabling branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity. |
| GitHub Branch Protection Policy Override | GitHub.Audit | Rule | Bypassing branch protection controls could indicate malicious use of admin credentials in an attempt to hide activity. |
| GitHub Org Authentication Method Changed | GitHub.Audit | Rule | Detects changes to GitHub org authentication changes. |
| GitHub Org IP Allow List modified | GitHub.Audit | Rule | Detects changes to a GitHub Org IP Allow List |
| Github Organization App Integration Installed | GitHub.Audit | Rule | An application integration was installed to your organization's Github account by someone in your organization. |
| Github Public Repository Created | GitHub.Audit | Rule | A public Github repository was created. |
| GitHub Repository Collaborator Change | GitHub.Audit | Rule | Detects when a repository collaborator is added or removed. |
| GitHub Repository Created | GitHub.Audit | Rule | Detects when a repository is created. |
| Github Repository Transfer | GitHub.Audit | Rule | A user accepted a request to receive a transferred Github repository, a Github repository was transferred to another repository network, or a user sent a request to transfer a repository to another user or organization. |
| GitHub Repository Visibility Change | GitHub.Audit | Rule | Detects when an organization repository visibility changes. |
| GitHub Secret Scanning Alert Created | GitHub.Audit | Rule | GitHub detected a secret and created a secret scanning alert. |
| GitHub Security Change, includes GitHub Advanced Security | GitHub.Audit | Rule | The rule alerts when GitHub Security tools (Dependabot, Secret Scanner, etc) are disabled. |
| GitHub Team Modified | GitHub.Audit | Rule | Detects when a team is modified in some way, such as adding a new team, deleting a team, modifying members, or a change in repository control. |
| GitHub User Access Key Created | GitHub.Audit | Rule | Detects when a GitHub user access key is created. |
| GitHub User Added or Removed from Org | GitHub.Audit | Rule | Detects when a user is added or removed from a GitHub Org. |
| GitHub User Added to Org Moderators | GitHub.Audit | Rule | Detects when a user is added to a GitHub org's list of moderators. |
| GitHub User Initial Access to Private Repo | GitHub.Audit | Rule | Detects when a user initially accesses a private organization repository. |
| GitHub User Role Updated | GitHub.Audit | Rule | Detects when a GitHub user role is upgraded to an admin or downgraded to a member |
| GitHub Web Hook Modified | GitHub.Audit | Rule | Detects when a web hook is added, modified, or deleted in an org repository. |
| Google Accessed a GSuite Resource | GSuite.ActivityEvent | Rule | Google accessed one of your GSuite resources directly, most likely in response to a support incident. |
| Google Drive High Download Count | GSuite.ActivityEvent | Scheduled Rule | Scheduled rule for the High Google Drive Download Count query which looks for incidents of more than 10 (tunable) downloads by a user in the past day. |
| Google Workspace Admin Custom Role | GSuite.ActivityEvent | Rule | A Google Workspace administrator created a new custom administrator role. |
| Google Workspace Advanced Protection Program | GSuite.ActivityEvent | Rule | Your organization's Google Workspace Advanced Protection Program settings were modified. |
| Google Workspace Apps Marketplace Allowlist | GSuite.ActivityEvent | Rule | Google Workspace Marketplace application allowlist settings were modified. |
| Google Workspace Apps Marketplace New Domain Application | GSuite.ActivityEvent | Rule | A Google Workspace User configured a new domain application from the Google Workspace Apps Marketplace. |
| Google Workspace Apps New Mobile App Installed | GSuite.ActivityEvent | Rule | A new mobile application was added to your organization's mobile apps whitelist in Google Workspace Apps. |
| GreyNoise Malicious AWS S3 Get/List Object | AWS.CloudTrail | Rule | S3 operations from known malicious GreyNoise classifications. Note that this rule will only work with S3 object-level logging enabled for a given bucket. |
| GSuite Calendar Has Been Made Public | GSuite.ActivityEvent | Rule | A User or Admin Has Modified A Calendar To Be Public |
| GSuite Device Suspicious Activity | GSuite.ActivityEvent | Rule | GSuite reported a suspicious activity on a user's device. |
| GSuite Document External Ownership Transfer | GSuite.ActivityEvent | Rule | A GSuite document's ownership was transferred to an external party. |
| GSuite Drive Many Documents Deleted | GSuite.ActivityEvent | Scheduled Rule | Scheduled rule for the GSuite Drive Many Documents Deleted query. Looks for users who have deleted more than 10 (tunable) documents the past day. |
| GSuite External Drive Document | GSuite.Reports | Rule | A Google drive resource became externally accessible. |
| GSuite Government Backed Attack | GSuite.ActivityEvent | Rule | GSuite reported that it detected a government backed attack against your account. |
| GSuite Login Type | GSuite.ActivityEvent | Rule | A login of a non-approved type was detected for this user. |
| Gsuite Mail forwarded to external domain | GSuite.ActivityEvent | Rule | A user has configured mail forwarding to an external domain |
| GSuite Many Docs Deleted Query | GSuite.ActivityEvent | Scheduled Query | Query to search for a user deleting many documents. |
| GSuite Many Docs Downloaded Query | GSuite.ActivityEvent | Scheduled Query | Query to search high document download counts by users. |
| GSuite Overly Visible Drive Document | GSuite.Reports | Rule | A Google drive resource that is overly visible has been modified. |
| GSuite Passthrough Rule Triggered | GSuite.ActivityEvent | Rule | A GSuite rule was triggered. |
| GSuite User Advanced Protection Change | GSuite.ActivityEvent | Rule | A user disabled advanced protection for themselves. |
| GSuite User Banned from Group | GSuite.ActivityEvent | Rule | A GSuite user was banned from an enterprise group by moderator action. |
| GSuite User Device Compromised | GSuite.ActivityEvent | Rule | GSuite reported a user's device has been compromised. |
| GSuite User Device Unlock Failures | GSuite.ActivityEvent | Rule | Someone failed to unlock a user's device multiple times in quick succession. |
| GSuite User Password Leaked | GSuite.ActivityEvent | Rule | GSuite reported a user's password has been compromised, so they disabled the account. |
| GSuite User Suspended | GSuite.ActivityEvent | Rule | A GSuite user was suspended, the account may have been compromised by a spam network. |
| GSuite User Two Step Verification Change | GSuite.ActivityEvent | Rule | A user disabled two step verification for themselves. |
| GSuite Workspace Calendar External Sharing Setting Change | GSuite.ActivityEvent | Rule | A Workspace Admin Changed The Sharing Settings for Primary Calendars |
| GSuite Workspace Data Export Has Been Created | GSuite.ActivityEvent | Rule | A Workspace Admin Has Created a Data Export |
| GSuite Workspace Gmail Default Routing Rule Modified | GSuite.ActivityEvent | Rule | A Workspace Admin Has Modified A Default Routing Rule In Gmail |
| GSuite Workspace Gmail Pre-Delivery Message Scanning Disabled | GSuite.ActivityEvent | Rule | A Workspace Admin Has Disabled Pre-Delivery Scanning For Gmail. |
| GSuite Workspace Gmail Security Sandbox Disabled | GSuite.ActivityEvent | Rule | A Workspace Admin Has Disabled The Security Sandbox |
| GSuite Workspace Password Reuse Has Been Enabled | GSuite.ActivityEvent | Rule | A Workspace Admin Has Enabled Password Reuse |
| GSuite Workspace Strong Password Enforcement Has Been Disabled | GSuite.ActivityEvent | Rule | A Workspace Admin Has Disabled The Enforcement Of Strong Passwords |
| GSuite Workspace Trusted Domain Allowlist Modified | GSuite.ActivityEvent | Rule | A Workspace Admin Has Modified The Trusted Domains List |
| IAM Assume Role Blocklist Ignored | AWS.CloudTrail | Rule | A user assumed a role that was explicitly blocklisted for manual user assumption. |
| IAM Change | AWS.CloudTrail | Rule | A change occurred in the IAM configuration. This could be a resource being created, deleted, or modified. This is a high level view of changes, helfpul to indicate how dynamic a certain IAM environment is. |
| IAM Entity Created Without CloudFormation | AWS.CloudTrail | Rule | An IAM Entity (Group, Policy, Role, or User) was created manually. IAM entities should be created in code to ensure that permissions are tracked and managed correctly. |
| IAM Inline Policy Network Admin | AWS.IAM.Group AWS.IAM.Role AWS.IAM.User | Policy | This policy validates that IAM entities (Groups, Roles, and Users) do not have inline policies attached that grant network admin privileges. Inline policies are more difficult to track and audit than managed policies, and can lead to persistent unexpected access. |
| IAM Policy Modified | AWS.CloudTrail | Rule | An IAM Policy was changed. |
| Impossible Travel for Login Action | AWS.CloudTrail Asana.Audit Okta.SystemLog | Rule | A user has subsequent logins from two geographic locations that are very far apart |
| KMS CMK Disabled or Deleted | AWS.CloudTrail | Rule | A KMS Customer Managed Key was disabled or scheduled for deletion. This could potentially lead to permanent loss of encrypted data. |
| Lambda CRUD Actions | AWS.CloudTrail | Rule | Unauthorized lambda Create, Read, Update, or Delete event occurred. |
| Log4J Exploit IOC Search | AWS.ALB AWS.CloudTrail AWS.S3ServerAccess Apache.AccessCombined Apache.AccessCommon Cloudflare.Firewall Cloudflare.HttpRequest Fastly.Access GCP.AuditLog Juniper.Access Juniper.Firewall Nginx.Access Syslog.RFC3164 Syslog.RFC5424 | Rule | Monitors for potential exploit attempts agains CVE-2021-44228, Log4J remote code execution |
| Logins Without MFA | AWS.CloudTrail | Rule | A console login was made without multi-factor authentication. |
| Logins Without SAML | AWS.CloudTrail | Rule | An AWS console login was made without SAML/SSO. |
| MacOS ALF is misconfigured | Osquery.Differential | Rule | The application level firewall blocks unwanted network connections made to your computer from other computers on your network. |
| MacOS Browser Credential Access | Scheduled Query | Detects processes that contain known browser credential files in arguments. | |
| MacOS Browser Credential Access (crowdstrike_fdrevent table) | Crowdstrike.FDREvent | Scheduled Query | Detects processes that contain known browser credential files in arguments. (crowdstrike_fdrevent table) |
| MacOS Keyboard Events | Osquery.Differential | Rule | A Key Logger has potentially been detected on a macOS system |
| macOS Malware Detected with osquery | Osquery.Differential | Rule | Malware has potentially been detected on a macOS system |
| Malicious Content Detected | Box.Event | Rule | Box has detect malicious content, such as a virus. |
| Malicious SSO DNS Lookup | CiscoUmbrella.DNS Crowdstrike.DNSRequest Crowdstrike.FDREvent Suricata.DNS Zeek.DNS | Rule | The rule looks for DNS requests to sites potentially posing as SSO domains. |
| MFA Disabled | Atlassian.Audit GitHub.Audit Okta.SystemLog Zendesk.Audit | Rule | Detects when Multi-Factor Authentication (MFA) is disabled |
| Microsoft Exchange External Forwarding | Microsoft365.Audit.Exchange | Rule | Detects creation of forwarding rule to external domains |
| Microsoft Graph Passthrough | MicrosoftGraph.SecurityAlert | Rule | The Microsoft Graph security API federates queries to all onboarded security providers, including Azure AD Identity Protection, Microsoft 365, Microsoft Defender (Cloud, Endpoint, Identity) and Microsoft Sentinel. Details https://learn.microsoft.com/en-us/graph/api/resources/security-api-overview |
| Microsoft365 Brute Force Login by User | Microsoft365.Audit.AzureActiveDirectory | Rule | A Microsoft365 user was denied login access several times |
| Microsoft365 External Document Sharing | Microsoft365.Audit.SharePoint | Rule | Document shared externally |
| Microsoft365 MFA Disabled | Microsoft365.Audit.AzureActiveDirectory | Rule | A user's MFA has been removed |
| MongoDB Atlas API Key Created | MongoDB.OrganizationEvent | Rule | A MongoDB Atlas api key's access list was updated |
| MongoDB External User Invited | MongoDB.OrganizationEvent | Rule | An external user has been invited to a MongoDB org. |
| Monitor Unauthorized API Calls | AWS.CloudTrail | Rule | An unauthorized AWS API call was made |
| New AWS Account Created | AWS.CloudTrail | Rule | A new AWS account was created |
| New IAM Credentials Updated | AWS.CloudTrail | Rule | A console password, access key, or user has been created. |
| New User Account Created | AWS.CloudTrail OneLogin.Events Zoom.Operation | Rule | A new account was created |
| Notion Audit Log Exported | Notion.AuditLogs | Rule | A Notion User exported audit logs for your organization’s workspace. |
| Notion Many Pages Deleted | Notion.AuditLogs | Rule | A Notion User deleted multiple pages. |
| Notion Many Pages Exported | Notion.AuditLogs | Rule | A Notion User exported multiple pages. |
| Notion SAML SSO Configuration Changed | Notion.AuditLogs | Rule | A Notion User changed settings to enforce SAML SSO configurations for your organization. |
| Notion Workspace Exported | Notion.AuditLogs | Rule | A Notion User exported an existing workspace. |
| Notion Workspace public page added | Notion.AuditLogs | Rule | A Notion page was set to public in your worksace. |
| Okta Admin Access Granted | Okta.SystemLog | Scheduled Query | Audit instances of admin access granted in your okta tenant |
| Okta Admin Role Assigned | Okta.SystemLog | Rule | A user has been granted administrative privileges in Okta |
| Okta API Key Created | Okta.SystemLog | Rule | A user created an API Key in Okta |
| Okta API Key Revoked | Okta.SystemLog | Rule | A user has revoked an API Key in Okta |
| Okta App Refresh Access Token Reuse | Okta.SystemLog | Rule | https://developer.okta.com/docs/guides/refresh-tokens/main/#refresh-token-reuse-detection |
| Okta App Unauthorized Access Attempt | Okta.SystemLog | Rule | Detects when a user is denied access to an Okta application |
| Okta Group Admin Role Assigned | Okta.SystemLog | Rule | Detect when an admin role is assigned to a group |
| Okta Investigate MFA and Password resets | Okta.SystemLog | Scheduled Query | Investigate Password and MFA resets for the last 7 days |
| Okta Investigate Session ID Activity | Okta.SystemLog | Scheduled Query | Search for activity related to a specific SessionID in Okta panther_logs.okta_systemlog |
| Okta Investigate User Activity | Okta.SystemLog | Scheduled Query | Audit user activity across your environment. Customize to filter on specific users, time ranges, etc |
| Okta Login From CrowdStrike Unmanaged Device | Crowdstrike.AIDMaster Okta.SystemLog | Scheduled Query | Okta Logins from an IP Address not found in CrowdStrike's AIP List |
| Okta Login From CrowdStrike Unmanaged Device | Crowdstrike.AIDMaster Okta.SystemLog | Scheduled Rule | Detects Okta Logins from IP addresses not found in CrowdStrike's AIP list. May indicate unmanaged device being used, or faulty CrowdStrike Sensor. |
| Okta Login From CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) | Crowdstrike.FDREvent Okta.SystemLog | Scheduled Query | Okta Logins from an IP Address not found in CrowdStrike's AIP List (crowdstrike_fdrevent table) |
| Okta MFA Globally Disabled | Okta.SystemLog | Rule | An admin user has disabled the MFA requirement for your Okta account |
| Okta Password Accessed | Okta.SystemLog | Rule | User accessed another user's application password |
| Okta Rate Limits | Okta.SystemLog | Rule | Potential DoS/Bruteforce attack or hitting limits (system degradation) |
| Okta Support Access | Okta.SystemLog | Scheduled Query | Show instances that Okta support was granted to your account |
| Okta Support Access Granted | Okta.SystemLog | Rule | An admin user has granted access to Okta Support to your account |
| Okta Support Reset Credential | Okta.SystemLog | Rule | A Password or MFA factor was reset by Okta Support |
| Okta ThreatInsight Security Threat Detected | Okta.SystemLog | Rule | https://help.okta.com/en-us/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm |
| Okta User Account Locked | Okta.SystemLog | Rule | An Okta user has locked their account. |
| Okta User MFA Factor Suspend | Okta.SystemLog | Rule | Suspend factor or authenticator enrollment method for user. |
| Okta User MFA Own Reset | Okta.SystemLog | Rule | User has reset one of their own MFA factors |
| Okta User MFA Reset All | Okta.SystemLog | Rule | All MFA factors have been reset for a user. |
| Okta User Reported Suspicious Activity | Okta.SystemLog | Rule | Suspicious Activity Reporting provides an end user with the option to report unrecognized activity from an account activity email notification.This detection alerts when a user marks the raised activity as suspicious. https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm |
| OneLogin Active Login Activity | OneLogin.Events | Rule | Multiple user accounts logged in from the same ip address. |
| OneLogin Authentication Factor Removed | OneLogin.Events | Rule | A user removed an authentication factor or otp device. |
| OneLogin Failed High Risk Login | OneLogin.Events | Rule | A OneLogin attempt with a high risk factor (>50) resulted in a failed authentication. |
| OneLogin High Risk Login | OneLogin.Events | Rule | A OneLogin user successfully logged in after a failed high-risk login attempt. |
| OneLogin Multiple Accounts Deleted | OneLogin.Events | Rule | Possible Denial of Service detected. Threshold for user account deletions exceeded. |
| OneLogin Multiple Accounts Modified | OneLogin.Events | Rule | Possible Denial of Service detected. Threshold for user account password changes exceeded. |
| OneLogin Password Access | OneLogin.Events | Rule | User accessed another user's application password |
| OneLogin Unauthorized Access | OneLogin.Events | Rule | A OneLogin user was denied access to an app more times than the configured threshold. |
| OneLogin User Assumed Another User | OneLogin.Events | Rule | User assumed another user account |
| OneLogin User Locked | OneLogin.Events | Rule | User locked or suspended from their account. |
| OneLogin User Password Changed | OneLogin.Events | Rule | A user password was updated. |
| Osquery Agent Outdated | Osquery.Differential | Rule | Keep track of osquery versions, current is 4.1.2. |
| OSQuery Detected SSH Listener | Osquery.Differential | Rule | Check if SSH is listening in a non-production environment. This could be an indicator of persistent access within an environment. |
| OSQuery Detected Unwanted Chrome Extensions | Osquery.Differential | Rule | Monitor for chrome extensions that could lead to a credential compromise. |
| OSQuery Reports Application Firewall Disabled | Osquery.Differential | Rule | Verifies that MacOS has automatic software updates enabled. |
| OSSEC Rootkit Detected via Osquery | Osquery.Differential | Rule | Checks if any results are returned for the Osquery OSSEC Rootkit pack. |
| Panther SAML configuration has been modified | Panther.Audit | Rule | An Admin has modified Panther's SAML configuration. |
| RoleAssumes by Multiple Useragents | AWS.CloudTrail | Scheduled Query | RoleAssumes with multiple Useragents could indicate compromised credentials. |
| Root Account Access Key Created | AWS.CloudTrail | Rule | An access key was created for the Root account |
| Root Account Activity | AWS.CloudTrail | Rule | Root account activity was detected. |
| Root Console Login | AWS.CloudTrail | Rule | The root account has been logged into. |
| Root Password Changed | AWS.CloudTrail | Rule | Someone manually changed the Root console login password. |
| S3 Bucket Deleted | AWS.CloudTrail | Rule | A S3 Bucket, Policy, or Website was deleted |
| Salesforce Admin Login As User | Salesforce.LoginAs | Rule | Salesforce detection that alerts when an admin logs in as another user. |
| Sensitive AWS CloudWatch Log Encryption | AWS.CloudWatch.LogGroup | Policy | AWS automatically performs server-side encryption of logs, but you can encrypt with your own CMK to protect extra sensitive log data. |
| SentinelOne Alert Passthrough | SentinelOne.Activity | Rule | SentinelOne Alert Passthrough |
| SentinelOne Threats | SentinelOne.Activity | Rule | Passthrough SentinelOne Threats |
| Slack Anomaly Detected | Slack.AuditLogs | Rule | Passthrough for anomalies detected by Slack |
| Slack App Access Expanded | Slack.AuditLogs | Rule | Detects when a Slack App has had its permission scopes expanded |
| Slack App Added | Slack.AuditLogs | Rule | Detects when a Slack App has been added to a workspace |
| Slack App Removed | Slack.AuditLogs | Rule | Detects when a Slack App has been removed |
| Slack Denial of Service | Slack.AuditLogs | Rule | Detects when slack admin invalidates user session(s) more than once in a 24 hour period which can lead to DoS |
| Slack DLP Modified | Slack.AuditLogs | Rule | Detects when a Data Loss Prevention (DLP) rule has been deactivated or a violation has been deleted |
| Slack EKM Config Changed | Slack.AuditLogs | Rule | Detects when the logging settings for a workspace's EKM configuration has changed |
| Slack EKM Slackbot Unenrolled | Slack.AuditLogs | Rule | Detects when a workspace is longer enrolled in EKM |
| Slack EKM Unenrolled | Slack.AuditLogs | Rule | Detects when a workspace is no longer enrolled or managed by EKM |
| Slack IDP Configuration Changed | Slack.AuditLogs | Rule | Detects changes to the identity provider (IdP) configuration for Slack organizations. |
| Slack Information Barrier Modified | Slack.AuditLogs | Rule | Detects when a Slack information barrier is deleted/updated |
| Slack Intune MDM Disabled | Slack.AuditLogs | Rule | Detects the disabling of Microsoft Intune Enterprise MDM within Slack |
| Slack Legal Hold Policy Modified | Slack.AuditLogs | Rule | Detects changes to configured legal hold policies |
| Slack MFA Settings Changed | Slack.AuditLogs | Rule | Detects changes to Multi-Factor Authentication requirements |
| Slack Organization Created | Slack.AuditLogs | Rule | Detects when a Slack organization is created |
| Slack Organization Deleted | Slack.AuditLogs | Rule | Detects when a Slack organization is deleted |
| Slack Potentially Malicious File Shared | Slack.AuditLogs | Rule | Detects when a potentially malicious file is shared within Slack |
| Slack Private Channel Made Public | Slack.AuditLogs | Rule | Detects when a channel that was previously private is made public |
| Slack Service Owner Transferred | Slack.AuditLogs | Rule | Detects transferring of service owner on request from primary owner |
| Slack SSO Settings Changed | Slack.AuditLogs | Rule | Detects changes to Single Sign On (SSO) restrictions |
| Slack User Privilege Escalation | Slack.AuditLogs | Rule | Detects when a Slack user gains escalated privileges |
| Slack User Privileges Changed to User | Slack.AuditLogs | Rule | Detects when a Slack account is to User from an elevated role. |
| Snowflake Account Admin Granted | Snowflake.AccountUsage | Scheduled Rule | Detect when account admin is granted. |
| Snowflake Brute Force Attacks by IP | Snowflake.AccountUsage | Scheduled Rule | Detect brute force attacks by monitoring for failed logins from the same IP address |
| Snowflake Brute Force Attacks by Username | Snowflake.AccountUsage | Scheduled Rule | Detect brute force attacks by monitoring for failed logins by the same username |
| Snowflake External Share | Snowflake.AccountUsage | Scheduled Rule | Detect when an external share has been initiated from one source cloud to another target cloud. |
| Snowflake Grant to Public Role | Snowflake.AccountUsage | Scheduled Rule | Detect additional grants to the public role |
| Snowflake Login Without MFA | Snowflake.AccountUsage | Scheduled Rule | Detect snowflake logins without multifactor authentication |
| Snowflake Multiple Failed Logins Followed By Success | Snowflake.AccountUsage | Scheduled Rule | Detecting brute force activity and reporting when a user has incorrectly logged in multiple times and then had a successful login. |
| Snowflake User Created | Snowflake.AccountUsage | Scheduled Rule | Detect new users created in snowflake |
| Snowflake User Enabled | Snowflake.AccountUsage | Scheduled Rule | Detect users being re-enabled in your environment |
| Snowflake user with key-based auth logged in with password auth | Snowflake.AccountUsage | Scheduled Rule | Detect when a user that has key-based authentication configured logs in with a password |
| Snyk Miscellaneous Settings | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk settings that lack a clear security impact are changed |
| Snyk Org or Group Settings Change | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Group or Organization Settings are changed. |
| Snyk Org Settings | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Organization settings, like Integrations and Webhooks, are changed |
| Snyk Project Settings | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Project settings are changed |
| Snyk Role Change | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Roles are changed |
| Snyk Service Account Change | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Service Accounts are changed |
| Snyk System External Access Settings Changed | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Settings that control access for external parties have been changed. |
| Snyk System Policy Settings Changed | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects Snyk Policy Settings have been changed. Policies define Snyk's behavior when encountering security and licensing issues. |
| Snyk System SSO Settings Changed | Snyk.GroupAudit | Rule | Detects Snyk SSO Settings have been changed. The reference URL from Snyk indicates that these events are likely to originate exclusively from Snyk Support. |
| Snyk User Management | Snyk.GroupAudit Snyk.OrgAudit | Rule | Detects when Snyk Users are changed |
| Sunburst Indicators of Compromise (FQDN) | AWS.ALB AWS.CloudTrail AWS.GuardDuty AWS.S3ServerAccess AWS.VPCFlow Box.Event CiscoUmbrella.DNS GCP.AuditLog GSuite.Reports Gravitational.TeleportAudit Okta.SystemLog OneLogin.Events Osquery.Differential | Rule | Monitors for communication to known Sunburst Backdoor FQDNs. These IOCs indicate a potential breach and have been associated with a sophisticated nation-state actor. |
| Sunburst Indicators of Compromise (SHA-256) | AWS.ALB AWS.CloudTrail AWS.GuardDuty AWS.S3ServerAccess Box.Event GCP.AuditLog GSuite.Reports Gravitational.TeleportAudit Okta.SystemLog OneLogin.Events Osquery.Differential | Rule | Monitors for hashes to known Sunburst Backdoor SHA256. These IOCs indicate a potential breach and have been associated with a sophisticated nation-state actor. |
| Suspicious cron detected | Osquery.Differential | Rule | A suspicious cron has been added |
| Suspicious GSuite Login | GSuite.ActivityEvent | Rule | GSuite reported a suspicious login for this user. |
| Tailscale HTTPS Disabled | Tailscale.Audit | Rule | A Tailscale User disabled HTTPS settings in your organization's tenant. |
| Tailscale Machine Approval Requirements Disabled | Tailscale.Audit | Rule | A Tailscale User disabled machine approval requirement settings in your organization's tenant. This means devices can access your network without requiring approval. |
| Tailscale Magic DNS Disabled | Tailscale.Audit | Rule | A Tailscale User disabled magic dns settings in your organization's tenant. |
| Teleport Create User Accounts | Gravitational.TeleportAudit | Rule | A user has been manually created, modified, or deleted |
| Teleport Network Scan Initiated | Gravitational.TeleportAudit | Rule | A user has invoked a network scan that could potentially indicate enumeration of the network. |
| Teleport Scheduled Jobs | Gravitational.TeleportAudit | Rule | A user has manually edited the Linux crontab |
| Teleport SSH Auth Errors | Gravitational.TeleportAudit | Rule | A high volume of SSH errors could indicate a brute-force attack |
| Teleport Suspicious Commands Executed | Gravitational.TeleportAudit | Rule | A user has invoked a suspicious command that could lead to a host compromise |
| Tines Actions Disabled Change | Tines.Audit | Rule | Detections when Tines Actions are set to Disabled Change |
| Tines Custom CertificateAuthority setting changed | Tines.Audit | Rule | Detects when Tines Custom CertificateAuthority settings are changed |
| Tines Enqueued/Retrying Job Deletion | Tines.Audit | Rule | Currently enqueued or retrying jobs were cleared |
| Tines Global Resource Destruction | Tines.Audit | Rule | A Tines user has destroyed a global resource. |
| Tines SSO Settings | Tines.Audit | Rule | Detects when Tines SSO settings are changed |
| Tines Story Items Destruction | Tines.Audit | Rule | A user has destroyed a story item |
| Tines Team Destruction | Tines.Audit | Rule | A user has destroyed a team |
| Tines Tenant API Keys Added | Tines.Audit | Rule | Detects when Tines Tenant API Keys are added |
| Unsupported macOS version | Osquery.Differential | Rule | Check that all laptops on the corporate environment are on a version of MacOS supported by IT. |
| Unused AWS Region | AWS.CloudTrail | Rule | CloudTrail logged non-read activity from a verboten AWS region. |
| Unusual 1Password Client Detected | OnePassword.SignInAttempt | Rule | Detects when unusual or undesirable 1Password clients access your 1Password account |
| VPC DNS Tunneling | AWS.VPCDns | Scheduled Rule | Detect dns tunneling traffic using a scheduled query |
| VPC Flow Logs Inbound Port Allowlist | AWS.VPCFlow | Rule | VPC Flow Logs observed inbound traffic violating the port allowlist. |
| VPC Flow Logs Inbound Port Blocklist | AWS.VPCFlow | Rule | VPC Flow Logs observed inbound traffic violating the port blocklist. |
| VPC Flow Logs Unapproved Outbound DNS Traffic | AWS.VPCFlow | Rule | Alerts if outbound DNS traffic is detected to a non-approved DNS server. DNS is often used as a means to exfiltrate data or perform command and control for compromised hosts. All DNS traffic should be routed through internal DNS servers or trusted 3rd parties. |
| VPC Flow Port Scanning | AWS.VPCFlow | Scheduled Query | Instances of a srcAddr communicating with multiple ports on a dstAddr could indicate port scanning activity. |
| VPC Flow Port Scanning | AWS.VPCFlow | Scheduled Rule | Searches for potential port scanning activity in VPC Flow logs |
| Zendesk Account Owner Changed | Zendesk.Audit | Rule | Only one admin user can be the account owner. Ensure the change in ownership is expected. |
| Zendesk API Token Created | Zendesk.Audit | Rule | A user created a new API token to be used with Zendesk. |
| Zendesk Credit Card Redaction Off | Zendesk.Audit | Rule | A user updated account setting that disabled credit card redaction. |
| Zendesk Mobile App Access Modified | Zendesk.Audit | Rule | A user updated account setting that enabled or disabled mobile app access. |
| Zendesk User Role Changed | Zendesk.Audit | Rule | A user's Zendesk role was changed |
| Zendesk User Suspension Status Changed | Zendesk.Audit | Rule | A user's Zendesk suspension status was changed. |
| Zoom All Meetings Secured With One Option Disabled | Zoom.Operation | Rule | A Zoom User turned off your organization's requirement that all meetings are secured with one security option. |
| Zoom Automatic Sign Out Disabled | Zoom.Operation | Rule | A Zoom User turned off your organization's setting to automatically sign users out after a specified period of time. |
| Zoom Meeting Passcode Disabled | Zoom.Operation | Rule | Meeting passcode requirement has been disabled from usergroup |
| Zoom New Meeting Passcode Required Disabled | Zoom.Operation | Rule | A Zoom User turned off your organization's setting to require passcodes for new meetings. |
| Zoom Sign In Method Modified | Zoom.Operation | Rule | A Zoom User modified your organizations sign in method. |
| Zoom Sign In Requirements Changed | Zoom.Operation | Rule | A Zoom User changed your organization's sign in requirements. |
| Zoom Two Factor Authentication Disabled | Zoom.Operation | Rule | A Zoom User disabled your organization's setting to sign in with Two-Factor Authentication. |
| Zoom User Promoted to Privileged Role | Zoom.Operation | Rule | A Zoom user was promoted to a privileged role. |