other:unmapped
Sources the pipeline could not classify
- Host type
- Other / unclassified
- Techniques
- 0
- Rules listed
- 600 of 1,317
- Events
- 0
Techniques
No ATT&CK analytic names this source.
Rules
600 of 1,317 rules are listed here: the dataset names at most this many per entry. The counts by vendor are complete.
Microsoft Sentinel 600
- AIShield - Image Segmentation AI Model extraction high suspicious vulnerability detection
- AIShield - Image classification AI Model Evasion high suspicious vulnerability detection
- AIShield - Image classification AI Model Evasion low suspicious vulnerability detection
- AIShield - Image classification AI Model extraction high suspicious vulnerability detection
- AIShield - Natural language processing AI model extraction high suspicious vulnerability detection
- AIShield - Tabular classification AI Model Evasion high suspicious vulnerability detection
- AIShield - Tabular classification AI Model Evasion low suspicious vulnerability detection
- AIShield - Tabular classification AI Model extraction high suspicious vulnerability detection
- AIShield - Timeseries Forecasting AI Model extraction high suspicious vulnerability detection
- API - API Scraping
- API - Account Takeover
- API - Anomaly Detection
- API - BOLA
- API - Invalid host access
- API - JWT validation
- API - Kiterunner detection
- API - Password Cracking
- API - Rate limiting
- API - Rate limiting
- API - Suspicious Login
- ARGOS Cloud Security - Exploitable Cloud Resources
- AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
- AWS Security Hub - Detect EC2 Security groups allowing unrestricted high-risk ports
- AWS Security Hub - Detect IAM Policies allowing full administrative privileges
- AWS Security Hub - Detect IAM root user Access Key existence
- AWS Security Hub - Detect SQS Queue lacking encryption at rest
- AWS Security Hub - Detect SQS Queue policy allowing public access
- AWS Security Hub - Detect SSM documents public sharing enabled
- AWS Security Hub - Detect root user lacking MFA
- AWS role with admin privileges
- AWS role with shadow admin privileges
- Abnormal Security - Account Takeover case opened
- Abnormal Security - High-risk email attack detected
- Abnormal Security - User-reported email judged malicious
- Abnormal Security - Vendor compromise case detected
- Access to AWS without MFA
- Admin SaaS account detected
- Admin password not updated in 30 days
- Alarming number of anomalies generated in NetBackup
- Alsid Active Directory attacks pathways
- Alsid DCShadow
- Alsid DCSync
- Alsid Golden Ticket
- Alsid Indicators of Attack
- Alsid Indicators of Exposures
- Alsid LSASS Memory
- Alsid Password Guessing
- Alsid Password Spraying
- Alsid Password issues
- Alsid privileged accounts issues
- Alsid user accounts issues
- Anomaly found in Network Session Traffic (ASIM Network Session schema)
- Anvilogic Alert
- Apache - Apache 2.4.49 flaw CVE-2021-41773
- Apache - Command in URI
- Apache - Known malicious user agent
- Apache - Multiple client errors from single IP
- Apache - Multiple server errors from single IP
- Apache - Private IP in URL
- Apache - Put suspicious file
- Apache - Request from private IP
- Apache - Request to sensitive files
- Apache - Requests to rare files
- App Service using TLS < 1.3
- AppServices AV Scan Failure
- AppServices AV Scan with Infected Files
- Armorblox Needs Review Alert
- Atlassian Beacon Alert
- Azure DevOps Administrator Group Monitoring
- Azure DevOps Agent Pool Created Then Deleted
- Azure DevOps Audit Detection for known malicious tooling
- Azure DevOps Audit Stream Disabled
- Azure DevOps Build Variable Modified by New User
- Azure DevOps New Extension Added
- Azure DevOps PAT used with Browser
- Azure DevOps Personal Access Token (PAT) misuse
- Azure DevOps Pipeline Created and Deleted on the Same Day
- Azure DevOps Pull Request Policy Bypassing - Historic allow list
- Azure DevOps Retention Reduced
- Azure DevOps Service Connection Abuse
- Azure DevOps Service Connection Addition/Abuse - Historic allow list
- Azure DevOps Variable Secret Not Secured
- Azure Secure Score Self Service Password Reset
- Azure Security Benchmark Posture Changed
- Azure secure score MFA registration V2
- Azure secure score PW age policy new
- Azure secure score admin MFA
- Azure secure score block legacy authentication
- Azure secure score one admin
- Azure secure score role overlap
- Azure secure score sign in risk policy
- Azure secure score user risk policy
- BOLA Finding with API Traffic Anomaly
- Best Practice Compliance Check Not Passed
- BitSight - compromised systems detected
- BitSight - diligence risk category detected
- BitSight - drop in company ratings
- BitSight - drop in the headline rating
- BitSight - new alert found
- BitSight - new breach found
- Bitglass - Impossible travel distance
- Bitglass - Login from new device
- Bitglass - Multiple failed logins
- Bitglass - Multiple files shared with external entity
- Bitglass - New admin user
- Bitglass - New risky user
- Bitglass - Suspicious file uploads
- Bitglass - The SmartEdge endpoint agent was uninstalled
- Bitglass - User Agent string has changed for user
- Bitglass - User login from new geo location
- BloodHound Attack Path Finding - AKS Contributor Role on Tier Zero Managed Cluster
- BloodHound Attack Path Finding - AS-REP Roastable User Accounts
- BloodHound Attack Path Finding - Add Key Credential Link Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Add Member Privileges on Tier Zero Security Groups
- BloodHound Attack Path Finding - Add Members to Tier Zero Group
- BloodHound Attack Path Finding - Add Owner to Tier Zero Object via MS Graph App Role
- BloodHound Attack Path Finding - Add Resource-Based Constrained Delegation Privileges on Tier Zero Computers
- BloodHound Attack Path Finding - Add Secret to Tier Zero Principal
- BloodHound Attack Path Finding - AddOwner Role on Tier Zero Resource
- BloodHound Attack Path Finding - AddSelf Privilege on Tier Zero Security Groups
- BloodHound Attack Path Finding - Admins on Tier Zero Computers
- BloodHound Attack Path Finding - AllExtended Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - App Admin Control of Tier Zero Principal
- BloodHound Attack Path Finding - Avere Contributor Role on Tier Zero Virtual Machine
- BloodHound Attack Path Finding - Cloud App Admin Over Tier Zero Principal
- BloodHound Attack Path Finding - Command Execution on Tier Zero Virtual Machine
- BloodHound Attack Path Finding - Computers Vulnerable to Coercion-Based NTLM Relay to SMB Attack
- BloodHound Attack Path Finding - Constrained Delegation on Tier Zero Computers
- BloodHound Attack Path Finding - Contributor Role on Tier Zero Automation Account
- BloodHound Attack Path Finding - Contributor Role on Tier Zero Resource
- BloodHound Attack Path Finding - DCOM Users on Tier Zero Computers
- BloodHound Attack Path Finding - ForceChangePassword Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - GenericAll Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - GenericWrite Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Get Certifcates on Tier Zero Key Vault
- BloodHound Attack Path Finding - Get Keys on Tier Zero Key Vault
- BloodHound Attack Path Finding - Get Secrets on Tier Zero Key Vault
- BloodHound Attack Path Finding - Kerberoastable User Accounts
- BloodHound Attack Path Finding - Kerberos Delegation on Tier Zero Objects
- BloodHound Attack Path Finding - Key Vault Contributor Role on Tier Zero Resource
- BloodHound Attack Path Finding - Large Default Group With SyncLapsPassword Privileges
- BloodHound Attack Path Finding - Large Default Groups With Add Key Credential Link Privileges
- BloodHound Attack Path Finding - Large Default Groups With Add Member Privileges
- BloodHound Attack Path Finding - Large Default Groups With Add Self Privileges
- BloodHound Attack Path Finding - Large Default Groups With All Extended Privileges
- BloodHound Attack Path Finding - Large Default Groups With ForceChangePassword Privileges
- BloodHound Attack Path Finding - Large Default Groups With GenericAll Privileges
- BloodHound Attack Path Finding - Large Default Groups With GenericWrite Privileges
- BloodHound Attack Path Finding - Large Default Groups With Limited Ownership Privileges
- BloodHound Attack Path Finding - Large Default Groups With Ownership Privileges
- BloodHound Attack Path Finding - Large Default Groups With RDP Access
- BloodHound Attack Path Finding - Large Default Groups With Read GMSA Password Privileges
- BloodHound Attack Path Finding - Large Default Groups With Read LAPS Password Privileges
- BloodHound Attack Path Finding - Large Default Groups With Resource-Based Constrained Delegation Privileges
- BloodHound Attack Path Finding - Large Default Groups With WriteAccountRestrictions Privileges
- BloodHound Attack Path Finding - Large Default Groups With WriteDacl Privilege
- BloodHound Attack Path Finding - Large Default Groups With WriteGpLink Privilege
- BloodHound Attack Path Finding - Large Default Groups With WriteOwner Privileges
- BloodHound Attack Path Finding - Large Default Groups With WriteOwnerLimitedRights Privileges
- BloodHound Attack Path Finding - Large Default Groups With WriteServicePrincipalName Privileges
- BloodHound Attack Path Finding - Large Default Groups in DCOM Users Groups
- BloodHound Attack Path Finding - Large Default Groups in Local Administrator Groups
- BloodHound Attack Path Finding - Large Default Groups in PS Remote Users Groups
- BloodHound Attack Path Finding - Large Default Groups in SQL Admins Groups
- BloodHound Attack Path Finding - Legacy SID History on Tier Zero Objects
- BloodHound Attack Path Finding - Limited Ownership Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Logic App Contributor Role on Tier Zero Logic App
- BloodHound Attack Path Finding - Logons From Tier Zero Users
- BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC1 Privileges
- BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC10 Scenario A Privileges
- BloodHound Attack Path Finding - Non Tier Zero Principals With ADCS ESC13 Privileges Against Tier Zero Group
- BloodHound Attack Path Finding - Non Tier Zero Resource Assigned to Tier Zero Service Principal
- BloodHound Attack Path Finding - Non-Tier Zero AD User Synced to Tier Zero Entra User
- BloodHound Attack Path Finding - Non-Tier Zero Computer Hosting EnterpriseCA Trusted for NT Authentication
- BloodHound Attack Path Finding - Non-Tier Zero Entra User Synced to Tier Zero AD User
- BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero App Roles
- BloodHound Attack Path Finding - Non-Tier Zero Principal Can Grant Tier Zero Entra ID Role
- BloodHound Attack Path Finding - Non-Tier Zero Principal Trusted for Unconstrained Delegation
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC10 Scenario B Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC3 Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC4 Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario A Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC6 Scenario B Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario A Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With ADCS ESC9 Scenario B Privileges
- BloodHound Attack Path Finding - Non-Tier Zero Principals With DCSync Privileges
- BloodHound Attack Path Finding - Owner Role on Tier Zero Resource
- BloodHound Attack Path Finding - Ownership Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Ownership of Tier Zero Principal
- BloodHound Attack Path Finding - PS Remote Users on Tier Zero Computers
- BloodHound Attack Path Finding - RDP Users on Tier Zero Computers
- BloodHound Attack Path Finding - Read GMSA Password Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - ReadLapsPassword Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Reset a Tier Zero User's Password
- BloodHound Attack Path Finding - SQL Admin Users on Tier Zero Computers
- BloodHound Attack Path Finding - SyncLapsPassword Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to ADCS (ESC8) Attack
- BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAP Attack
- BloodHound Attack Path Finding - Tier Zero Computer Vulnerable to Coercion-Based NTLM Relay to LDAPS Attack
- BloodHound Attack Path Finding - Tier Zero Group Control via MS Graph App Role
- BloodHound Attack Path Finding - Tier Zero SMSA Installed on Non-Tier Zero Computer
- BloodHound Attack Path Finding - Tier Zero Service Principal Control via MS Graph App Role
- BloodHound Attack Path Finding - User Access Admin Role on Tier Zero Resource
- BloodHound Attack Path Finding - VM Admin Login Role on Tier Zero System
- BloodHound Attack Path Finding - VM Contributor Role on Tier Zero System
- BloodHound Attack Path Finding - Website Contributor Role on Tier Zero Resource
- BloodHound Attack Path Finding - Write Account Restrictions Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - WriteDacl Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - WriteGpLink Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - WriteOwner Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - WriteOwnerLimitedRights Privileges on Tier Zero Objects
- BloodHound Attack Path Finding - WriteServicePrincipalName Privileges on Tier Zero Objects
- Brute force attack against user credentials
- CDM_ContinuousDiagnostics&Mitigation_PostureChanged
- CMMC 2.0 Level 1 (Foundational) Readiness Posture
- CMMC 2.0 Level 2 (Advanced) Readiness Posture
- CTE - Admin Login Detected
- CTE - Blocked URL Attempted
- CTE - CTI Blocked URL Attempted
- CTE - Compromised Device Suspected (High-Volume IOC Blocks)
- CTE - Device Enrolled but On Hold
- CTE - Device License Capacity Critical (99%)
- CTE - Device License Capacity High (95%)
- CTE - Device Repeatedly Blocked Across Multiple Days
- CTE - Enrollment Token Generated
- CTE - License Expiring Critically (7 Days)
- CTE - License Expiring Soon (30 Days)
- CTE - Possible Company-Wide C2 Campaign (Multiple Devices, Same Destination)
- CTE - Risky Device (Multiple IOC URL Hits)
- CTE - Rule Capacity Critical (95%)
- CTE - Rule Capacity High (90%)
- CTE - Security Rule Changed (Created/Updated/Deleted)
- CTE - Stale Device (No Heartbeat in 30 Days)
- CTE - Sudden Block Spike Detected
- CYFIRMA - Attack Surface - Cloud Weakness High Rule
- CYFIRMA - Attack Surface - Cloud Weakness Medium Rule
- CYFIRMA - Attack Surface - Configuration High Rule
- CYFIRMA - Attack Surface - Configuration Medium Rule
- CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure High Rule
- CYFIRMA - Attack Surface - Domain/IP Vulnerability Exposure Medium Rule
- CYFIRMA - Attack Surface - Malicious Domain/IP Reputation High Rule
- CYFIRMA - Attack Surface - Malicious Domain/IP Reputation Medium Rule
- CYFIRMA - Attack Surface - Open Ports High Rule
- CYFIRMA - Attack Surface - Open Ports Medium Rule
- CYFIRMA - Attack Surface - Weak Certificate Exposure - High Rule
- CYFIRMA - Attack Surface - Weak Certificate Exposure - Medium Rule
- CYFIRMA - Brand Intelligence - Domain Impersonation High Rule
- CYFIRMA - Brand Intelligence - Domain Impersonation Medium Rule
- CYFIRMA - Brand Intelligence - Executive/People Impersonation High Rule
- CYFIRMA - Brand Intelligence - Executive/People Impersonation Medium Rule
- CYFIRMA - Brand Intelligence - Malicious Mobile App High Rule
- CYFIRMA - Brand Intelligence - Malicious Mobile App Medium Rule
- CYFIRMA - Brand Intelligence - Product/Solution High Rule
- CYFIRMA - Brand Intelligence - Product/Solution Medium Rule
- CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected High Rule
- CYFIRMA - Brand Intelligence - Social Media Handle Impersonation Detected Medium Rule
- CYFIRMA - Compromised Employees Detection Rule
- CYFIRMA - Customer Accounts Leaks Detection Rule
- CYFIRMA - Data Breach and Web Monitoring - Dark Web High Rule
- CYFIRMA - Data Breach and Web Monitoring - Dark Web Medium Rule
- CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule
- CYFIRMA - Data Breach and Web Monitoring - Phishing Campaign Detection Rule
- CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule
- CYFIRMA - Data Breach and Web Monitoring - Ransomware Exposure Detected Rule
- CYFIRMA - High Severity Asset based Vulnerabilities Rule Alert
- CYFIRMA - High Severity Attack Surface based Vulnerabilities Rule Alert
- CYFIRMA - High severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - High severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - High severity File Hash Indicators with Block Action Rule
- CYFIRMA - High severity File Hash Indicators with Block Action and Malware
- CYFIRMA - High severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - High severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - High severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
- CYFIRMA - High severity Malicious Network Indicators with Block Action Rule
- CYFIRMA - High severity Malicious Network Indicators with Monitor Action Rule
- CYFIRMA - High severity Malicious Phishing Network Indicators - Block Recommended Rule
- CYFIRMA - High severity Malicious Phishing Network Indicators - Monitor Recommended Rule
- CYFIRMA - High severity TOR Node Network Indicators - Block Recommended Rule
- CYFIRMA - High severity TOR Node Network Indicators - Monitor Recommended Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Block Action Rule
- CYFIRMA - High severity Trojan File Hash Indicators with Monitor Action Rule
- CYFIRMA - High severity Trojan Network Indicators - Block Recommended Rule
- CYFIRMA - High severity Trojan Network Indicators - Monitor Recommended Rule
- CYFIRMA - Medium Severity Asset based Vulnerabilities Rule Alert
- CYFIRMA - Medium Severity Attack Surface based Vulnerabilities Rule
- CYFIRMA - Medium severity Command & Control Network Indicators with Block Recommendation Rule
- CYFIRMA - Medium severity Command & Control Network Indicators with Monitor Recommendation Rule
- CYFIRMA - Medium severity File Hash Indicators with Block Action Rule
- CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action Rule
- CYFIRMA - Medium severity File Hash Indicators with Monitor Action and Malware
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Block Recommended Rule
- CYFIRMA - Medium severity Malicious Network Indicators Associated with Malware - Monitor Recommended Rule
- CYFIRMA - Medium severity Malicious Network Indicators with Block Action Rule
- CYFIRMA - Medium severity Malicious Network Indicators with Monitor Action Rule
- CYFIRMA - Medium severity Malicious Phishing Network Indicators - Block Recommended Rule
- CYFIRMA - Medium severity Malicious Phishing Network Indicators - Monitor Recommended Rule
- CYFIRMA - Medium severity TOR Node Network Indicators - Block Recommended Rule
- CYFIRMA - Medium severity TOR Node Network Indicators - Monitor Recommended Rule
- CYFIRMA - Medium severity Trojan File Hash Indicators with Block Action Rule
- CYFIRMA - Medium severity Trojan File Hash Indicators with Monitor Action Rule
- CYFIRMA - Medium severity Trojan Network Indicators - Block Recommended Rule
- CYFIRMA - Medium severity Trojan Network Indicators - Monitor Recommended Rule
- CYFIRMA - Public Accounts Leaks Detection Rule
- CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule
- CYFIRMA - Social and Public Exposure - Social Media Threats Activity Detected Rule
- CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule
- CYFIRMA - Social and Public Exposure - Confidential Files Information Exposure Rule
- CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
- CYFIRMA - Social and Public Exposure - Exposure of PII/CII in Public Domain Rule
- CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule
- CYFIRMA - Social and Public Exposure - Source Code Exposure on Public Repositories Rule
- Canary alerts to incidents
- Cayosoft Guardian - Cloud Application Security Threats
- Cayosoft Guardian - Core Identity and Infrastructure Threats
- Certificate expiring after 2030 still uses classical signature
- Check Point Exposure Management - Alert Ingestion Anomaly
- Check Point Exposure Management - Argos alerts to incidents
- Checkpoint - Pending Phishing emails
- Cisco Cloud Security - Connection to Unpopular Website Detected
- Cisco Cloud Security - Connection to non-corporate private network
- Cisco Cloud Security - Crypto Miner User-Agent Detected
- Cisco Cloud Security - Empty User Agent Detected
- Cisco Cloud Security - Hack Tool User-Agent Detected
- Cisco Cloud Security - Rare User Agent Detected
- Cisco Cloud Security - Request Allowed to harmful/malicious URI category
- Cisco Cloud Security - Request to blocklisted file type
- Cisco Cloud Security - URI contains IP address
- Cisco Cloud Security - Windows PowerShell User-Agent Detected
- Cisco Duo - AD sync failed
- Cisco Duo - Admin password reset
- Cisco Duo - Admin user created
- Cisco Duo - Admin user deleted
- Cisco Duo - Authentication device new location
- Cisco Duo - Multiple admin 2FA failures
- Cisco Duo - Multiple user login failures
- Cisco Duo - Multiple users deleted
- Cisco Duo - New access device
- Cisco Duo - Unexpected authentication factor
- Cisco SDWAN - IPS Event Threshold
- Cisco SDWAN - Intrusion Events
- Cisco SDWAN - Maleware Events
- Cisco SDWAN - Monitor Critical IPs
- Cisco SE - Connection to known C2 server
- Cisco SE - Dropper activity on host
- Cisco SE - Generic IOC
- Cisco SE - Malware execusion on host
- Cisco SE - Malware outbreak
- Cisco SE - Multiple malware on host
- Cisco SE - Policy update failure
- Cisco SE - Possible webshell
- Cisco SE - Ransomware Activity
- Cisco SE - Unexpected binary file
- Cisco SE High Events Last Hour
- Cisco WSA - Access to unwanted site
- Cisco WSA - Internet access from public IP
- Cisco WSA - Multiple attempts to download unwanted file
- Cisco WSA - Multiple errors to URL
- Cisco WSA - Multiple errors to resource from risky category
- Cisco WSA - Multiple infected files
- Cisco WSA - Suspected protocol abuse
- Cisco WSA - Unexpected URL
- Cisco WSA - Unexpected file type
- Cisco WSA - Unexpected uploads
- Cisco WSA - Unscannable file or scan error
- CiscoISE - Command executed with the highest privileges from new IP
- CiscoISE - Attempt to delete local store logs
- CiscoISE - Backup failed
- CiscoISE - Certificate has expired
- CiscoISE - Command executed with the highest privileges by new user
- CiscoISE - Device PostureStatus changed to non-compliant
- CiscoISE - Device changed IP in last 24 hours
- CiscoISE - ISE administrator password has been reset
- CiscoISE - Log collector was suspended
- CiscoISE - Log files deleted
- ClientDeniedAccess
- CloudNGFW By Palo Alto Networks - Threat signatures from Unusual IP addresses
- CloudNGFW By Palo Alto Networks - possible internal to external port scanning
- Cloudflare - Bad client IP
- Cloudflare - Bad client IP
- Cloudflare - Client request from country in blocklist
- Cloudflare - Client request from country in blocklist
- Cloudflare - Empty user agent
- Cloudflare - Empty user agent
- Cloudflare - Multiple error requests from single source
- Cloudflare - Multiple error requests from single source
- Cloudflare - Multiple user agents for single source
- Cloudflare - Multiple user agents for single source
- Cloudflare - Unexpected POST requests
- Cloudflare - Unexpected POST requests
- Cloudflare - Unexpected URI
- Cloudflare - Unexpected URI
- Cloudflare - Unexpected client request
- Cloudflare - Unexpected client request
- Cloudflare - WAF Allowed threat
- Cloudflare - WAF Allowed threat
- Cloudflare - XSS probing pattern in request
- Cloudflare - XSS probing pattern in request
- Cognni Incidents for Highly Sensitive Business Information
- Cognni Incidents for Highly Sensitive Financial Information
- Cognni Incidents for Highly Sensitive Governance Information
- Cognni Incidents for Highly Sensitive HR Information
- Cognni Incidents for Highly Sensitive Legal Information
- Cognni Incidents for Low Sensitivity Business Information
- Cognni Incidents for Low Sensitivity Financial Information
- Cognni Incidents for Low Sensitivity Governance Information
- Cognni Incidents for Low Sensitivity HR Information
- Cognni Incidents for Low Sensitivity Legal Information
- Cognni Incidents for Medium Sensitivity Business Information
- Cognni Incidents for Medium Sensitivity Financial Information
- Cognni Incidents for Medium Sensitivity Governance Information
- Cognni Incidents for Medium Sensitivity HR Information
- Cognni Incidents for Medium Sensitivity Legal Information
- Commvault Cloud Alert
- Configuration Backup Failed
- ContraForce - Destructive workspace action
- ContraForce - Machine credential activity
- ContraForce - Privileged access change
- Contrast ADR - DLP SQL Injection Correlation
- Contrast ADR - EDR Alert Correlation
- Contrast ADR - Exploited Attack Event
- Contrast ADR - Exploited Attack in Production
- Contrast ADR - Security Incident Alert
- Contrast ADR - WAF Alert Correlation
- Copilot - File Uploads Disabled
- Copilot - Jailbreak Attempt Detected
- Copilot - Plugin Created by Non-Admin User
- Copilot - Plugin Tampering (Enable and Disable Within 5 Minutes)
- Corelight - C2 DGA Detected Via Repetitive Failures
- Corelight - External Proxy Detected
- Corelight - Forced External Outbound SMB
- Corelight - Multiple Compressed Files Transferred over HTTP
- Corelight - Multiple files sent over HTTP with abnormal requests
- Corelight - Network Service Scanning Multiple IP Addresses
- Corelight - Possible Typo Squatting or Punycode Phishing HTTP Request
- Corelight - Possible Webshell
- Corelight - Possible Webshell (Rare PUT or POST)
- Corelight - SMTP Email containing NON Ascii Characters within the Subject
- Cortex XDR Incident - High
- Cortex XDR Incident - High
- Cortex XDR Incident - Low
- Cortex XDR Incident - Low
- Cortex XDR Incident - Medium
- Cortex XDR Incident - Medium
- Create Incident for XDR Alerts
- Critical Finding Overdue on Internet-Facing App
- Critical Severity Incident
- Critical Threat Detected
- CyberBlindSpot - Any Issue Detected
- Cyble Advisory Alerts Advisory
- Cyble Vision Alerts Assets
- Cyble Vision Alerts Bitbucket
- Cyble Vision Alerts Cloud Storage
- Cyble Vision Alerts Compromised Endpoint Cookies
- Cyble Vision Alerts Compromised Files
- Cyble Vision Alerts Cyble Web Applications
- Cyble Vision Alerts Darkweb Data Breaches
- Cyble Vision Alerts Darkweb Ransomware Leak
- Cyble Vision Alerts Discord Keyword
- Cyble Vision Alerts Discovered Subdomain
- Cyble Vision Alerts Docker
- Cyble Vision Alerts Domain Expiry Alert
- Cyble Vision Alerts Domain Watchlist
- Cyble Vision Alerts Flash Report
- Cyble Vision Alerts Github
- Cyble Vision Alerts Hacktivism
- Cyble Vision Alerts I2P Monitoring
- Cyble Vision Alerts IOC'S
- Cyble Vision Alerts IP Risk Score
- Cyble Vision Alerts Leaked Credentials
- Cyble Vision Alerts Malicious Ads Detected
- Cyble Vision Alerts New Vulnerability Detected
- Cyble Vision Alerts News Feed Alert
- Cyble Vision Alerts OSINT Mention Detected
- Cyble Vision Alerts OT/ICS Threat Activity Detected
- Cyble Vision Alerts Pastebin
- Cyble Vision Alerts Phishing Domain Detected
- Cyble Vision Alerts Physical Threat Alert
- Cyble Vision Alerts Postman API Exposure Detection
- Cyble Vision Alerts Product Vulnerability Detected
- Cyble Vision Alerts SSL Certificate Expiry
- Cyble Vision Alerts Social Media Monitoring
- Cyble Vision Alerts Suspicious Domain
- Cyble Vision Alerts TOR Links
- Cyble Vision Alerts Vulnerability
- Cyble Vision Alerts Website Defacement Content
- Cyble Vision Alerts Website Defacement Keyword
- Cyble Vision Alerts Website Defacement URL
- CybleVision Alerts Cyber Crime Forum Alerts
- CybleVision Alerts Darkweb Marketplace Alerts
- CybleVision Alerts Mobile Apps
- CybleVision Alerts Stealer Logs
- CybleVision Alerts Telegram Mentions
- Cynerio - Exploitation Attempt of IoT device
- Cynerio - IoT - Default password
- Cynerio - IoT - Weak password
- Cynerio - Medical device scanning
- Cynerio - Suspicious Connection to External Address
- Cyren Feed Outage Detection
- Cyren High-Risk IP Indicators
- Cyren High-Risk URL Indicators
- D3 Smart SOAR - High or critical severity incident detected
- DDoS attack detected
- Darktrace AI Analyst (Legacy)
- Darktrace Incident Event
- Darktrace Model Alert
- Darktrace Model Breach (Legacy)
- Darktrace System Status (Legacy)
- Dataminr - urgent alerts detected
- Datawiza - massive errors detected
- Deleted a Custom Field Mapping profile
- Deleted a Tenant
- Delinea - Bulk secret export / access
- Delinea - Failed authentication spike (single account)
- Delinea - Platform configuration change
- Delinea - Privilege escalation detected (role / permission changes)
- Delinea - Privileged account access anomaly (secret-access volume vs baseline)
- Delinea - Sensitive secret accessed by new user (first access in 14 days)
- Detect AWS IAM Users
- Detect port misuse by anomaly based detection (ASIM Network Session schema)
- Detect port misuse by static threshold (ASIM Network Session schema)
- Device Alert Surge
- Digital Guardian - Bulk exfiltration to external domain
- Digital Guardian - Exfiltration to external domain
- Digital Guardian - Exfiltration to online fileshare
- Digital Guardian - Exfiltration to private email
- Digital Guardian - Exfiltration using DNS protocol
- Digital Guardian - Incident with not blocked action
- Digital Guardian - Multiple incidents from user
- Digital Guardian - Possible SMTP protocol abuse
- Digital Guardian - Sensitive data transfer over insecure channel
- Digital Guardian - Unexpected protocol
- Digital Shadows Incident Creation for exclude-app
- Digital Shadows Incident Creation for include-app
- Disks Alerts From Prancer
- DomainTools New Domain Discovery Indicators Ingested
- DomainTools Newly Added Domains Feeds Ingested
- DomainTools Newly Observed Domains Feeds Ingested
- DomainTools Newly Observed Hostnames Feeds Ingested
- Dynatrace - Problem detection
- Dynatrace Application Security - Attack detection
- Dynatrace Application Security - Code-Level runtime vulnerability detection
- Dynatrace Application Security - Non-critical runtime vulnerability detection
- Dynatrace Application Security - Third-Party runtime vulnerability detection
- Egress Defend - Dangerous Attachment Detected
- Egress Defend - Dangerous Link Click
- Elevation of Privilege attempt detected
- Employee account deleted
- Empty group with entitlements
- Europium - Hash and IP IOCs - September 2022
- Excessive Blocked Traffic Events Generated by User
- Excessive Denied Proxy Traffic
- Excessive Failed Authentication from Invalid Inputs
- Excessive NXDOMAIN DNS Queries
- Excessive number of failed connections from a single source (ASIM Network Session schema)
- Exchange Server Suspicious File Downloads.
- External Upstream Source Added to Azure DevOps Feed
- F&O - Bank account change following network alias reassignment
- F&O - Mass update or deletion of user records
- F&O - Non-interactive account mapped to self or sensitive privileged user
- F&O - Reverted bank account number modifications
- Field Effect MDR Alert: ARO Alert
- Filewall - Blocked emails
- Filewall - Blocked files
- Flare chat results
- Flare cloud bucket results
- Flare google dork results
- Flare host results
- Flare infected device results
- Flare leaked credentials results
- Flare lookalike domain results
- Flare marketplace results
- Flare paste results
- Flare source code results
- Flow Logs Alerts for Prancer
- Forescout-DNS_Sniff_Event_Monitor
- FortiNDR Cloud - Security Event Detected
- Fortiweb - WAF Allowed threat
- GCP Security Command Center - Detect DNSSEC disabled for DNS zones
- GCP Security Command Center - Detect Firewall rules allowing unrestricted high-risk ports
- GCP Security Command Center - Detect Open/Unrestricted API Keys
- GCP Security Command Center - Detect Resources with Logging Disabled
- GCP Security Command Center - Detect projects with API Keys present
- GSA - Detect Abnormal Deny Rate for Source to Destination IP
- GSA - Detect Connections Outside Operational Hours
- GSA - Detect Protocol Changes for Destination Ports
- GSA - Detect Source IP Scanning Multiple Open Ports
- GTI - Actively Exploited Vulnerability Detected
- GTI - CISA Known Exploited Vulnerability Detected
- GTI - Critical CVSS Score Vulnerability Detected
- GTI - Data Leak Alert Detected
- GTI - High Relevance Alert Detected
- GTI - High and Critical Priority Alerts
- GTI - Initial Access Broker Alert Detected
- GTI - Insider Threat Alert Detected
- GTI - Zero-Day Vulnerability Detected
- GTI Relevance System Alert - Incident by Alert ID
- Gambit Security - Critical Policy Issue Promotion
- Generate alerts based on ExtraHop detections recommended for triage
Events
No event-level rows: this source is tiered as a whole.