network:ids
IDS/IPS alerts (Suricata, Snort, TLS inspection)
- Host type
- Network devices and network sensors
- Tier, as a whole
- Minimum
- Cost class
- Free tool
- Techniques
- 2
- Rules listed
- 57
- Events
- 0
Why this tier
OMB M-26-14 A6 (Security tooling alerts; our analysis)
Licensing
- License or service
- Suricata (GPLv2; OISF)
- What is free
- All
- What costs
- Nothing
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: IDS and IPS alerts |
Techniques
Rules
Splunk 48
- Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint
- Adobe ColdFusion Access Control Bypass
- Adobe ColdFusion Unauthenticated Arbitrary File Read
- Cisco IOS XE Implant Access
- Citrix ADC Exploitation CVE-2023-3519
- Citrix ADC and Gateway CitrixBleed 2 Memory Disclosure
- Citrix ADC and Gateway Unauthorized Data Disclosure
- Citrix ShareFile Exploitation CVE-2023-24489
- Confluence CVE-2023-22515 Trigger Vulnerability
- Confluence Pre-Auth RCE via OGNL Injection CVE-2023-22527
- Confluence Unauthenticated Remote Code Execution CVE-2022-26134
- ConnectWise ScreenConnect Authentication Bypass
- DNS Kerberos Coercion
- Detect Remote Access Software Usage URL
- Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952
- F5 BIG-IP iControl REST Vulnerability CVE-2022-1388
- F5 TMUI Authentication Bypass
- Fortinet Appliance Auth bypass
- HTTP C2 Framework User Agent
- HTTP Duplicated Header
- HTTP Malware User Agent
- HTTP PUA User Agent
- HTTP Possible Request Smuggling
- HTTP RMM User Agent
- HTTP Request to Reserved Name on IIS Server
- Ivanti Connect Secure Command Injection Attempts
- Ivanti Connect Secure SSRF in SAML Component
- Ivanti Connect Secure System Information Access via Auth Bypass
- Ivanti EPM SQL Injection Remote Code Execution
- Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35078
- Ivanti EPMM Remote Unauthenticated API Access CVE-2023-35082
- JetBrains TeamCity Authentication Bypass CVE-2024-27198
- JetBrains TeamCity Authentication Bypass Suricata CVE-2024-27198
- JetBrains TeamCity Limited Auth Bypass Suricata CVE-2024-27199
- JetBrains TeamCity RCE Attempt
- Juniper Networks Remote Code Execution Exploit Detection
- Large HTTP POST Request Failure or Missing Response - Suricata
- Microsoft SharePoint Server Elevation of Privilege
- PHP Opening Tag in Upload Filename - Suricata
- PaperCut NG Remote Web Access Attempt
- SAP NetWeaver Visual Composer Exploitation Attempt
- Serialized PHP Token in Upload Filename - Suricata
- VMWare Aria Operations Exploit Attempt
- VMware Server Side Template Injection Hunt
- VMware Workspace ONE Freemarker Server-side Template Injection
- WS FTP Remote Code Execution
- Windows SharePoint Spinstall0 GET Request
- Windows SharePoint ToolPane Endpoint Exploitation Attempt
Elastic 9
- Accepted Default Telnet Port Connection
- First Seen External MQTT Broker Connection
- First Time Seen RMM Service Hostname from Network DNS
- Multiple RMM Vendors Queried by a Single DNS Client
- Newly Observed High Severity Suricata Alert
- React2Shell Network Security Alert
- Splunk Enterprise PostgreSQL Backup-to-Restore Potential RCE Sequence
- Splunk Enterprise PostgreSQL Recovery Endpoint Injection Artifacts
- Suricata and Elastic Defend Network Correlation
Events
No event-level rows: this source is tiered as a whole.