diff --git a/plugins/alerts/audits/fixture-coverage.md b/plugins/alerts/audits/fixture-coverage.md new file mode 100644 index 000000000..8389859e0 --- /dev/null +++ b/plugins/alerts/audits/fixture-coverage.md @@ -0,0 +1,76 @@ +# What filter fixtures prove + +The shared runner uses the pinned SDK for configuration/schema decoding, CEL and +Event conversion. The closed filter executor is not invoked. Report each level +of coverage separately; a green module run does not establish end-to-end alerts. + +## Synthetic normalization input (existing default) + +```json +{ + "name": "normalization-only", + "filter": "source/filter.yml", + "input": {"log": {"VendorField": "synthetic"}}, + "expected": {"origin.user": "synthetic"}, + "rules": {} +} +``` + +`input` supplies fields as though extraction already ran. JSON/KV/CSV/XML, +complex grok, dynamic and reformat operations are skipped. This mode establishes +modeled normalization only. `rules: {}` or an absent `rules` member means **no +rule predicate was tested**, which the verbose test output states explicitly. + +## Opt-in raw JSON model + +```json +{ + "name": "raw-json-model", + "filter": "utmstack/utmstack.yml", + "raw": "{\"msg\":\"synthetic\",\"args\":{\"event-id\":17}}", + "dataType": "utmstack", + "dataSource": "synthetic-host", + "expected": {"log.msg": "synthetic", "log.args.eventid": 17}, + "rules": {} +} +``` + +`raw` and `input` are mutually exclusive. Raw mode requires explicit ingress +`dataType` and `dataSource` and selects matching pipeline stages. It decodes JSON +objects into `log`, recursively uses `utils.SanitizeField` on JSON keys, then +models rename/delete/cast/trim, literal `add.function: string` with SDK string +conversion, and whole-field copy captures. Exact `(?s:.*)` captures preserve +multiline text; `{{.greedy}}` and `(.*)` only model single-line input. Other +multiline copies, custom `greedy` patterns and non-literal add functions fail +explicitly. Executed +unsupported operations fail the fixture rather than being silently skipped. +Empty/dotted sanitized keys and sanitization collisions also fail: the closed +executor's behavior for those ambiguous inputs is not established here. + +This is a **bounded parser model**, not proof of the closed runtime's extraction. +A fixture demonstrates that its source keys reach the selected destinations +under that model; real retained raw/output pairs or separately authorized staging +execution are still needed to verify deployed behavior. No existing synthetic +technology fixture becomes a raw-parser test merely by loading this runner. + +## Rule and history assertions + +`rules` maps rule paths to expected `where` booleans; it does not assert generated +alerts. A fixture may additionally enable `checkHistoryPlaceholders: true`. +For each expected-positive, actually-positive rule, the runner checks all +`correlation`/legacy `afterEvents` placeholders, including recursive `or` +branches, against the normalized event. Numeric zero and boolean false resolve; +missing and null values do not. + +This optional check intentionally requires **every branch** to resolve. The SDK +may skip an OR branch when its parent meets the threshold, so enabling the flag +requires a fixture intended to cover the whole graph. The flag performs no +history search, count comparison or alert generation. It cannot replace a +technology test using the real `SearchRequest.Execute` and a controlled history +backend. The SDK's process-wide OpenSearch connection also means independent +mock servers must not be assumed to isolate tests within one process. + +The runner's output distinguishes synthetic input, raw JSON model, no rule +assertions and placeholder-only preflight. Store source document provenance and +real-vs-synthetic status in the source's audit report; do not publish customer +payloads in fixture JSON. diff --git a/plugins/alerts/audits/grouping-inventory-v11.json b/plugins/alerts/audits/grouping-inventory-v11.json new file mode 100644 index 000000000..17288698b --- /dev/null +++ b/plugins/alerts/audits/grouping-inventory-v11.json @@ -0,0 +1,12984 @@ +{ + "revision": "660c796f168670fd6ccb079995c09c46d4f0068d", + "scope": "YAML groupBy and deduplicateBy only; references in descriptions, where and history queries excluded", + "ruleFilesScanned": 635, + "configuredRuleFiles": 622, + "configuredFieldOccurrences": 1177, + "lastEventRuleFiles": 231, + "lastEventFieldOccurrences": 309, + "lastEventDistinctPaths": 126, + "lastEventRuleFilesByKind": { + "groupBy": 227, + "deduplicateBy": 4 + }, + "lastEventRuleFilesByDirectory": { + "antivirus": 50, + "cisco": 4, + "cloud": 91, + "crowdstrike": 13, + "fortinet": 2, + "github": 13, + "ibm": 3, + "json": 1, + "linux": 2, + "macos": 5, + "nids": 14, + "office365": 19, + "paloalto": 3, + "pfsense": 2, + "sophos": 2, + "syslog": 3, + "vmware": 2, + "windows": 2 + }, + "runtimeStatus": "Potential query changes only. Scalar value presence, deployed rules and alert-volume impact are not established by static inventory.", + "fields": [ + { + "file": "rules/antivirus/bitdefender_gz/antivirus_service_stopped.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Antivirus Service Stopped or Tampered", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/antivirus_service_stopped.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Antivirus Service Stopped or Tampered", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZModule", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/apt_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Advanced Persistent Threat (APT) Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/apt_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Advanced Persistent Threat (APT) Detection", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZDetectionName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/av_console_lateral_movement.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Task Burst Across Endpoints", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/av_console_lateral_movement.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Task Burst Across Endpoints", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZTaskName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/av_policy_override.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Protection Module Disabled", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/av_policy_override.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Protection Module Disabled", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZModule", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/bootkit_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Bootkit or UEFI Threat Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/bootkit_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Bootkit or UEFI Threat Detected", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/crypto_mining_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Crypto Mining Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/crypto_mining_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Crypto Mining Detected", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/email_threat_spreading.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Malware Detected on Exchange Server", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/email_threat_spreading.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Malware Detected on Exchange Server", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/fileless_malware_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Fileless Attack Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/fileless_malware_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Fileless Attack Detected", + "kind": "groupBy", + "field": "target.process", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/high_severity_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone High Severity Malware Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/high_severity_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone High Severity Malware Detection", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/malware_outbreak_multiple_hosts.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Malware Outbreak Across Endpoints", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/memory_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Memory Exploit Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/memory_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Memory Exploit Detected", + "kind": "groupBy", + "field": "target.process", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/multiple_malware_from_single_source.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Repeated Malware Detections on One Endpoint", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/network_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Network Attack Blocked", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/network_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Network Attack Blocked", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/phishing_access_blocked.yaml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Phishing Page Loaded Without Blocking", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/phishing_access_blocked.yaml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Phishing Page Loaded Without Blocking", + "kind": "groupBy", + "field": "adversary.url", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/quarantine_failure_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Malware Not Remediated", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/quarantine_failure_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Malware Not Remediated", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/ransomware_behavior_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Ransomware Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/ransomware_behavior_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Ransomware Detected", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZIncidentId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/realtime_protection_disabled.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Real-Time Antimalware Disabled", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/rootkit_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Rootkit Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/rootkit_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Rootkit Detected", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/suspicious_exclusions_added.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Exclusion-Related Task Executed", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/suspicious_exclusions_added.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Exclusion-Related Task Executed", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZTaskName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/usb_malware_propagation.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone USB-Borne Threat Activity", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/usb_malware_propagation.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone USB-Borne Threat Activity", + "kind": "groupBy", + "field": "lastEvent.log.BitdefenderGZDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/bitdefender_gz/zero_day_malware_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Threat Detected Without a Signature", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/bitdefender_gz/zero_day_malware_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-bitdefender-gz" + ], + "name": "Bitdefender GravityZone Threat Detected Without a Signature", + "kind": "groupBy", + "field": "target.malware", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/advanced_threat_tactic_identification.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Advanced Threat Tactic Identification", + "kind": "groupBy", + "field": "lastEvent.log.tacticName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/advanced_threat_tactic_identification.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Advanced Threat Tactic Identification", + "kind": "groupBy", + "field": "lastEvent.log.threatLevel", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/advanced_threat_tactic_identification.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Advanced Threat Tactic Identification", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/criminal_group_signatures.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Criminal Group Signatures", + "kind": "groupBy", + "field": "lastEvent.log.groupName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/criminal_group_signatures.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Criminal Group Signatures", + "kind": "groupBy", + "field": "lastEvent.log.signature", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/criminal_group_signatures.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Criminal Group Signatures", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/data_theft_attempt_indicators.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Data Theft Attempt on Decoy Files", + "kind": "groupBy", + "field": "lastEvent.log.decoy_file", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/data_theft_attempt_indicators.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Data Theft Attempt on Decoy Files", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/data_theft_attempt_indicators.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Data Theft Attempt on Decoy Files", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/deception_api_call_tracking.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Deception API Call Tracking", + "kind": "groupBy", + "field": "lastEvent.log.apiEndpoint", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/deception_api_call_tracking.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Deception API Call Tracking", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/deception_token_access_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Deception Token Access Patterns", + "kind": "groupBy", + "field": "lastEvent.log.tokenId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/deception_token_access_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Deception Token Access Patterns", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/decoy_share_access_monitoring.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Decoy Share Access Monitoring", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/decoy_share_access_monitoring.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Decoy Share Access Monitoring", + "kind": "deduplicateBy", + "field": "lastEvent.log.resourceType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/decoy_system_enumeration.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Decoy System Enumeration", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/decoy_system_enumeration.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Decoy System Enumeration", + "kind": "deduplicateBy", + "field": "lastEvent.log.targetHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/decoy_system_enumeration.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Decoy System Enumeration", + "kind": "deduplicateBy", + "field": "lastEvent.log.decoyName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/fake_user_authentication_attempts.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Fake User Authentication Attempts", + "kind": "groupBy", + "field": "lastEvent.log.username", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/fake_user_authentication_attempts.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Fake User Authentication Attempts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/honey_table_query_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Honey Table Query Detection", + "kind": "groupBy", + "field": "lastEvent.log.tableName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/honey_table_query_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Honey Table Query Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/lateral_movement_trap_triggers.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Lateral Movement Trap Triggered", + "kind": "groupBy", + "field": "lastEvent.log.trap_type", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/lateral_movement_trap_triggers.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Lateral Movement Trap Triggered", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/living_off_the_land_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Living Off The Land Attack Using Deceptive Resources", + "kind": "groupBy", + "field": "lastEvent.log.deceptive_target", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/living_off_the_land_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Living Off The Land Attack Using Deceptive Resources", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/living_off_the_land_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Living Off The Land Attack Using Deceptive Resources", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/nation_state_tactic_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Nation-State Tactic Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/nation_state_tactic_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Nation-State Tactic Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/privilege_escalation_bait_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Privilege Escalation Bait Accessed", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/privilege_escalation_bait_detection.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Privilege Escalation Bait Accessed", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/ransomware_behavior_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Ransomware Behavior Detected in Deception Environment", + "kind": "groupBy", + "field": "lastEvent.log.hostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/ransomware_behavior_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Ransomware Behavior Detected in Deception Environment", + "kind": "groupBy", + "field": "lastEvent.log.process", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/threat_actor_attribution.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Threat Actor Attribution", + "kind": "groupBy", + "field": "lastEvent.log.actorProfile", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/threat_actor_attribution.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Threat Actor Attribution", + "kind": "groupBy", + "field": "lastEvent.log.campaignId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/threat_actor_attribution.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Threat Actor Attribution", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/deceptive-bytes/zero_day_behavior_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Zero-Day Behavior Patterns Detection", + "kind": "groupBy", + "field": "lastEvent.log.exploitTechnique", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/zero_day_behavior_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Zero-Day Behavior Patterns Detection", + "kind": "groupBy", + "field": "lastEvent.log.processHash", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/deceptive-bytes/zero_day_behavior_patterns.yml", + "document": 1, + "dataTypes": [ + "deceptive-bytes" + ], + "name": "Zero-Day Behavior Patterns Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/advanced_heuristic_detection_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Advanced Heuristic Detection Triggers", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/advanced_heuristic_detection_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Advanced Heuristic Detection Triggers", + "kind": "groupBy", + "field": "lastEvent.log.msgType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/botnet_communication_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Botnet Communication Detection", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/botnet_communication_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Botnet Communication Detection", + "kind": "groupBy", + "field": "lastEvent.log.jsonMessage", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/eset_agent_tampering.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Agent Disabled or Tampered", + "kind": "groupBy", + "field": "lastEvent.log.eventType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/eset_agent_tampering.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Agent Disabled or Tampered", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/eset_console_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET ERA/ESMC Console Suspicious Activity", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/eset_console_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET ERA/ESMC Console Suspicious Activity", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/eset_quarantine_failures.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Repeated Quarantine Failures", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/eset_quarantine_failures.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Repeated Quarantine Failures", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/exploit_detection_events.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Exploit Detection Alert", + "kind": "groupBy", + "field": "lastEvent.log.jsonMessage", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/exploit_detection_events.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Exploit Detection Alert", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/host_intrusion_prevention_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Host Intrusion Prevention System Triggered", + "kind": "groupBy", + "field": "lastEvent.log.objectname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/host_intrusion_prevention_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Host Intrusion Prevention System Triggered", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/machine_learning_detection_anomalies.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Machine Learning Detection Anomalies", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/machine_learning_detection_anomalies.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Machine Learning Detection Anomalies", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/network_attack_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Network Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/network_attack_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Network Attack Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/registry_modification_attempts_blocked.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Registry Modification Attempts Blocked", + "kind": "groupBy", + "field": "lastEvent.log.action", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/registry_modification_attempts_blocked.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Registry Modification Attempts Blocked", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_encrypted_file_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Suspicious Encrypted File Activity", + "kind": "groupBy", + "field": "lastEvent.log.msgType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_encrypted_file_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Suspicious Encrypted File Activity", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_powershell_activity_blocked.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Blocked Suspicious PowerShell Activity", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_powershell_activity_blocked.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "ESET Blocked Suspicious PowerShell Activity", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_process_behavior.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Suspicious Process Behavior Detection", + "kind": "groupBy", + "field": "lastEvent.log.headHostname", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/esmc-eset/suspicious_process_behavior.yml", + "document": 1, + "dataTypes": [ + "antivirus-esmc-eset" + ], + "name": "Suspicious Process Behavior Detection", + "kind": "groupBy", + "field": "lastEvent.log.msgType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/kaspersky/code_injection_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Code Injection Attempt Detection", + "kind": "deduplicateBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/code_injection_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Code Injection Attempt Detection", + "kind": "deduplicateBy", + "field": "log.cs4", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/command_and_control_communication.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Command and Control Communication Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/command_and_control_communication.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Command and Control Communication Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/critical_object_detected.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Critical Object Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/critical_object_detected.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Critical Object Detection", + "kind": "groupBy", + "field": "log.signatureID", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/data_exfiltration_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Data Exfiltration Attempts Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/data_exfiltration_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Data Exfiltration Attempts Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/lolbins_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Living Off the Land Binaries (LOLBins) Abuse Detection", + "kind": "groupBy", + "field": "log.cs4", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/lolbins_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Living Off the Land Binaries (LOLBins) Abuse Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/privilege_escalation_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Application Privilege Escalation Detection", + "kind": "groupBy", + "field": "log.signatureID", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/privilege_escalation_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Application Privilege Escalation Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/privilege_escalation_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Application Privilege Escalation Detection", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/process_hollowing_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Process Hollowing Detection", + "kind": "groupBy", + "field": "log.cs5", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/process_hollowing_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Process Hollowing Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/sandbox_evasion_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Sandbox Evasion Attempts Detection", + "kind": "deduplicateBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/suspicious_network_activity.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Suspicious Network Activity Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/suspicious_packed_executables.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Suspicious Packed Executable Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/suspicious_packed_executables.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Suspicious Packed Executable Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/suspicious_scheduled_tasks.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Suspicious Scheduled Tasks Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/suspicious_service_installation.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Suspicious Service Installation Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/system_file_tampering_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky System File Tampering Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/trusted_application_compromise.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky Trusted Application Compromise Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/wmi_abuse_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky WMI Abuse Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/kaspersky/wmi_abuse_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-kaspersky" + ], + "name": "Kaspersky WMI Abuse Detection", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/agent_tampering_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Agent Tampering Attempts", + "kind": "groupBy", + "field": "lastEvent.log.agentId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/agent_tampering_attempts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Agent Tampering Attempts", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/ai_based_threat_hunting_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne AI-Based Threat Hunting Alerts", + "kind": "groupBy", + "field": "lastEvent.log.accName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/ai_based_threat_hunting_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne AI-Based Threat Hunting Alerts", + "kind": "groupBy", + "field": "lastEvent.log.endpointDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/behavioral_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Behavioral Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/behavioral_threat_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Behavioral Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/cloud_workload_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Cloud Workload Protection Alert", + "kind": "groupBy", + "field": "lastEvent.log.accName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/cloud_workload_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Cloud Workload Protection Alert", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/container_security_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Container Security Alert", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/container_security_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Container Security Alert", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/custom_detection_rule_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Custom Detection Rule Triggers", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/custom_detection_rule_triggers.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Custom Detection Rule Triggers", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/deep_visibility_threat_indicators.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Deep Visibility Threat Indicators", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/deep_visibility_threat_indicators.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Deep Visibility Threat Indicators", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/endpoint_detection_response_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Endpoint Detection and Response (EDR) Alerts", + "kind": "groupBy", + "field": "lastEvent.log.endpointDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/endpoint_detection_response_alerts.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Endpoint Detection and Response (EDR) Alerts", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/iot_device_compromise_indicators.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne IoT Device Compromise Indicator", + "kind": "groupBy", + "field": "lastEvent.log.endpointDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/iot_device_compromise_indicators.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne IoT Device Compromise Indicator", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/kernel_level_threat.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Kernel-Level Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/kernel_level_threat.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Kernel-Level Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/memory_injection_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Memory Injection Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/memory_injection_detection.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Memory Injection Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/rollback_operation_patterns.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Rollback Operation Patterns Detection", + "kind": "groupBy", + "field": "lastEvent.log.endpointDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/rollback_operation_patterns.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Rollback Operation Patterns Detection", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/s1_exclusion_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Suspicious Exclusion Addition", + "kind": "groupBy", + "field": "lastEvent.log.activityType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/s1_exclusion_abuse.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Suspicious Exclusion Addition", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/s1_policy_downgrade.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Policy Downgraded from Protect to Detect", + "kind": "groupBy", + "field": "lastEvent.log.activityType", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/s1_policy_downgrade.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Policy Downgraded from Protect to Detect", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/storyline_correlation.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Storyline Correlation Event", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/storyline_correlation.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Storyline Correlation Event", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/antivirus/sentinel-one/suspicious_process_tree.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Suspicious Process Tree Analysis", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/suspicious_process_tree.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Suspicious Process Tree Analysis", + "kind": "groupBy", + "field": "lastEvent.log.threatId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/suspicious_script_execution.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Suspicious Script Execution Detected", + "kind": "groupBy", + "field": "lastEvent.log.endpointDeviceName", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/suspicious_script_execution.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Suspicious Script Execution Detected", + "kind": "groupBy", + "field": "lastEvent.log.eventDescription", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/threat_intelligence_matches.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Threat Intelligence Matches", + "kind": "groupBy", + "field": "lastEvent.log.externalthreatvalue", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/threat_intelligence_matches.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Threat Intelligence Matches", + "kind": "groupBy", + "field": "lastEvent.log.filecontenthash", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/threat_intelligence_matches.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "Threat Intelligence Matches", + "kind": "groupBy", + "field": "lastEvent.log.syslogHost", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/threat_mitigation_failures.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Threat Mitigation Failures", + "kind": "groupBy", + "field": "lastEvent.log.agentId", + "lastEventAlias": true + }, + { + "file": "rules/antivirus/sentinel-one/threat_mitigation_failures.yml", + "document": 1, + "dataTypes": [ + "antivirus-sentinel-one" + ], + "name": "SentinelOne Threat Mitigation Failures", + "kind": "groupBy", + "field": "lastEvent.log.threatId", + "lastEventAlias": true + }, + { + "file": "rules/cisco/asa/botnet_traffic_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "Botnet Command and Control Traffic Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/asa/botnet_traffic_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "Botnet Command and Control Traffic Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/asa/ips_signature_matches.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "IPS Signature Match - Malicious Pattern Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/asa/ips_signature_matches.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "IPS Signature Match - Malicious Pattern Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/asa/multiple_failed_vpn_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "Multiple Failed VPN Authentication Attempts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/asa/multiple_failed_vpn_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-asa" + ], + "name": "Multiple Failed VPN Authentication Attempts", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cisco/cs_switch/arp_poisoning_detection.yml", + "document": 1, + "dataTypes": [ + "cisco-switch" + ], + "name": "ARP Poisoning Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/cs_switch/arp_poisoning_detection.yml", + "document": 1, + "dataTypes": [ + "cisco-switch" + ], + "name": "ARP Poisoning Attack Detection", + "kind": "groupBy", + "field": "adversary.mac", + "lastEventAlias": false + }, + { + "file": "rules/cisco/cs_switch/mac_address_spoofing.yml", + "document": 1, + "dataTypes": [ + "cisco-switch" + ], + "name": "MAC Address Spoofing Detection", + "kind": "groupBy", + "field": "adversary.mac", + "lastEventAlias": false + }, + { + "file": "rules/cisco/cs_switch/vlan_hopping_attempts.yml", + "document": 1, + "dataTypes": [ + "cisco-switch" + ], + "name": "VLAN Hopping Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/cs_switch/vlan_hopping_attempts.yml", + "document": 1, + "dataTypes": [ + "cisco-switch" + ], + "name": "VLAN Hopping Attack Detection", + "kind": "groupBy", + "field": "adversary.mac", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/advanced_malware_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Advanced Malware Protection (AMP) Alert Detection", + "kind": "groupBy", + "field": "lastEvent.log.sha256", + "lastEventAlias": true + }, + { + "file": "rules/cisco/firepower/advanced_malware_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Advanced Malware Protection (AMP) Alert Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/c2_nonstandard_port.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Command and Control on Non-Standard Ports", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/c2_nonstandard_port.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Command and Control on Non-Standard Ports", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/c2_nonstandard_port.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Command and Control on Non-Standard Ports", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/intrusion_prevention_high_priority_events.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Intrusion Prevention System High Priority Events", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/intrusion_prevention_high_priority_events.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Intrusion Prevention System High Priority Events", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/ioc_matches.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Firepower IOC (Indicator of Compromise) Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/firepower/threat_intelligence_director_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Threat Intelligence Director (TID) Alert Detection", + "kind": "groupBy", + "field": "lastEvent.log.tidIndicator", + "lastEventAlias": true + }, + { + "file": "rules/cisco/firepower/threat_intelligence_director_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-cisco-firepower" + ], + "name": "Threat Intelligence Director (TID) Alert Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/advanced_malware_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki Advanced Malware Protection Alert", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/advanced_malware_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki Advanced Malware Protection Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/air_marshal_rogue_ap.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Air Marshal Rogue Access Point Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/evil_twin_ap_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Evil Twin Access Point Detection", + "kind": "groupBy", + "field": "lastEvent.log.bssid", + "lastEventAlias": true + }, + { + "file": "rules/cisco/meraki/evil_twin_ap_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Evil Twin Access Point Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/intrusion_detection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki IDS High Priority Intrusion Alert", + "kind": "groupBy", + "field": "lastEvent.log.signature", + "lastEventAlias": true + }, + { + "file": "rules/cisco/meraki/intrusion_detection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki IDS High Priority Intrusion Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/meraki_vpn_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki Client VPN Brute Force Attempts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/meraki_vpn_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Meraki Client VPN Brute Force Attempts", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/rogue_ssid_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Rogue SSID Detection", + "kind": "groupBy", + "field": "adversary.mac", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/wireless_intrusion_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Wireless Intrusion Attempts", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cisco/meraki/wireless_intrusion_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-meraki" + ], + "name": "Wireless Intrusion Attempts", + "kind": "deduplicateBy", + "field": "target.mac", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_backup_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Backup Deletion for Impact", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_backup_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Backup Deletion for Impact", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_config_service_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Config Service Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_config_service_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Config Service Disabled", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_console_getsignintoken_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Console GetSigninToken Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_console_getsignintoken_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Console GetSigninToken Abuse", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_ec2_startup_script_modification.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Instance Startup Script Modified", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_ec2_startup_script_modification.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Instance Startup Script Modified", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.instanceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_ecs_credential_theft.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS ECS Task Credential Endpoint Query", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_ecs_credential_theft.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS ECS Task Credential Endpoint Query", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_glue_privilege_escalation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Glue Development Endpoint Privilege Escalation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_glue_privilege_escalation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Glue Development Endpoint Privilege Escalation", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_golden_saml_attack.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Golden SAML Attack Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_golden_saml_attack.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Golden SAML Attack Detected", + "kind": "groupBy", + "field": "lastEvent.log.requestParametersRoleArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_iam_login_profile_modification.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Login Profile Modified for Another User", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_iam_login_profile_modification.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Login Profile Modified for Another User", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.userName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_kms_key_material_import.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS KMS Key Material Import or Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_kms_key_material_import.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS KMS Key Material Import or Deletion", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_rds_public_restore.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Database Restored as Publicly Accessible", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_rds_public_restore.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Database Restored as Publicly Accessible", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_s3_versioning_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Versioning Suspended", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_s3_versioning_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Versioning Suspended", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.bucketName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_securityhub_finding_evasion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SecurityHub Finding Evasion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_securityhub_finding_evasion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SecurityHub Finding Evasion", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Snapshot Shared with External Account", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Snapshot Shared with External Account", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.snapshotId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_ssm_sendcommand_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSM SendCommand Remote Execution", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_ssm_sendcommand_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSM SendCommand Remote Execution", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_sso_idp_change.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSO Identity Provider Configuration Changed", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_sso_idp_change.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSO Identity Provider Configuration Changed", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_sso_suspicious_activities.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSO Suspicious Activities", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_sso_suspicious_activities.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS SSO Suspicious Activities", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.principalId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/aws_trufflehog_scanning.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS TruffleHog Credential Scanning Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/aws_trufflehog_scanning.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS TruffleHog Credential Scanning Detected", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cloudformation_stack_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudFormation Stack Deletion", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityAccountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cloudformation_stack_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudFormation Stack Deletion", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cloudtrail_event_selector_manipulation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Event Selector Manipulation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/cloudtrail_event_selector_manipulation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Event Selector Manipulation", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.trailName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cloudtrail_logging_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Logging Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/cloudtrail_logging_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Logging Disabled", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.name", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/console_login_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Console Login Impossible Travel Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/console_login_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Console Login Impossible Travel Detection", + "kind": "groupBy", + "field": "adversary.geolocation.countryCode", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/cross_account_access_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Cross-Account Access Anomalies", + "kind": "groupBy", + "field": "lastEvent.log.responseElementsAssumedRoleUserArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cross_account_access_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Cross-Account Access Anomalies", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/cross_account_access_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Cross-Account Access Anomalies", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityAccountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ebs_snapshot_sharing_violations.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "EBS Snapshot Sharing Violations", + "kind": "groupBy", + "field": "lastEvent.log.responseElements.snapshotId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ebs_snapshot_sharing_violations.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "EBS Snapshot Sharing Violations", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.accountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ec2_cryptomining_detection.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Cryptomining Instance Launch Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/ec2_cryptomining_detection.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Cryptomining Instance Launch Detection", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.instanceType", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ec2_metadata_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "EC2 Instance Metadata Abuse", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ec2_metadata_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "EC2 Instance Metadata Abuse", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityAccountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ecs_eks_container_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS ECS/EKS Container Abuse Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/ecs_eks_container_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS ECS/EKS Container Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/guardduty_high_severity_findings.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS GuardDuty High-Severity Finding", + "kind": "groupBy", + "field": "lastEvent.log.accountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/guardduty_high_severity_findings.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS GuardDuty High-Severity Finding", + "kind": "groupBy", + "field": "lastEvent.log.region", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/guardduty_high_severity_findings.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS GuardDuty High-Severity Finding", + "kind": "groupBy", + "field": "lastEvent.log.type", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/iam_backdoor_creation_attempts.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Backdoor Creation Attempts", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/iam_backdoor_creation_attempts.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Backdoor Creation Attempts", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.arn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/iam_privilege_escalation_paths.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Privilege Escalation Path Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/iam_privilege_escalation_paths.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Privilege Escalation Path Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/lambda_privilege_escalation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "Lambda Function Privilege Escalation", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.roleArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/lambda_privilege_escalation.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "Lambda Function Privilege Escalation", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.arn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/lambda_url_backdoor.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Lambda Function URL Backdoor Creation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/lambda_url_backdoor.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Lambda Function URL Backdoor Creation", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.functionName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/mass_resource_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Mass Resource Deletion", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/mass_resource_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Mass Resource Deletion", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.arn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/rds_security_group_changes.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "RDS Security Group Changes", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/rds_security_group_changes.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "RDS Security Group Changes", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/rds_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Snapshot Sharing for Data Exfiltration", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/rds_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Snapshot Sharing for Data Exfiltration", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.dBSnapshotIdentifier", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/root_account_usage_without_mfa.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Root Account Usage Without MFA", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/root_account_usage_without_mfa.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Root Account Usage Without MFA", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityAccountId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/route53_dns_hijacking.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 DNS Hijacking Attempt", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/route53_dns_hijacking.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 DNS Hijacking Attempt", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/s3_bucket_public_exposure.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Public Exposure", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.bucketName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/s3_bucket_public_exposure.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Public Exposure", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.accessKeyId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/s3_bulk_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bulk Data Exfiltration Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/s3_bulk_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bulk Data Exfiltration Detected", + "kind": "groupBy", + "field": "lastEvent.log.requestParameters.bucketName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/secrets_manager_suspicious_access.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Secrets Manager Suspicious Access Pattern", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/secrets_manager_suspicious_access.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Secrets Manager Suspicious Access Pattern", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/security_group_modifications.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Security Group Modifications", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/security_group_modifications.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Security Group Modifications", + "kind": "groupBy", + "field": "lastEvent.log.userIdentity.arn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/ssm_session_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Systems Manager Session Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/ssm_session_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Systems Manager Session Abuse", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/sts_token_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS STS Token Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.userIdentityArn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/sts_token_abuse.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS STS Token Abuse Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/unusual_api_call_patterns.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Unusual API Call Patterns", + "kind": "groupBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/vpc_flow_log_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS VPC Flow Log Anomalies", + "kind": "deduplicateBy", + "field": "lastEvent.log.sourceIPAddress", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/vpc_flow_log_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS VPC Flow Log Anomalies", + "kind": "deduplicateBy", + "field": "lastEvent.log.userIdentity.arn", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/vpc_flow_log_anomalies.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS VPC Flow Log Anomalies", + "kind": "deduplicateBy", + "field": "lastEvent.log.awsRegion", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/aws/waf_shield_rule_modifications.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF and Shield Rule Modifications", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/aws/waf_shield_rule_modifications.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF and Shield Rule Modifications", + "kind": "groupBy", + "field": "lastEvent.log.eventName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/aws/credential_access_aws_iam_assume_role_brute_force.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Brute Force of Assume Role Policy", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/credential_access_aws_iam_assume_role_brute_force.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Brute Force of Assume Role Policy", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/credential_access_root_console_failure_brute_force.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Management Console Brute Force of Root User Identity", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/credential_access_root_console_failure_brute_force.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Management Console Brute Force of Root User Identity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_cloudtrail_logging_deleted.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Deleted", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_cloudtrail_logging_deleted.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Deleted", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_cloudtrail_logging_suspended.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Suspended", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_cloudtrail_logging_suspended.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Suspended", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_config_service_rule_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Config Service Tampering", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_config_service_rule_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Config Service Tampering", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_configuration_recorder_stopped.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Configuration Recorder Stopped", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_configuration_recorder_stopped.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Configuration Recorder Stopped", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_ec2_flow_log_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Flow Log Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_ec2_flow_log_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Flow Log Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_guardduty_detector_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS GuardDuty Detector Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_guardduty_detector_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS GuardDuty Detector Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_s3_bucket_configuration_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Configuration Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_s3_bucket_configuration_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS S3 Bucket Configuration Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_waf_acl_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF Access Control List Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_waf_acl_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF Access Control List Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_waf_rule_or_rule_group_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF Rule or Rule Group Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/defense_evasion_waf_rule_or_rule_group_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS WAF Rule or Rule Group Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_full_network_packet_capture_detected.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Full Network Packet Capture Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_full_network_packet_capture_detected.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Full Network Packet Capture Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_snapshot_change_activity.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Snapshot Activity", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_snapshot_change_activity.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Snapshot Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_vm_export_failure.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 VM Export Failure", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_ec2_vm_export_failure.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 VM Export Failure", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_rds_snapshot_export.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Snapshot Export", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/exfiltration_rds_snapshot_export.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Snapshot Export", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudtrail_logging_updated.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Updated", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudtrail_logging_updated.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudTrail Log Updated", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudwatch_log_group_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudWatch Log Group Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudwatch_log_group_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudWatch Log Group Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudwatch_log_stream_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudWatch Log Stream Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_cloudwatch_log_stream_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS CloudWatch Log Stream Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_ec2_disable_ebs_encryption.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Encryption Disabled", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_ec2_disable_ebs_encryption.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS EC2 Encryption Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_iam_deactivate_mfa_device.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Deactivation of MFA Device", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_iam_deactivate_mfa_device.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Deactivation of MFA Device", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_rds_cluster_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Cluster Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/impact_rds_cluster_deletion.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS RDS Cluster Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_console_login_root.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Management Console Root Login", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_console_login_root.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Management Console Root Login", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_password_recovery.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Password Recovery Requested", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_password_recovery.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Password Recovery Requested", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_via_system_manager.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Execution via System Manager", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/initial_access_via_system_manager.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Execution via System Manager", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/persistence_route_53_domain_transfer_lock_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 Domain Transfer Lock Disabled", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/persistence_route_53_domain_transfer_lock_disabled.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 Domain Transfer Lock Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/persistence_route_53_domain_transferred_to_another_account.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 Domain Transferred to Another Account", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/persistence_route_53_domain_transferred_to_another_account.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Route 53 Domain Transferred to Another Account", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/privilege_escalation_root_login_without_mfa.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Root Login Without MFA", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/privilege_escalation_root_login_without_mfa.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS Root Login Without MFA", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/privilege_escalation_updateassumerolepolicy.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Assume Role Policy Update", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/aws/privilege_escalation_updateassumerolepolicy.yml", + "document": 1, + "dataTypes": [ + "aws" + ], + "name": "AWS IAM Assume Role Policy Update", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/aks_security_threats.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AKS Container Security Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/aks_security_threats.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AKS Container Security Threat Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/app_registration_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD App Registration with High-Privilege API Permissions", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/app_registration_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD App Registration with High-Privilege API Permissions", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/application_gateway_waf_alerts.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Application Gateway WAF Security Alerts", + "kind": "groupBy", + "field": "lastEvent.log.ruleId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/application_gateway_waf_alerts.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Application Gateway WAF Security Alerts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/automation_runbook_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Automation Runbook Abuse", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/automation_runbook_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Automation Runbook Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_ad_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Impossible Travel Sign-In Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_ad_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Impossible Travel Sign-In Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_ad_password_spray.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Password Spray Attack Detection", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_ad_password_spray.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Password Spray Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_alert_suppression_rule.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Security Alert Suppression Rule Created", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_alert_suppression_rule.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Security Alert Suppression Rule Created", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_anomalous_token.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Anomalous Token Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_anomalous_token.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Anomalous Token Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_app_credential_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Application Credential Added", + "kind": "groupBy", + "field": "lastEvent.log.properties.targetResources", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_app_credential_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Application Credential Added", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_app_privileged_permissions.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Privileged App Role Assignment", + "kind": "groupBy", + "field": "lastEvent.log.properties.targetResources", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_app_privileged_permissions.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Privileged App Role Assignment", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_azurehound_discovery.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "AzureHound Reconnaissance Tool Detected", + "kind": "deduplicateBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_azurehound_discovery.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "AzureHound Reconnaissance Tool Detected", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_bulk_role_changes.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Bulk Privileged Role Assignment Changes", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_bulk_role_changes.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Bulk Privileged Role Assignment Changes", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_device_code_auth_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Device Code Authentication Flow Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_device_code_auth_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Device Code Authentication Flow Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_disk_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Disk Snapshot Exfiltration", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_disk_snapshot_exfiltration.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Disk Snapshot Exfiltration", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_federation_modified.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Federation Settings Modified", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_federation_modified.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Federation Settings Modified", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Impossible Travel Sign-In", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_impossible_travel.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Impossible Travel Sign-In", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_kubernetes_admission_controller.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Admission Webhook Modified", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_kubernetes_admission_controller.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Admission Webhook Modified", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_kubernetes_events_deleted.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Events Deleted", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_kubernetes_events_deleted.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Events Deleted", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_kubernetes_secret_access.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Secret Write or Delete", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_kubernetes_secret_access.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Kubernetes Secret Write or Delete", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_laps_credential_dump.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD LAPS Password Recovery", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_laps_credential_dump.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD LAPS Password Recovery", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_leaked_credentials.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Leaked Credentials Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_leaked_credentials.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Leaked Credentials Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_new_root_ca_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD New Root Certificate Authority Added", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_new_root_ca_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD New Root Certificate Authority Added", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_password_spray_detected.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Password Spray Attack Detected", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_password_spray_detected.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Password Spray Attack Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_prt_access_attempt.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Primary Refresh Token Access Attempt", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_prt_access_attempt.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Primary Refresh Token Access Attempt", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_ropc_authentication.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Resource Owner Password Credentials Flow Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_ropc_authentication.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Resource Owner Password Credentials Flow Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_sentinel_alert_patterns.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Sentinel High/Critical Alert Pattern Detection", + "kind": "groupBy", + "field": "lastEvent.log.AlertType", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_sentinel_alert_patterns.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Sentinel High/Critical Alert Pattern Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_subscription_permission_elevation.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Subscription Permission Elevation via ElevateAccess", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_subscription_permission_elevation.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Subscription Permission Elevation via ElevateAccess", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/azure_temporary_access_pass.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Temporary Access Pass Registration", + "kind": "groupBy", + "field": "lastEvent.log.properties.targetResources", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/azure_temporary_access_pass.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Temporary Access Pass Registration", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/credential_access_key_vault_modified.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Key Vault Modified", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/credential_access_key_vault_modified.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Key Vault Modified", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defender_cloud_critical_alerts.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Defender for Cloud Critical Security Alert", + "kind": "groupBy", + "field": "lastEvent.log.correlationId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/defender_cloud_critical_alerts.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Defender for Cloud Critical Security Alert", + "kind": "groupBy", + "field": "lastEvent.log.eventDataId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/defense_evasion_azure_application_credential_modification.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Application Credential Modification", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defense_evasion_azure_application_credential_modification.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Application Credential Modification", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defense_evasion_azure_diagnostic_settings_deletion.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Diagnostic Settings Deletion", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defense_evasion_azure_diagnostic_settings_deletion.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Diagnostic Settings Deletion", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defense_evasion_event_hub_deletion.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Event Hub Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/defense_evasion_event_hub_deletion.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Event Hub Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/diagnostic_settings_tampering.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Diagnostic Settings Tampering", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/diagnostic_settings_tampering.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Diagnostic Settings Tampering", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/golden_saml_federation_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Golden SAML and Federation Domain Abuse", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/golden_saml_federation_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure AD Golden SAML and Federation Domain Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/impact_azure_service_principal_credentials_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Service Principal Credentials Added", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/impact_azure_service_principal_credentials_added.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Service Principal Credentials Added", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/initial_access_azure_active_directory_high_risk_signin.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Active Directory High Risk Sign-in", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/initial_access_azure_active_directory_high_risk_signin.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Active Directory High Risk Sign-in", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/initial_access_consent_grant_attack_via_azure_registered_application.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Possible Consent Grant Attack via Azure-Registered Application", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/initial_access_consent_grant_attack_via_azure_registered_application.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Possible Consent Grant Attack via Azure-Registered Application", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/key_vault_access_spikes.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Key Vault Excessive Access Detected", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/key_vault_access_spikes.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Key Vault Excessive Access Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/managed_identity_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Managed Identity Token Abuse", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/managed_identity_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Managed Identity Token Abuse", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/mfa_disabled_privileged_users.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "MFA Disabled for Privileged Azure AD User", + "kind": "groupBy", + "field": "lastEvent.log.correlationId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/mfa_disabled_privileged_users.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "MFA Disabled for Privileged Azure AD User", + "kind": "groupBy", + "field": "lastEvent.log.targetUserPrincipalName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/persistence_azure_pim_user_added_global_admin.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Global Administrator Role Addition to PIM User", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/persistence_azure_pim_user_added_global_admin.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Global Administrator Role Addition to PIM User", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/persistence_mfa_disabled_for_azure_user.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Multi-Factor Authentication Disabled for an Azure User", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/persistence_mfa_disabled_for_azure_user.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Multi-Factor Authentication Disabled for an Azure User", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/pim_role_activation_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure PIM Role Activation Anomaly", + "kind": "groupBy", + "field": "lastEvent.log.operationName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/pim_role_activation_abuse.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure PIM Role Activation Anomaly", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/azure/storage_account_public_access.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Storage Account Public Access Enabled", + "kind": "groupBy", + "field": "lastEvent.log.aadObjectId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/storage_account_public_access.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Storage Account Public Access Enabled", + "kind": "groupBy", + "field": "lastEvent.log.resourceId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/subscription_ownership_transfer.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Subscription Ownership Transfer Detected", + "kind": "groupBy", + "field": "lastEvent.log.correlationId", + "lastEventAlias": true + }, + { + "file": "rules/cloud/azure/subscription_ownership_transfer.yml", + "document": 1, + "dataTypes": [ + "azure" + ], + "name": "Azure Subscription Ownership Transfer Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/anthos_security_events.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Anthos Security Policy Violations", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/anthos_security_events.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Anthos Security Policy Violations", + "kind": "groupBy", + "field": "lastEvent.log.resource.labels.project_id", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/binary_authorization_bypasses.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Binary Authorization Bypass Detection", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/binary_authorization_bypasses.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Binary Authorization Bypass Detection", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/cloud_identity_suspicious_signins.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Cloud Identity Suspicious Sign-ins Detection", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/cloud_identity_suspicious_signins.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Cloud Identity Suspicious Sign-ins Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_hijacked.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable hijacked account", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_hijacked.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable hijacked account", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_password_leak.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP detected account with password leak", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_password_leak.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP detected account with password leak", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_spamming.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP account is probably used for spamming", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_account_disabled_spamming.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP account is probably used for spamming", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_audit_log_disabling.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Audit Log Disabling or Tampering", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_audit_log_disabling.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Audit Log Disabling or Tampering", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_bigquery_exfiltration.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP BigQuery Data Exfiltration Detection", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_bigquery_exfiltration.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP BigQuery Data Exfiltration Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_breakglass_container_deploy.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Break-Glass Container Workload Deployed", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_breakglass_container_deploy.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Break-Glass Container Workload Deployed", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_cloud_function_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cloud Function and Cloud Run Abuse", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_cloud_function_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cloud Function and Cloud Run Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_cryptomining_detection.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cryptomining Instance Launch Detection", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_cryptomining_detection.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cryptomining Instance Launch Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_custom_role_creation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Custom Role with Overly Permissive Permissions", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_custom_role_creation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Custom Role with Overly Permissive Permissions", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_defense_evasion_logging_sink_deletion.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Defense Evasion, Logging Sink Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_defense_evasion_logging_sink_deletion.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Defense Evasion, Logging Sink Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_dlp_reidentification.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP DLP Re-Identification API Call", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_dlp_reidentification.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP DLP Re-Identification API Call", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_domain_api_access_granted.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Domain-Wide API Access Granted", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_domain_api_access_granted.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Domain-Wide API Access Granted", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_exfiltration_logging_sink_modification.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Exfiltration, Logging Sink Modification", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_exfiltration_logging_sink_modification.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Exfiltration, Logging Sink Modification", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_gov_attack.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Government-backed attack", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_gov_attack.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Government-backed attack", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_impact_storage_bucket_deleted.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Impact, Storage Bucket Deleted", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_impact_storage_bucket_deleted.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Impact, Storage Bucket Deleted", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_kms_key_modifications.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP KMS Key Destruction or Disabling", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_kms_key_modifications.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP KMS Key Destruction or Disabling", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_kubernetes_admission_controller.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GKE Kubernetes Admission Webhook Modified", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_kubernetes_admission_controller.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GKE Kubernetes Admission Webhook Modified", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_packet_capture_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Network Packet Capture Configuration", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_packet_capture_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Network Packet Capture Configuration", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_privilege_escalation_kubernetes_rolebindings_created_or_patched.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Privilege Escalation, Kubernetes role bindings created or patched", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_privilege_escalation_kubernetes_rolebindings_created_or_patched.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Privilege Escalation, Kubernetes role bindings created or patched", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_probable_password_guess.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Password Guessing", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_probable_password_guess.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP probable Password Guessing", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_project_manipulation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Project Manipulation and Shadow Projects", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_project_manipulation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Project Manipulation and Shadow Projects", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_secret_manager_access.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Secret Manager Bulk Access Detection", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_secret_manager_access.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Secret Manager Bulk Access Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_service_account_impersonation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Service Account Impersonation Detection", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_service_account_impersonation.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Service Account Impersonation Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_storage_exfiltration.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cloud Storage Data Exfiltration", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadResourceName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_storage_exfiltration.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Cloud Storage Data Exfiltration", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_login_blocked.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious login blocked", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_login_blocked.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious login blocked", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_login_less_secure_app.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious login from less secure app", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_login_less_secure_app.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious login from less secure app", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_programmatic_login.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious programmatic login", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_suspicious_programmatic_login.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP suspicious programmatic login", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_two_step_verification_disabled.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP 2-step verification disabled", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_two_step_verification_disabled.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP 2-step verification disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_workload_identity_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Workload Identity Federation Abuse", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_workload_identity_abuse.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "GCP Workload Identity Federation Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/cloud/google/gcp_workspace_mfa_disabled.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Google Workspace MFA Enforcement Disabled", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/gcp_workspace_mfa_disabled.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Google Workspace MFA Enforcement Disabled", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/service_account_key_creation_spikes.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Google Cloud Service Account Key Creation Spike", + "kind": "groupBy", + "field": "lastEvent.origin.user", + "lastEventAlias": true + }, + { + "file": "rules/cloud/google/service_account_key_creation_spikes.yml", + "document": 1, + "dataTypes": [ + "google" + ], + "name": "Google Cloud Service Account Key Creation Spike", + "kind": "groupBy", + "field": "lastEvent.log.protoPayloadMethodName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/critical_role_modification.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Critical Role Modification (Privilege Escalation)", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/critical_role_modification.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Critical Role Modification (Privilege Escalation)", + "kind": "groupBy", + "field": "lastEvent.log.eventOperationName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/custom_indicator_of_compromise_(IoC)_detected.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Custom Indicator of Compromise (IoC) Detected", + "kind": "groupBy", + "field": "lastEvent.log.metadataEventType", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/deletion_or_deactivation_of_user_account.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Deletion or Deactivation of User Account", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/deletion_or_deactivation_of_user_account.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Deletion or Deactivation of User Account", + "kind": "groupBy", + "field": "lastEvent.log.eventOperationName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/endpoint_network_containment_action.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Endpoint Network Containment Action", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/endpoint_network_containment_action.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Endpoint Network Containment Action", + "kind": "groupBy", + "field": "lastEvent.log.eventOperationName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/endpoint_or_XDR_detection_alert.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Endpoint or XDR Detection Alert", + "kind": "groupBy", + "field": "lastEvent.log.metadataEventType", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/inhibit_system_recovery.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Inhibit System Recovery (Shadow Copy Deletion)", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/inhibit_system_recovery.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Inhibit System Recovery (Shadow Copy Deletion)", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/ip_whitelisting_modification.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "IP Whitelisting Modification", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/ip_whitelisting_modification.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "IP Whitelisting Modification", + "kind": "groupBy", + "field": "lastEvent.log.eventOperationName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/major_incident_generated.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Major Incident Generated (CrowdScore)", + "kind": "groupBy", + "field": "lastEvent.log.metadataEventType", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/multiple_authentication_failures_(possible_brute_force_attack).yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Multiple Authentication Failures (Possible Brute Force Attack)", + "kind": "deduplicateBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/os_credential_dumping_activity.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "OS Credential Dumping Activity", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/os_credential_dumping_activity.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "OS Credential Dumping Activity", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/real_time_response_rtr_session_execution.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Real-Time Response (RTR) Session Execution", + "kind": "groupBy", + "field": "lastEvent.log.metadataEventType", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/real_time_response_rtr_session_execution.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Real-Time Response (RTR) Session Execution", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/security_defenses_impaired_or_policy_disabled.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Security Defenses Impaired or Policy Disabled", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/security_defenses_impaired_or_policy_disabled.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Security Defenses Impaired or Policy Disabled", + "kind": "groupBy", + "field": "lastEvent.log.eventPatternDispositionDescription", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/security_policy_disabled_or_deleted.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Security Policy Disabled or Deleted", + "kind": "groupBy", + "field": "lastEvent.log.eventUserId", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/security_policy_disabled_or_deleted.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Security Policy Disabled or Deleted", + "kind": "groupBy", + "field": "lastEvent.log.eventOperationName", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/suspicious_downloader_execution_linux_macos.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Downloader Execution (Linux/macOS)", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/suspicious_downloader_execution_linux_macos.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Downloader Execution (Linux/macOS)", + "kind": "groupBy", + "field": "lastEvent.log.eventCommandLine", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/suspicious_encoded_powershell_execution.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Encoded PowerShell Execution", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/suspicious_encoded_powershell_execution.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Encoded PowerShell Execution", + "kind": "groupBy", + "field": "lastEvent.log.eventCommandLine", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/suspicious_native_downloaders.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Native Downloaders (LoLBin)", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/suspicious_native_downloaders.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "Suspicious Native Downloaders (LoLBin)", + "kind": "groupBy", + "field": "lastEvent.log.eventCommandLine", + "lastEventAlias": true + }, + { + "file": "rules/crowdstrike/windows_event_log_clearing.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "CrowdStrike Hunting: Windows Event Log Clearing", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/crowdstrike/windows_event_log_clearing.yml", + "document": 1, + "dataTypes": [ + "crowdstrike" + ], + "name": "CrowdStrike Hunting: Windows Event Log Clearing", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/admin_account_compromise.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Admin Account Compromise Indicators", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/admin_account_compromise.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Admin Account Compromise Indicators", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/antivirus_outbreak_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Fortinet Antivirus Malware Outbreak Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/antivirus_outbreak_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Fortinet Antivirus Malware Outbreak Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/dlp_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Data Loss Prevention Trigger", + "kind": "groupBy", + "field": "lastEvent.log.dlp_profile", + "lastEventAlias": true + }, + { + "file": "rules/fortinet/fortinet/dlp_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Data Loss Prevention Trigger", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/fortigate_admin_session_anomaly.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiGate Admin Login from Unusual Source", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/fortigate_admin_session_anomaly.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiGate Admin Login from Unusual Source", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/fortigate_vpn_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiGate VPN Authentication Brute Force", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/fortigate_vpn_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiGate VPN Authentication Brute Force", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/ips_critical_severity_events.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Fortinet IPS Critical Severity Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/ips_critical_severity_events.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "Fortinet IPS Critical Severity Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortinet/sandbox_malicious_verdict.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiSandbox Malicious File Detection", + "kind": "groupBy", + "field": "lastEvent.log.filehash", + "lastEventAlias": true + }, + { + "file": "rules/fortinet/fortinet/sandbox_malicious_verdict.yml", + "document": 1, + "dataTypes": [ + "firewall-fortigate-traffic" + ], + "name": "FortiSandbox Malicious File Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/authentication_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Authentication Bypass Attempt Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/authentication_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Authentication Bypass Attempt Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/file_upload_security_violations.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb File Upload Security Violation Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/file_upload_security_violations.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb File Upload Security Violation Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_sqli_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb SQL Injection Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_sqli_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb SQL Injection Attack Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_ssrf_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb SSRF Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_ssrf_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb SSRF Attack Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_webshell_upload.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Web Shell Upload Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/fortiweb_webshell_upload.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Web Shell Upload Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/owasp_top10_violations.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb OWASP Top 10 Violation Attempts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/owasp_top10_violations.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb OWASP Top 10 Violation Attempts", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/web_application_attacks_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Web Application Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/fortinet/fortiweb/web_application_attacks_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-fortiweb" + ], + "name": "FortiWeb Web Application Attack Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/generic/generic/cross_source_lateral_movement.yml", + "document": 1, + "dataTypes": [ + "generic" + ], + "name": "Cross-Source Lateral Movement Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/generic/generic/cross_source_lateral_movement.yml", + "document": 1, + "dataTypes": [ + "generic" + ], + "name": "Cross-Source Lateral Movement Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/github/action_secret_access.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Action Secret Access Activity", + "kind": "groupBy", + "field": "lastEvent.log.action", + "lastEventAlias": true + }, + { + "file": "rules/github/action_secret_access.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Action Secret Access Activity", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/action_secret_access.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Action Secret Access Activity", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/codeowners_modification.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub CODEOWNERS File Modification", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/codeowners_modification.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub CODEOWNERS File Modification", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/dependabot_config_poisoning.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Dependabot Configuration Poisoning", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/dependabot_config_poisoning.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Dependabot Configuration Poisoning", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/environment_protection_bypass.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Environment Protection Rule Bypass", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/environment_protection_bypass.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Environment Protection Rule Bypass", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/github_app_token_theft.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub App Installation Token Suspicious Access", + "kind": "groupBy", + "field": "lastEvent.log.action", + "lastEventAlias": true + }, + { + "file": "rules/github/github_app_token_theft.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub App Installation Token Suspicious Access", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/mass_repository_cloning.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Mass Repository Cloning Detection", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/org_member_role_escalation.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Organization Member to Owner Role Escalation", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/org_member_role_escalation.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Organization Member to Owner Role Escalation", + "kind": "groupBy", + "field": "lastEvent.log.user", + "lastEventAlias": true + }, + { + "file": "rules/github/repo_visibility_public.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Repository Visibility Changed to Public", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/repo_visibility_public.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Repository Visibility Changed to Public", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/secret_scanning_alerts.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Secret Scanning Alert Detected", + "kind": "groupBy", + "field": "lastEvent.log.alert_number", + "lastEventAlias": true + }, + { + "file": "rules/github/secret_scanning_alerts.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Secret Scanning Alert Detected", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/self_hosted_runner_compromise.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Self-Hosted Runner Compromise Detection", + "kind": "groupBy", + "field": "lastEvent.log.action", + "lastEventAlias": true + }, + { + "file": "rules/github/self_hosted_runner_compromise.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Self-Hosted Runner Compromise Detection", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/sensitive_data_commits.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Sensitive Data Commit Detection", + "kind": "groupBy", + "field": "lastEvent.log.headCommitId", + "lastEventAlias": true + }, + { + "file": "rules/github/sensitive_data_commits.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Sensitive Data Commit Detection", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/workflow_injection_pr_target.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Workflow pull_request_target Injection", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/workflow_injection_pr_target.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Workflow pull_request_target Injection", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/github/workflow_modifications.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Workflow Modifications Detected", + "kind": "groupBy", + "field": "lastEvent.log.repositoryName", + "lastEventAlias": true + }, + { + "file": "rules/github/workflow_modifications.yml", + "document": 1, + "dataTypes": [ + "github" + ], + "name": "GitHub Workflow Modifications Detected", + "kind": "groupBy", + "field": "lastEvent.log.senderLogin", + "lastEventAlias": true + }, + { + "file": "rules/ibm/ibm_aix/aix_cron_persistence.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Unauthorized Crontab Modification Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_cron_persistence.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Unauthorized Crontab Modification Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_hmc_access.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Unauthorized HMC Access Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_hmc_access.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Unauthorized HMC Access Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_nim_abuse.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX NIM Master Exploitation Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_rootkit_detection.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Rootkit Indicator Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_ssh_key_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX SSH Authorized Keys Manipulation Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/aix_ssh_key_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX SSH Authorized Keys Manipulation Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/intrusion_detection_events.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Intrusion Detection Alert", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/intrusion_detection_events.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Intrusion Detection Alert", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/security_audit_subsystem_alerts.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Security Audit Subsystem Alert", + "kind": "groupBy", + "field": "lastEvent.log.eventType", + "lastEventAlias": true + }, + { + "file": "rules/ibm/ibm_aix/security_audit_subsystem_alerts.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Security Audit Subsystem Alert", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/system_integrity_violations.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX System Integrity Violation Detected", + "kind": "groupBy", + "field": "lastEvent.log.objName", + "lastEventAlias": true + }, + { + "file": "rules/ibm/ibm_aix/system_integrity_violations.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX System Integrity Violation Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/trusted_computing_base_events.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Trusted Computing Base Violation", + "kind": "groupBy", + "field": "lastEvent.log.objName", + "lastEventAlias": true + }, + { + "file": "rules/ibm/ibm_aix/trusted_computing_base_events.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Trusted Computing Base Violation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/trusted_execution_violations.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Trusted Execution Violation", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_aix/trusted_execution_violations.yml", + "document": 1, + "dataTypes": [ + "ibm-aix" + ], + "name": "IBM AIX Trusted Execution Violation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_audit_journal_disable.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Audit Journal Disabling Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_audit_journal_disable.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Audit Journal Disabling Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_exit_point_tampering.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Exit Point Tampering Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_exit_point_tampering.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Exit Point Tampering Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_ifs_access.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Unauthorized IFS Access Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_ifs_access.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Unauthorized IFS Access Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_job_queue_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Job Queue Manipulation Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_job_queue_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Job Queue Manipulation Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_library_list_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Library List Manipulation Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_library_list_manipulation.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Library List Manipulation Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_program_adopt_abuse.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Program Adopt Authority Abuse Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_program_adopt_abuse.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Program Adopt Authority Abuse Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_remote_command.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Remote Command Execution Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_remote_command.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 Remote Command Execution Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/ibm/ibm_as_400/as400_sql_injection.yml", + "document": 1, + "dataTypes": [ + "ibm-as400" + ], + "name": "IBM AS/400 SQL Injection via ODBC/JDBC Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/deserialization_attacks.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Unsafe Deserialization Attack Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/deserialization_attacks.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Unsafe Deserialization Attack Detected", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/graphql_abuse.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "GraphQL Abuse Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/graphql_abuse.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "GraphQL Abuse Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/json_hijacking_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSON Hijacking Attempt Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/json_hijacking_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSON Hijacking Attempt Detected", + "kind": "groupBy", + "field": "target.domain", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/json_injection_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSON Injection Attack Attempt", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/json_injection_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSON Injection Attack Attempt", + "kind": "groupBy", + "field": "target.hostname", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/jsonp_vulnerabilities.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSONP Vulnerability Exploitation Detected", + "kind": "groupBy", + "field": "lastEvent.log.url_path", + "lastEventAlias": true + }, + { + "file": "rules/json/json-input/jsonp_vulnerabilities.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JSONP Vulnerability Exploitation Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/jwt_algorithm_confusion.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JWT Algorithm Confusion Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/jwt_algorithm_confusion.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JWT Algorithm Confusion Attack Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/jwt_token_security_issues.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JWT Token Security Issue Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/jwt_token_security_issues.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "JWT Token Security Issue Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/mass_assignment_attack.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Mass Assignment Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/mass_assignment_attack.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Mass Assignment Attack Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/nosql_injection_json.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "NoSQL Injection via JSON Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/nosql_injection_json.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "NoSQL Injection via JSON Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/prototype_pollution_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Prototype Pollution Attempt Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/json/json-input/prototype_pollution_attempts.yml", + "document": 1, + "dataTypes": [ + "json-input" + ], + "name": "Prototype Pollution Attempt Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/attempt_to_disable_syslog_service.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Attempt to Disable Syslog Service", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/attempt_to_disable_syslog_service.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Attempt to Disable Syslog Service", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/bruteforce_attack.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Possible Brute Force Attack", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/chattr_immutable_file.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: File made Immutable by Chattr", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/chattr_immutable_file.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: File made Immutable by Chattr", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/auditd_syslog_disabling.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Audit or Logging Service Disabled", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/auditd_syslog_disabling.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Audit or Logging Service Disabled", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/container_escape_techniques.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Container Escape Technique Detected", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/container_escape_techniques.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Container Escape Technique Detected", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/crontab_persistence.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Crontab Persistence Mechanism Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/debian_kernel_exploits.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Debian-Specific Kernel Exploit Attempts", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/debian_kernel_exploits.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Debian-Specific Kernel Exploit Attempts", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/debian_specific_rootkits.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Debian-Specific Rootkits", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/ebpf_rootkit_detection.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "eBPF Rootkit Activity Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/etc_shadow_access.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Unauthorized /etc/shadow or /etc/passwd Access", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/etc_shadow_access.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Unauthorized /etc/shadow or /etc/passwd Access", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/kernel_exploit_indicators.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Kernel Exploit Indicators Detected", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/kernel_exploit_indicators.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Kernel Exploit Indicators Detected", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/ld_preload_hijacking.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "LD_PRELOAD Hijacking Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/process_masquerading.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Process Masquerading Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/reverse_shell_detection.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Reverse Shell Execution Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/shell_rc_file_modification.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Shell RC File Modification for Persistence", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/ssh_authorized_keys_modification.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "SSH Authorized Keys Modification", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/ssh_tunneling_port_forwarding.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "SSH Tunneling or Port Forwarding Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/suid_sgid_binary_creation.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "SUID/SGID Binary Creation Detected", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/suid_sgid_binary_creation.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "SUID/SGID Binary Creation Detected", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/suspicious_binary_in_tmp.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Suspicious Binary Execution from Temporary Directory", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/debian_family/systemd_timer_persistence.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Systemd Timer Persistence Mechanism", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/disable_selinux_attempt.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential Disabling of SELinux", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/disable_selinux_attempt.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential Disabling of SELinux", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/file_deletion_via_shred.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: File Deletion via Shred", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/file_deletion_via_shred.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: File Deletion via Shred", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/file_transfer_or_listener_established_via_netcat.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: File Transfer or Listener Established via Netcat", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/insmod_kernel_module_load.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Kernel module load via insmod", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/insmod_kernel_module_load.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Kernel module load via insmod", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/kde_autostart_modification.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Persistence via KDE AutoStart Script or Desktop File Modification", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/kernel_module_removal.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Kernel Module Removal", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_hping_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Hping Process Activity", + "kind": "deduplicateBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_hping_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Hping Process Activity", + "kind": "deduplicateBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_iodine_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential DNS Tunneling via Iodine", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_iodine_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential DNS Tunneling via Iodine", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_nping_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Nping Process Activity", + "kind": "deduplicateBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/linux_nping_activity.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Nping Process Activity", + "kind": "deduplicateBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/log_files_deleted.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: System Log File Deletion", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/log_files_deleted.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: System Log File Deletion", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/modify_ssh_binaries.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Modification of OpenSSH Binaries", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/perl_tty_shell.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Interactive Terminal Spawned via Perl", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/pkexec_envar_hijack.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential Privilege Escalation via PKEXEC", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/python_tty_shell.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Interactive Terminal Spawned via Python", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/reverse_shell_via_named_pipe.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Reverse Shell Created via Named Pipe", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/boot_loader_attacks.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL Boot Loader Attack Detection", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/container_platform_attacks.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Container Platform Security Attacks", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/openshift_security_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "OpenShift Security Violations", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/openshift_security_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "OpenShift Security Violations", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/rhel_kernel_exploits.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL-Specific Kernel Exploitation Attempt", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/rhel_kernel_exploits.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL-Specific Kernel Exploitation Attempt", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/rhel_specific_malware.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL-Specific Malware Detection", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/rpm_database_tampering.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RPM Database Tampering Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/rpm_database_tampering.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RPM Database Tampering Detection", + "kind": "groupBy", + "field": "target.file", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/secure_boot_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL Secure Boot Violation Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/secure_boot_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "RHEL Secure Boot Violation Detection", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/selinux_policy_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Critical SELinux Policy Violation", + "kind": "groupBy", + "field": "lastEvent.log.scontext", + "lastEventAlias": true + }, + { + "file": "rules/linux/rhel_family/selinux_policy_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Critical SELinux Policy Violation", + "kind": "groupBy", + "field": "lastEvent.log.tcontext", + "lastEventAlias": true + }, + { + "file": "rules/linux/rhel_family/selinux_policy_violations.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "Critical SELinux Policy Violation", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/systemd_unit_file_attacks.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "SystemD Unit File Attack Detected", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/rhel_family/yum_dnf_repository_attacks.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "YUM/DNF Repository Manipulation Attack", + "kind": "groupBy", + "field": "lastEvent.log.comm", + "lastEventAlias": true + }, + { + "file": "rules/linux/rhel_family/yum_dnf_repository_attacks.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "YUM/DNF Repository Manipulation Attack", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/linux/tc_bpf_filter.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: BPF filter applied using TC", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/linux/tc_bpf_filter.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: BPF filter applied using TC", + "kind": "groupBy", + "field": "origin.user", + "lastEventAlias": false + }, + { + "file": "rules/linux/tunneling_via_earthworm.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Potential Protocol Tunneling via EarthWorm", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/unshare_namesapce_manipulation.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: Namespace Manipulation Using Unshare", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/linux/user_added_to_admin_group.yml", + "document": 1, + "dataTypes": [ + "linux" + ], + "name": "System Linux: A user has been added to the administrators group", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/macos/admin_group_addition.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "User Added to Admin Group via dscl", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/admin_group_addition.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "User Added to Admin Group via dscl", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/apple_script_abuse.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Apple Script Abuse Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/apple_script_abuse.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Apple Script Abuse Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/browser_child_process_exploitation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Browser Child Process on macOS", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/browser_child_process_exploitation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Browser Child Process on macOS", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/cron_job_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Cron Job Persistence", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/cron_job_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Cron Job Persistence", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/dylib_hijacking.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Dynamic Library Hijacking Detected", + "kind": "groupBy", + "field": "lastEvent.log.eventMessage", + "lastEventAlias": true + }, + { + "file": "rules/macos/dylib_hijacking.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Dynamic Library Hijacking Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/endpoint_security_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Endpoint Security Framework Bypass Attempt", + "kind": "groupBy", + "field": "lastEvent.log.process", + "lastEventAlias": true + }, + { + "file": "rules/macos/endpoint_security_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Endpoint Security Framework Bypass Attempt", + "kind": "groupBy", + "field": "lastEvent.system.hostname", + "lastEventAlias": true + }, + { + "file": "rules/macos/folder_action_scripts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Folder Actions Script Abuse", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/folder_action_scripts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Folder Actions Script Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/gatekeeper_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Gatekeeper Bypass Attempt Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/gatekeeper_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Gatekeeper Bypass Attempt Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/gatekeeper_xattr_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Gatekeeper Bypass via Quarantine Attribute Removal", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/gatekeeper_xattr_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Gatekeeper Bypass via Quarantine Attribute Removal", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/gui_input_capture.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "GUI Input Capture via Fake Password Dialog", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/gui_input_capture.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "GUI Input Capture via Fake Password Dialog", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/hidden_user_creation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Hidden User Account Creation on macOS", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/hidden_user_creation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Hidden User Account Creation on macOS", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/jxa_in_memory_execution.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "JXA In-Memory Execution Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/jxa_in_memory_execution.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "JXA In-Memory Execution Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/kernel_extension_loading.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Kernel Extension Loading Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/kernel_extension_loading.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Kernel Extension Loading Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_access_violations.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Access Violations Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_access_violations.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Access Violations Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_credential_dumping.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Credential Dumping Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_credential_dumping.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Credential Dumping Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_dumping_cli.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Credential Dumping via CLI", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/keychain_dumping_cli.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Keychain Credential Dumping via CLI", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/launch_agent_daemon_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Launch Agent/Daemon Persistence Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventMessage", + "lastEventAlias": true + }, + { + "file": "rules/macos/launch_agent_daemon_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Launch Agent/Daemon Persistence Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/login_items_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Login Items Persistence Modification", + "kind": "groupBy", + "field": "lastEvent.log.eventMessage", + "lastEventAlias": true + }, + { + "file": "rules/macos/login_items_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Login Items Persistence Modification", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/macos_ransomware_indicators.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Ransomware Indicators", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/macos_ransomware_indicators.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Ransomware Indicators", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/notarization_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Notarization Bypass Attempt Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/notarization_bypass_attempts.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Notarization Bypass Attempt Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/office_macro_exploitation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Office Application Child Process on macOS", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/office_macro_exploitation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Suspicious Office Application Child Process on macOS", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/osascript_encoded_execution.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Osascript Encoded or Suspicious Execution", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/osascript_encoded_execution.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Osascript Encoded or Suspicious Execution", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/plistbuddy_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "PlistBuddy Persistence via RunAtLoad", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/plistbuddy_persistence.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "PlistBuddy Persistence via RunAtLoad", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/privacy_preferences_tampering.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Privacy Preferences (TCC) Database Tampering", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/privacy_preferences_tampering.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Privacy Preferences (TCC) Database Tampering", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/root_account_enable.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Root Account Enabled", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/root_account_enable.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Root Account Enabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/security_tools_disabling.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Security Tools Disabled", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/security_tools_disabling.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS Security Tools Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/shell_profile_modification.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Shell Profile Modification for Persistence", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/shell_profile_modification.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Shell Profile Modification for Persistence", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/ssh_key_theft.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "SSH Private Key Theft Attempt", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/ssh_key_theft.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "SSH Private Key Theft Attempt", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/sudo_caching_abuse.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Sudo Credential Caching Abuse", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/sudo_caching_abuse.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Sudo Credential Caching Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/system_integrity_protection_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "System Integrity Protection (SIP) Bypass Attempt", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/system_integrity_protection_bypass.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "System Integrity Protection (SIP) Bypass Attempt", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/system_log_clearing.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS System Log Clearing Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/system_log_clearing.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "macOS System Log Clearing Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/tcc_database_manipulation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "TCC Database Manipulation Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/tcc_database_manipulation.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "TCC Database Manipulation Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/time_machine_backup_deletion.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Time Machine Backup Deletion Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/time_machine_backup_deletion.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "Time Machine Backup Deletion Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/wizardupdate_malware.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "WizardUpdate Malware Indicators Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/wizardupdate_malware.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "WizardUpdate Malware Indicators Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/xcsset_malware.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "XCSSET Malware Indicators Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/macos/xcsset_malware.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "XCSSET Malware Indicators Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/macos/xprotect_evasion.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "XProtect Evasion or Tampering Detected", + "kind": "groupBy", + "field": "lastEvent.log.process", + "lastEventAlias": true + }, + { + "file": "rules/macos/xprotect_evasion.yml", + "document": 1, + "dataTypes": [ + "macos" + ], + "name": "XProtect Evasion or Tampering Detected", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/dns_cache_poisoning.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "DNS Cache Poisoning Attempt", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/dns_cache_poisoning.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "DNS Cache Poisoning Attempt", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_dns_redirection.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik DNS Static Entry Redirection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_dns_redirection.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik DNS Static Entry Redirection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_socks_proxy.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik SOCKS Proxy Enablement Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_socks_proxy.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik SOCKS Proxy Enablement Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_user_creation.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik New Admin User Creation", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/mikrotik_user_creation.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "MikroTik New Admin User Creation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/routeros_brute_force_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "RouterOS Multiple Authentication Failures", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/mikrotik/mikrotik_fw/ssh_brute_force_attempts.yml", + "document": 1, + "dataTypes": [ + "firewall-mikrotik" + ], + "name": "SSH Brute Force Attack on MikroTik Device", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/beaconing_behavior_detection.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "C2 Beaconing Behavior Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/beaconing_behavior_detection.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "C2 Beaconing Behavior Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/data_exfiltration_indicators.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Data Exfiltration Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/data_exfiltration_indicators.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Data Exfiltration Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/ddos_traffic_patterns.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "DDoS Attack Pattern Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_cryptomining_traffic.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Cryptocurrency Mining Pool Traffic Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_cryptomining_traffic.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Cryptocurrency Mining Pool Traffic Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_doh_detection.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "DNS-over-HTTPS (DoH) Traffic Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_doh_detection.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "DNS-over-HTTPS (DoH) Traffic Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_icmp_tunnel.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "ICMP Tunneling Detection via NetFlow", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_icmp_tunnel.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "ICMP Tunneling Detection via NetFlow", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_internal_scanning.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Internal Network Host Scanning Detection", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_lateral_movement_smb_rdp.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Internal SMB/RDP Lateral Movement Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_lateral_movement_smb_rdp.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Internal SMB/RDP Lateral Movement Detection", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_long_duration_connections.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Abnormally Long-Lived Network Connection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_long_duration_connections.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Abnormally Long-Lived Network Connection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_long_duration_connections.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Abnormally Long-Lived Network Connection", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_vpn_unusual_destinations.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "VPN Protocol to Non-Corporate Destination", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_vpn_unusual_destinations.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "VPN Protocol to Non-Corporate Destination", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/netflow_vpn_unusual_destinations.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "VPN Protocol to Non-Corporate Destination", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/netflow/port_scanning_patterns.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Port Scanning Activity Detection", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/port_scanning_patterns.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Port Scanning Activity Detection", + "kind": "deduplicateBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/netflow/tor_usage_detection.yml", + "document": 1, + "dataTypes": [ + "netflow" + ], + "name": "Tor Network Usage Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/baby_shark_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Baby Shark C2 Communication Pattern Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/baby_shark_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Baby Shark C2 Communication Pattern Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/base64_dns_queries.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Base64-Encoded DNS Query Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/base64_dns_queries.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Base64-Encoded DNS Query Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/base64_encoded_user_agent.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Base64-Encoded User Agent String Detected", + "kind": "groupBy", + "field": "lastEvent.log.http.http_user_agent", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/base64_encoded_user_agent.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Base64-Encoded User Agent String Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/cobalt_strike_dns_beacon.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cobalt Strike DNS Beacon Pattern Detected", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/cobalt_strike_dns_beacon.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cobalt Strike DNS Beacon Pattern Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/cobalt_strike_malleable_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cobalt Strike Malleable C2 Profile Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/cobalt_strike_malleable_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cobalt Strike Malleable C2 Profile Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/command_and_control_traffic.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Command and Control Traffic Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/command_and_control_traffic.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Command and Control Traffic Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/command_and_control_traffic.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Command and Control Traffic Detection", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/covert_channel_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Covert Channel Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/covert_channel_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Covert Channel Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/data_exfiltration_patterns.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Data Exfiltration Pattern Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/data_exfiltration_patterns.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Data Exfiltration Pattern Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/ddos_attack_patterns.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DDoS Attack Patterns", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/ddos_attack_patterns.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DDoS Attack Patterns", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/dns_mining_pool_lookups.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cryptocurrency Mining Pool DNS Lookup Detected", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/dns_mining_pool_lookups.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Cryptocurrency Mining Pool DNS Lookup Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/dns_oob_interaction_domains.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS Query to Out-of-Band Interaction Domain", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/dns_oob_interaction_domains.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS Query to Out-of-Band Interaction Domain", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/dns_tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS Tunneling Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/dns_tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS Tunneling Detection", + "kind": "groupBy", + "field": "target.domain", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/dns_txt_execution_strings.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS TXT Record Contains Execution Strings", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/dns_txt_execution_strings.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "DNS TXT Record Contains Execution Strings", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/exploit_attempt_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Attempt Detection", + "kind": "groupBy", + "field": "lastEvent.log.alert.signature", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/exploit_attempt_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Attempt Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/exploit_attempt_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Attempt Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/exploit_framework_user_agents.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Framework User Agent Detected in HTTP Traffic", + "kind": "groupBy", + "field": "lastEvent.log.http.http_user_agent", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/exploit_framework_user_agents.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Framework User Agent Detected in HTTP Traffic", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/exploit_framework_user_agents.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Exploit Framework User Agent Detected in HTTP Traffic", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/hacktool_user_agents.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Hack Tool User Agent Detected in HTTP Traffic", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/hacktool_user_agents.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Hack Tool User Agent Detected in HTTP Traffic", + "kind": "deduplicateBy", + "field": "lastEvent.log.http.http_user_agent", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/icmp_tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "ICMP Tunneling Detection via Suricata", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/icmp_tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "ICMP Tunneling Detection via Suricata", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/ipfs_credential_harvesting.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "IPFS-Based Credential Harvesting Page Access", + "kind": "groupBy", + "field": "lastEvent.log.http.hostname", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/ipfs_credential_harvesting.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "IPFS-Based Credential Harvesting Page Access", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/lateral_movement_indicators.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Lateral Movement Indicators", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/lateral_movement_indicators.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Lateral Movement Indicators", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/lateral_movement_indicators.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Lateral Movement Indicators", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/malware_callbacks.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malware Callback Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/malware_callbacks.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malware Callback Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/malware_callbacks.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malware Callback Detection", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/malware_user_agent_strings.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Known Malware User Agent String Detected", + "kind": "groupBy", + "field": "lastEvent.log.http.http_user_agent", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/malware_user_agent_strings.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Known Malware User Agent String Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_arp_spoofing.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "ARP Spoofing Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_arp_spoofing.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "ARP Spoofing Detection", + "kind": "groupBy", + "field": "adversary.mac", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_ja3_threat_matching.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "JA3 Fingerprint Threat Intelligence Match", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_ja3_threat_matching.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "JA3 Fingerprint Threat Intelligence Match", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_malicious_file_downloads.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malicious File Download Detection", + "kind": "groupBy", + "field": "lastEvent.log.alert.signature", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/nids_malicious_file_downloads.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malicious File Download Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_malicious_file_downloads.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Malicious File Download Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_ssh_anomalies.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "SSH Brute Force and Tunneling Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_ssh_anomalies.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "SSH Brute Force and Tunneling Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_tls_certificate_anomalies.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "TLS Certificate Anomaly Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nids_tls_certificate_anomalies.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "TLS Certificate Anomaly Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/nkn_blockchain_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "NKN Blockchain C2 Communication Detected", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/nkn_blockchain_c2.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "NKN Blockchain C2 Communication Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/port_scan_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Port Scan Detection", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/port_scan_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Port Scan Detection", + "kind": "deduplicateBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/pwndrop_file_hosting.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "PwnDrop File Hosting Server Access Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/pwndrop_file_hosting.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "PwnDrop File Hosting Server Access Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/rclone_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Rclone Data Exfiltration Tool Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/rclone_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Rclone Data Exfiltration Tool Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/threat_intelligence_iocs.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Threat Intelligence IOC Match", + "kind": "groupBy", + "field": "lastEvent.log.threat_type", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/threat_intelligence_iocs.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Threat Intelligence IOC Match", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/tor_proxy_dns_lookups.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Tor Proxy/Gateway DNS Lookup Detected", + "kind": "groupBy", + "field": "lastEvent.log.dns.query", + "lastEventAlias": true + }, + { + "file": "rules/nids/suricata/tor_proxy_dns_lookups.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Tor Proxy/Gateway DNS Lookup Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Tunneling Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/nids/suricata/tunneling_detection.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Tunneling Detection", + "kind": "groupBy", + "field": "target.port", + "lastEventAlias": false + }, + { + "file": "rules/office365/anti_phishing_policy_bypasses.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Anti-Phishing Policy Bypass Detected", + "kind": "groupBy", + "field": "lastEvent.log.Operation", + "lastEventAlias": true + }, + { + "file": "rules/office365/anti_phishing_policy_bypasses.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Anti-Phishing Policy Bypass Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/app_consent_grants.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 App Consent Grants Detected", + "kind": "groupBy", + "field": "lastEvent.log.appAccessContextClientAppId", + "lastEventAlias": true + }, + { + "file": "rules/office365/app_consent_grants.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 App Consent Grants Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/audit_log_tampering.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Audit Log Tampering Detection", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/audit_log_tampering.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Audit Log Tampering Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/azure_ad_integration_events.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Azure AD Integration Suspicious Activity", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/azure_ad_integration_events.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Azure AD Integration Suspicious Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/collection_microsoft_365_new_inbox_rule.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 New Inbox Rule Created", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/collection_microsoft_365_new_inbox_rule.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 New Inbox Rule Created", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/compliance_alert_patterns.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Compliance Alert Activity", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/compliance_alert_patterns.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Compliance Alert Activity", + "kind": "groupBy", + "field": "lastEvent.log.ObjectId", + "lastEventAlias": true + }, + { + "file": "rules/office365/compliance_alert_patterns.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Compliance Alert Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/conditional_access_bypasses.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Conditional Access Bypass Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/conditional_access_bypasses.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Conditional Access Bypass Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/credential_access_microsoft_365_potential_password_spraying_attack.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Potential Password Spraying of Microsoft 365 User Accounts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/credential_access_microsoft_365_potential_password_spraying_attack.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Potential Password Spraying of Microsoft 365 User Accounts", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/credential_access_user_excessive_sso_logon_errors.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Excessive Single Sign-On Logon Errors", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/credential_access_user_excessive_sso_logon_errors.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Excessive Single Sign-On Logon Errors", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Malware Filter Policy Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Malware Filter Policy Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Malware Filter Rule Modification", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_malware_filter_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Malware Filter Rule Modification", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Safe Attachment Rule Disabled", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/defense_evasion_microsoft_365_exchange_safe_attach_rule_disabled.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Safe Attachment Rule Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/detection_of_a_connection_to_onion_domain.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Detection of a connection to a .onion domain", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/detection_of_a_connection_to_onion_domain.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Detection of a connection to a .onion domain", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/dlp_policy_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Data Loss Prevention Policy Violation", + "kind": "groupBy", + "field": "lastEvent.log.PolicyId", + "lastEventAlias": true + }, + { + "file": "rules/office365/dlp_policy_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Data Loss Prevention Policy Violation", + "kind": "groupBy", + "field": "lastEvent.log.SensitiveInfoTypeData", + "lastEventAlias": true + }, + { + "file": "rules/office365/dlp_policy_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Data Loss Prevention Policy Violation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/ediscovery_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "eDiscovery Abuse Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/exchange_admin_changes.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Exchange Admin Configuration Changes", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/exchange_admin_changes.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Exchange Admin Configuration Changes", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/exfiltration_microsoft_365_exchange_transport_rule_creation.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Transport Rule Creation", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/exfiltration_microsoft_365_exchange_transport_rule_creation.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Transport Rule Creation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/exfiltration_microsoft_365_exchange_transport_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Transport Rule Modification", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/exfiltration_microsoft_365_exchange_transport_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Transport Rule Modification", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/external_sharing_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious External Sharing Activity", + "kind": "groupBy", + "field": "lastEvent.log.ObjectId", + "lastEventAlias": true + }, + { + "file": "rules/office365/external_sharing_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious External Sharing Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/forms_sway_phishing.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Forms and Sway Phishing Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/guest_user_invitation_spikes.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Abnormal Guest User Invitation Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/information_barriers_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Information Barriers Policy Violation", + "kind": "groupBy", + "field": "lastEvent.log.TargetUser", + "lastEventAlias": true + }, + { + "file": "rules/office365/information_barriers_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Information Barriers Policy Violation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Anti-Phish Policy Deletion", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_anti_phish_policy_deletion.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Anti-Phish Policy Deletion", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_anti_phish_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Anti-Phish Rule Modification", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_anti_phish_rule_mod.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Anti-Phish Rule Modification", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_safelinks_disabled.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Safe Link Policy Disabled", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/initial_access_microsoft_365_exchange_safelinks_disabled.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Exchange Safe Link Policy Disabled", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/insider_risk_indicators.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Insider Risk Indicator Detection", + "kind": "groupBy", + "field": "lastEvent.log.PolicyName", + "lastEventAlias": true + }, + { + "file": "rules/office365/insider_risk_indicators.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Insider Risk Indicator Detection", + "kind": "groupBy", + "field": "lastEvent.log.RiskLevel", + "lastEventAlias": true + }, + { + "file": "rules/office365/insider_risk_indicators.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Insider Risk Indicator Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/m365_data_exfiltration_unsanctioned.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 Data Exfiltration to Unsanctioned Application", + "kind": "groupBy", + "field": "lastEvent.log.Parameters", + "lastEventAlias": true + }, + { + "file": "rules/office365/m365_data_exfiltration_unsanctioned.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 Data Exfiltration to Unsanctioned Application", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/m365_federated_domain_added.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 New Federated Domain Added", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/m365_oauth_app_file_downloads.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 Suspicious OAuth Application File Downloads", + "kind": "groupBy", + "field": "lastEvent.log.Parameters", + "lastEventAlias": true + }, + { + "file": "rules/office365/m365_oauth_app_file_downloads.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 Suspicious OAuth Application File Downloads", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/m365_pst_export.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "M365 Mailbox PST Export Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mail_flow_rule_changes.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mail Flow Rule Modified", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/mail_flow_rule_changes.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mail Flow Rule Modified", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mail_forwarding_rules.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Mail Forwarding Rule Creation", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/mail_forwarding_rules.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Mail Forwarding Rule Creation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mailbox_delegation_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mailbox Delegation Abuse", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mailbox_delegation_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mailbox Delegation Abuse", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mailbox_export_pst.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mailbox Export to PST", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/mailbox_export_pst.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Mailbox Export to PST", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mass_email_deletion.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Mass Email Deletion Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/mfa_fatigue_push_spam.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "MFA Fatigue Push Spam Attack Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/mfa_fatigue_push_spam.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "MFA Fatigue Push Spam Attack Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/multi_geo_data_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Multi-Geo Data Violations", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/multi_geo_data_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Multi-Geo Data Violations", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/o365-admin-role-assignment.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Admin Role Assignment", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/o365-admin-role-assignment.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Admin Role Assignment", + "kind": "groupBy", + "field": "lastEvent.log.ObjectId", + "lastEventAlias": true + }, + { + "file": "rules/office365/o365-admin-role-granted.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Admin Role/Permission Granted", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/o365-audit-log-purge.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Audit Log Purge", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/o365-inbox-forward-rule-exfiltration.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "O365 Inbox Forward Rule with Email Exfiltration", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/oauth_app_anomalies.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 OAuth Application Anomalous Activity", + "kind": "groupBy", + "field": "lastEvent.log.appAccessContextClientAppId", + "lastEventAlias": true + }, + { + "file": "rules/office365/oauth_app_anomalies.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 OAuth Application Anomalous Activity", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/onedrive_mass_file_access.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "OneDrive Mass File Access Detected", + "kind": "deduplicateBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/onedrive_mass_file_access.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "OneDrive Mass File Access Detected", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/possible_succesfull_password_guessing_o365.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Possible Successful Password Guessing detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/possible_succesfull_password_guessing_o365.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft 365 Possible Successful Password Guessing detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/power_apps_data_leaks.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Power Apps Data Connector Suspicious Activity", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/power_apps_data_leaks.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Power Apps Data Connector Suspicious Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/power_automate_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Power Automate Flow Activity", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/power_automate_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Power Automate Flow Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/power_bi_data_export.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Power BI Suspicious Data Export", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/safe_attachment_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Safe Attachment Policy Violation", + "kind": "groupBy", + "field": "lastEvent.action", + "lastEventAlias": true + }, + { + "file": "rules/office365/safe_attachment_violations.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Office 365 Safe Attachment Policy Violation", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/safe_links_click_patterns.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Safe Links Click Pattern Anomaly", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/service_principal_credential_addition.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Service Principal Credential Addition", + "kind": "groupBy", + "field": "lastEvent.log.Parameters", + "lastEventAlias": true + }, + { + "file": "rules/office365/service_principal_credential_addition.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Service Principal Credential Addition", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/sharepoint_mass_downloads.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "SharePoint Mass File Download Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/sharepoint_mass_downloads.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "SharePoint Mass File Download Detected", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/sharepoint_permission_escalation.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "SharePoint Permission Escalation Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/sharepoint_permission_escalation.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "SharePoint Permission Escalation Detection", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/suspicious_inbox_rules.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Email Forwarding Rule Created", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/teams_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Teams Message Export Activity", + "kind": "groupBy", + "field": "lastEvent.log.appAccessContextClientAppId", + "lastEventAlias": true + }, + { + "file": "rules/office365/teams_data_exfiltration.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Suspicious Teams Message Export Activity", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/teams_external_user_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft Teams External User Phishing Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/office365/teams_external_user_abuse.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Microsoft Teams External User Phishing Detection", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/threat_intelligence_alerts.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Threat Intelligence Alert Pattern", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/office365/threat_intelligence_alerts.yml", + "document": 1, + "dataTypes": [ + "o365" + ], + "name": "Threat Intelligence Alert Pattern", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/ioc_threat_intel_match.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "IOC Match from Threat Intelligence Feed", + "kind": "groupBy", + "field": "lastEvent.log.panOSThreatID", + "lastEventAlias": true + }, + { + "file": "rules/paloalto/pa_firewall/ioc_threat_intel_match.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "IOC Match from Threat Intelligence Feed", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/ioc_threat_intel_match.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "IOC Match from Threat Intelligence Feed", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_admin_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Management Plane Login Brute Force", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_admin_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Management Plane Login Brute Force", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_dns_security_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS DNS Security Alert Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_dns_security_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS DNS Security Alert Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Spyware and Vulnerability Threat Detection", + "kind": "groupBy", + "field": "lastEvent.log.pa_threatid", + "lastEventAlias": true + }, + { + "file": "rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Spyware and Vulnerability Threat Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_spyware_vulnerability.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Spyware and Vulnerability Threat Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Malicious URL Category Block", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/panos_url_filtering_blocks.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "PAN-OS Malicious URL Category Block", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/wildfire_malware_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "WildFire Malware Detection", + "kind": "groupBy", + "field": "lastEvent.log.pa_threatid", + "lastEventAlias": true + }, + { + "file": "rules/paloalto/pa_firewall/wildfire_malware_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "WildFire Malware Detection", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/wildfire_malware_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "WildFire Malware Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "Zero-Day Exploit Prevention", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/paloalto/pa_firewall/zero_day_exploit_prevention.yml", + "document": 1, + "dataTypes": [ + "firewall-paloalto" + ], + "name": "Zero-Day Exploit Prevention", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/pfsense/dns_resolver_cache_poisoning.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "DNS Resolver Cache Poisoning Attempt", + "kind": "groupBy", + "field": "lastEvent.log.query_name", + "lastEventAlias": true + }, + { + "file": "rules/pfsense/dns_resolver_cache_poisoning.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "DNS Resolver Cache Poisoning Attempt", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/pfsense/pfsense_admin_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "pfSense WebGUI Authentication Brute Force", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/pfsense/pfsense_admin_brute_force.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "pfSense WebGUI Authentication Brute Force", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/pfsense/snort_suricata_ids_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "pfSense Snort/Suricata IDS Alerts", + "kind": "groupBy", + "field": "lastEvent.log.eventType", + "lastEventAlias": true + }, + { + "file": "rules/pfsense/snort_suricata_ids_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-pfsense" + ], + "name": "pfSense Snort/Suricata IDS Alerts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/anti_spyware_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Anti-Spyware Detection", + "kind": "deduplicateBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/anti_spyware_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Anti-Spyware Detection", + "kind": "deduplicateBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/botnet_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Botnet Activity Detected", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/botnet_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Botnet Activity Detected", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/capture_atp_verdicts.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Capture ATP Malicious Verdict", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/capture_atp_verdicts.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Capture ATP Malicious Verdict", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/gateway_antivirus_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Gateway Anti-Virus Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/gateway_antivirus_detection.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Gateway Anti-Virus Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/intrusion_prevention_alert.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Intrusion Prevention System Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/intrusion_prevention_alert.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Intrusion Prevention System Alert", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/sonicwall_admin_auth_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Management Interface Authentication Failures", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/sonicwall_admin_auth_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall Management Interface Authentication Failures", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/sonicwall_vpn_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall SSL VPN Authentication Failures", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sonicwall/sonicwall_firewall/sonicwall_vpn_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sonicwall" + ], + "name": "SonicWall SSL VPN Authentication Failures", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/behavioral_analysis_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Behavioral Analysis Alert", + "kind": "groupBy", + "field": "lastEvent.log.processPath", + "lastEventAlias": true + }, + { + "file": "rules/sophos/sophos_central/behavioral_analysis_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Behavioral Analysis Alert", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/endpoint_threat_detection.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Endpoint Threat Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/endpoint_threat_detection.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Endpoint Threat Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/exploit_prevention_triggers.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Exploit Prevention Triggered", + "kind": "groupBy", + "field": "lastEvent.log.name", + "lastEventAlias": true + }, + { + "file": "rules/sophos/sophos_central/exploit_prevention_triggers.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Exploit Prevention Triggered", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/managed_threat_response_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Managed Threat Response Critical Alert", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/managed_threat_response_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Managed Threat Response Critical Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/ransomware_detection.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Ransomware Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/ransomware_detection.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Ransomware Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/server_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Server Protection Alerts", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/server_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Server Protection Alerts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_app_hijacking_prevented.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Application Hijacking prevented in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_app_hijacking_prevented.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Application Hijacking prevented in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_credential_theft_attack_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Credential Theft Attemp detected in Sophos Central", + "kind": "groupBy", + "field": "target.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_credential_theft_attack_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Credential Theft Attemp detected in Sophos Central", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_device_compromised.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Potentially compromised or blocked device detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_device_compromised.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Potentially compromised or blocked device detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_exploit_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Probable attempt to exploit vulnerabilities detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_exploit_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Probable attempt to exploit vulnerabilities detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_malware_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Malware detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_malware_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Malware detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_man_in_the_middle_attack_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Man in the Middle Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_man_in_the_middle_attack_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Man in the Middle Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_possible_botnet_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Botnet detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_possible_botnet_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Botnet detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_possible_brute_force_attack.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Brute Force Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_possible_brute_force_attack.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Brute Force Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_potential_password_spraying_attack.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Potential Password Spraying Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_potential_password_spraying_attack.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Potential Password Spraying Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_ransomware_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Ransomware Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_ransomware_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Possible Ransomware Attack detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_real_time_protection_disabled.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Real Time Protection disabled in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_real_time_protection_disabled.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Real Time Protection disabled in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_unknown_threat_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Unknown Threat detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/sophos_central_unknown_threat_detected.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Unknown Threat detected in Sophos Central", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/tamper_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Tamper Protection Alert", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_central/tamper_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "sophos-central" + ], + "name": "Sophos Central Tamper Protection Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/advanced_threat_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG Advanced Threat Protection Alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/advanced_threat_protection_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG Advanced Threat Protection Alert", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_denial_of_service.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos denial of service (DoS) attack", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_denial_of_service.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos denial of service (DoS) attack", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_firewall_probable_malware_detected.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable malware detected by sophos firewall", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_firewall_probable_malware_detected.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable malware detected by sophos firewall", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_high_severity_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos detected high priority alerts", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_high_severity_alerts.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos detected high priority alerts", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_initial_access_by_guest_account.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos initial access vulnerability", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_initial_access_by_guest_account.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos initial access vulnerability", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_ip_spoofing_attack.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos ip spoofing attack", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_ip_spoofing_attack.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable Sophos ip spoofing attack", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_password_guessing_on_administrator_account.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable password guessing in Sophos Administrator account", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_password_guessing_on_administrator_account.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Probable password guessing in Sophos Administrator account", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_xg_ips_signatures.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG IPS Alert Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_xg_ips_signatures.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG IPS Alert Detection", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_xg_vpn_auth_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG VPN Authentication Failures", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/sophos/sophos_xg_firewall/sophos_xg_vpn_auth_failures.yml", + "document": 1, + "dataTypes": [ + "firewall-sophos-xg" + ], + "name": "Sophos XG VPN Authentication Failures", + "kind": "groupBy", + "field": "adversary.user", + "lastEventAlias": false + }, + { + "file": "rules/suricata/high_severity_suricata_alerts_were_detected.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "High level Suricata alert", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/suricata/high_severity_suricata_alerts_were_detected.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "High level Suricata alert", + "kind": "groupBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/suricata/medium_severity_suricata_alerts_were_detected.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Medium level Suricata alert", + "kind": "deduplicateBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/suricata/medium_severity_suricata_alerts_were_detected.yml", + "document": 1, + "dataTypes": [ + "suricata" + ], + "name": "Medium level Suricata alert", + "kind": "deduplicateBy", + "field": "target.ip", + "lastEventAlias": false + }, + { + "file": "rules/syslog/cef/file_hash_mismatches.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF File Hash Mismatch Detection", + "kind": "groupBy", + "field": "lastEvent.log.fname", + "lastEventAlias": true + }, + { + "file": "rules/syslog/cef/file_hash_mismatches.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF File Hash Mismatch Detection", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/syslog/cef/syslog_source_impersonation.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF Source Impersonation Detection", + "kind": "groupBy", + "field": "lastEvent.log.deviceVendor", + "lastEventAlias": true + }, + { + "file": "rules/syslog/cef/syslog_source_impersonation.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF Source Impersonation Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/syslog/cef/user_agent_anomalies.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF User Agent Anomaly Detection", + "kind": "groupBy", + "field": "lastEvent.log.requestClientApplication", + "lastEventAlias": true + }, + { + "file": "rules/syslog/cef/user_agent_anomalies.yml", + "document": 1, + "dataTypes": [ + "syslog" + ], + "name": "CEF User Agent Anomaly Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_account_manipulation.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Local Account Manipulation Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_disk_theft.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Virtual Disk Theft Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_disk_theft.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Virtual Disk Theft Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_firewall_modification.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Firewall Rule Modification Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_host_compromise.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Host Compromise Indicators", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_ransomware_detection.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Ransomware Attack Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_ssh_access.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Direct SSH Login Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_ssh_access.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Direct SSH Login Detection", + "kind": "groupBy", + "field": "adversary.ip", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_syslog_disruption.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Syslog Forwarding Disruption Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/esxi_vib_sideloading.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "ESXi Unsigned VIB Installation Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/hypervisor_escape_attempts.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "VMware ESXi Hypervisor Escape Attempt Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/powercli_script_execution.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "PowerCLI Script Execution Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/vcenter_server_attacks.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "VMware vCenter Server Attack Indicators", + "kind": "groupBy", + "field": "adversary.host", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/vm_escape_detection.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "Virtual Machine Escape Detection", + "kind": "groupBy", + "field": "lastEvent.log.process", + "lastEventAlias": true + }, + { + "file": "rules/vmware/vmware-esxi/vm_escape_detection.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "Virtual Machine Escape Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/vmware_tools_vulnerabilities.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "VMware Tools Vulnerability Exploitation", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/vmware/vmware-esxi/vsphere_api_abuse.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "vSphere API Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventInfo", + "lastEventAlias": true + }, + { + "file": "rules/vmware/vmware-esxi/vsphere_api_abuse.yml", + "document": 1, + "dataTypes": [ + "vmware-esxi" + ], + "name": "vSphere API Abuse Detection", + "kind": "groupBy", + "field": "adversary.hostname", + "lastEventAlias": false + }, + { + "file": "rules/windows/adfs_authentication_anomalies.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "ADFS Authentication Anomalies", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/adfs_authentication_anomalies.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "ADFS Authentication Anomalies", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/adminsdholder_abuse.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "AdminSDHolder Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventDataObjectName", + "lastEventAlias": true + }, + { + "file": "rules/windows/adminsdholder_abuse.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "AdminSDHolder Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventDataSubjectUserName", + "lastEventAlias": true + }, + { + "file": "rules/windows/asrep_roasting_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "AS-REP Roasting Attack Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/asrep_roasting_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "AS-REP Roasting Attack Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/audit_log_was_cleared.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows audit log was cleared", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/audit_log_was_cleared.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows audit log was cleared", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/audit_or_event_log_tampering.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Audit Policy or Event Log Tampering", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_attack.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible Brute Force Attack", + "kind": "deduplicateBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_attack.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible Brute Force Attack", + "kind": "deduplicateBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_attack.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible Brute Force Attack", + "kind": "deduplicateBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_multiple_logon_failure_followed_by_success.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Multiple Logon Failure Followed by Logon Success", + "kind": "deduplicateBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_multiple_logon_failure_followed_by_success.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Multiple Logon Failure Followed by Logon Success", + "kind": "deduplicateBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/bruteforce_multiple_logon_failure_followed_by_success.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Multiple Logon Failure Followed by Logon Success", + "kind": "deduplicateBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/certificate_services_abuse.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Certificate Services Abuse Detection", + "kind": "groupBy", + "field": "lastEvent.log.eventDataSubjectUserName", + "lastEventAlias": true + }, + { + "file": "rules/windows/certificate_services_abuse.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Certificate Services Abuse Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/credential_dumping_tool_indicators.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Credential Dumping Tool Indicators", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/golden_ticket_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Golden Ticket Attack Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/golden_ticket_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Golden Ticket Attack Detection", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/kerberoasting_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Kerberoasting Attack Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/kerberoasting_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Kerberoasting Attack Detection", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/lolbin_proxy_execution.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: LOLBin Proxy Execution / Ingress Tool Transfer", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/lsass_memdump_handle_access.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: LSASS Memory Dump Handle Access", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/lsass_memdump_handle_access.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: LSASS Memory Dump Handle Access", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/masquerading_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Process Masquerading Detection", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/ntds_extraction_attempts.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "NTDS.dit Extraction Attempt", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/ntlm_downgrade_attack.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "NTLM Authentication Downgrade Attack", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/office_application_spawned_shell.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Office Application Spawned Command or Script Interpreter", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/possible_exploit_over_reverse_tunneling_using_stolen_credentials.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: User logged using Remote Desktop Connection from loopback address, possible exploit over reverse tunneling using stolen credentials", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/possible_exploit_over_reverse_tunneling_using_stolen_credentials.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: User logged using Remote Desktop Connection from loopback address, possible exploit over reverse tunneling using stolen credentials", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/possible_remote_code_execution_using_printernightmare.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Printer driver failed to load, possible remote code execution using PrinterNightmare exploit: CVE-2021-34527", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/powershell_profiles.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Persistence via PowerShell profile", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/printspooler_service_suspicious_file.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Suspicious PrintSpooler Service Executable File Creation", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/printspooler_suspicious_spl_file.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Suspicious Print Spooler SPL File Created", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/ransom_inhibit_system_recovery.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Ransomware Recovery Inhibition (Shadow Copy / Backup Deletion)", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/ransom_multiple_file_deletion.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible ransomware attack detected. Multiple File Deletion.", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/ransom_multiple_file_deletion.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible ransomware attack detected. Multiple File Deletion.", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/ransom_note_creation.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible ransomware attack detected. Ransomware Note Creation.", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/ransom_unusual_file_extension.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Possible ransomware attack detected. Unusual File Extensions.", + "kind": "deduplicateBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/remote_file_copy_desktopimgdownldr.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Remote File Download via Desktopimgdownldr Utility", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/sam_database_access.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SAM Database Access Attempt", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/sam_database_access.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SAM Database Access Attempt", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/sid_history_injection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SID History Injection Attempt", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/sid_history_injection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SID History Injection Attempt", + "kind": "groupBy", + "field": "target.user", + "lastEventAlias": false + }, + { + "file": "rules/windows/silver_ticket_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Silver Ticket Attack Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/silver_ticket_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Silver Ticket Attack Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/smbv1_usage_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SMBv1 Usage Detection", + "kind": "groupBy", + "field": "origin.host", + "lastEventAlias": false + }, + { + "file": "rules/windows/smbv1_usage_detection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "SMBv1 Usage Detection", + "kind": "groupBy", + "field": "origin.ip", + "lastEventAlias": false + }, + { + "file": "rules/windows/suspicious_event_as_the_binary_may_have_been_dropped_using_windows_dmin_shares.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: New Windows Service Created to start from windows root path. Suspicious event as the binary may have been dropped using Windows Admin Shares", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/suspicious_powershell_obfuscation.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Suspicious PowerShell (Encoded / Download Cradle / AMSI Bypass)", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/suspicious_scheduled_task_created.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Suspicious Scheduled Task Created", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/uac_bypass_dll_sideloading.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: UAC Bypass Attempt via Privileged IFileOperation COM Interface", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/unusual_dns_service_file_writes.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Unusual File Modification by dns.exe", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/unusual_process_network_connection.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows: Unusual Process Network Connection", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + }, + { + "file": "rules/windows/windows_remote_management_abuse.yml", + "document": 1, + "dataTypes": [ + "wineventlog" + ], + "name": "Windows Remote Management (WinRM) Abuse", + "kind": "groupBy", + "field": "dataSource", + "lastEventAlias": false + } + ] +} diff --git a/plugins/alerts/audits/grouping-rollout.md b/plugins/alerts/audits/grouping-rollout.md new file mode 100644 index 000000000..96b726c42 --- /dev/null +++ b/plugins/alerts/audits/grouping-rollout.md @@ -0,0 +1,127 @@ +# Alert grouping and deduplication rollout review + +This draft changes runtime alert grouping across technologies. Keep it separate +from technology filter corrections and obtain rollout approval after the checks +below. No customer configuration was changed or deployment performed for this +review. + +## Correct query and value paths + +The wire `plugins.Alert` carries `events[]`. The indexed `AlertFields` document +adds `lastEvent` from the final event. Therefore a rule's +`lastEvent.origin.user` grouping key must produce an OpenSearch query on that +indexed path while reading its value from the final wire event. Preserve these +two representations; do not replace rule YAML paths with `events.0.*`. + +Both `isDuplicate` and `getPreviousAlertId` now share `addAlertGroupingTerms`. +It preserves indexed keys, strips positional array selectors only from the +indexed query path, and rejects null/missing/object/array values. No usable key +means the caller does not execute a name-only search. Other usable keys on the +same rule still participate; rejecting one array field does **not** imply the +whole rule remains unaffected. + +Source evidence: + +- [Pinned go-sdk v1.1.31 Alert schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto) +- [Pinned v11 alert plugin](https://github.com/utmstack/UTMStack/blob/660c796f168670fd6ccb079995c09c46d4f0068d/plugins/alerts/main.go) +- Local regression tests: `plugins/alerts/grouping_test.go`. + +## Exact static scope + +[`grouping-inventory-v11.json`](grouping-inventory-v11.json) is generated from +**v11 commit `660c796f168670fd6ccb079995c09c46d4f0068d`**, not the working tree. +It records every configured grouping/deduplication path, its rule file/name, +configuration kind and data types. YAML parsing excludes occurrences in prose, +`where`, and historical event queries. + +| Measurement | Count | +|---|---:| +| YAML rule files scanned | 635 | +| Files with any groupBy/deduplicateBy setting | 622 | +| All configured field occurrences | 1,177 | +| Files with at least one `lastEvent.*` key | 231 | +| Of those, groupBy files | 227 | +| Of those, deduplicateBy files | 4 | +| `lastEvent.*` occurrences | 309 | +| Distinct `lastEvent.*` paths | 126 | + +The 231 files are **potential query changes**, not 231 proven live activations. +They may be disabled on an instance, receive no qualifying events, or use absent +or non-scalar values. Actual values, existing working grouping keys, and deployed +rule revisions determine the result. The scalar guard also applies to other +configured paths, which is why the inventory includes all 622 configured files. +A static inventory cannot establish the full runtime population affected by that +guard. + +| Rule directory | Files using `lastEvent.*` | +|---|---:| +| antivirus | 50 | +| cisco | 4 | +| cloud | 91 | +| crowdstrike | 13 | +| fortinet | 2 | +| github | 13 | +| ibm | 3 | +| json | 1 | +| linux | 2 | +| macos | 5 | +| nids | 14 | +| office365 | 19 | +| paloalto | 3 | +| pfsense | 2 | +| sophos | 2 | +| syslog | 3 | +| vmware | 2 | +| windows | 2 | + +Reproduce with Python 3 and PyYAML from the repository root: + +```sh +python3 plugins/alerts/audits/grouping_inventory.py \ + 660c796f168670fd6ccb079995c09c46d4f0068d \ + > /tmp/grouping-inventory-v11.json +cmp plugins/alerts/audits/grouping-inventory-v11.json /tmp/grouping-inventory-v11.json +``` + +In a partial clone, reading pinned rule blobs can download missing public +repository objects. The script never queries customer instances or modifies git. + +## Validation completed and limits + +Offline tests serialize real SDK alerts with multiple events, build actual SDK +BoolBuilder term clauses, and check that final-event values appear under indexed +`lastEvent.*` names. They cover `.keyword` input suffixes, positional array member +selection, numeric zero, boolean false, older-event-only fields, missing events, +and non-scalars. Query tests use no index list to avoid network access. They do +not prove deployed index mappings or automatic `.keyword` resolution. + +The synthetic filter-normalization harness is separate from these runtime query +construction tests. Passing fixtures do not establish closed EventProcessor raw +extraction, deployed filter/rule parity, history search results, or actual alert +generation. Fixtures without `rules` assertions establish no rule match at all. +Do not describe a green module test run as live detection validation. + +## Separate rollout gates — pending + +1. Pin the deployed plugin, active rule definitions and index mappings on a + selected staging system. Compare its active rules with the inventory; include + site-specific rules and direct keys that may contain arrays/objects. +2. Use the **same ordered sanitized stream and equivalent isolated starting + alert indices** to compare old and candidate grouping behavior. Avoid comparing + unrelated calendar windows. Preserve the seven-day deduplication horizon and + grouping's parent/orphan lookup semantics. +3. Record per-rule candidate alerts, saved alerts, duplicate suppressions, parent + assignments, group cardinality and key presence/type. Compare resolved final- + event values and generated indexed query fields. Verify unrelated users, hosts + and targets do not become a single group. +4. Include multi-event alerts; missing/non-scalar keys; one valid plus one missing + key; repeated keys; numeric/boolean values; array members; mappings with/without + `.keyword` subfields. Prioritize populated scalar `lastEvent.*` paths. +5. Investigate every unexplained change in stored alert counts. Approve intended + per-rule changes and a plugin-image/configuration rollback procedure before + production rollout. SOC notification and deployment require separate user + authorization; neither was sent or performed here. + +**Pending:** controlled staging replay, actual indexed-query matching, per-rule +before/after alert volume and grouping review, and rollout approval. Customer +access during the maintenance review remains read-only. diff --git a/plugins/alerts/audits/grouping_inventory.py b/plugins/alerts/audits/grouping_inventory.py new file mode 100644 index 000000000..601547354 --- /dev/null +++ b/plugins/alerts/audits/grouping_inventory.py @@ -0,0 +1,73 @@ +#!/usr/bin/env python3 +"""Inventory grouping paths from a fixed git revision, not the working tree. + +Requires PyYAML. Writes JSON to stdout; does not connect to instances or modify git. +""" +import argparse +from collections import Counter +import io +import json +from pathlib import Path +import subprocess +import tarfile + +import yaml + + +def git(*args): + root = Path(__file__).resolve().parents[3] + return subprocess.check_output(['git', '-C', str(root), *args]) + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('revision', help='Reviewed base commit/ref (recorded as a full SHA)') + args = parser.parse_args() + revision = git('rev-parse', '--verify', args.revision + '^{commit}').decode().strip() + records = [] + rule_files = 0 + with tarfile.open(fileobj=io.BytesIO(git('archive', revision, 'rules'))) as archive: + for member in sorted(archive.getmembers(), key=lambda item: item.name): + if not member.isfile() or not member.name.endswith(('.yml', '.yaml')): + continue + rule_files += 1 + for document, rule in enumerate(yaml.safe_load_all(archive.extractfile(member)), 1): + if not isinstance(rule, dict): + raise ValueError(f'{member.name}: expected one rule mapping per YAML document') + for kind in ('groupBy', 'deduplicateBy'): + for field in rule.get(kind) or []: + if not isinstance(field, str): + raise ValueError(f'{member.name}: non-string {kind} path') + records.append({ + 'file': member.name, + 'document': document, + 'dataTypes': rule.get('dataTypes', []), + 'name': rule.get('name', ''), + 'kind': kind, + 'field': field, + 'lastEventAlias': field.startswith('lastEvent.'), + }) + aliases = [record for record in records if record['lastEventAlias']] + affected_files = sorted({record['file'] for record in aliases}) + result = { + 'revision': revision, + 'scope': 'YAML groupBy and deduplicateBy only; references in descriptions, where and history queries excluded', + 'ruleFilesScanned': rule_files, + 'configuredRuleFiles': len({record['file'] for record in records}), + 'configuredFieldOccurrences': len(records), + 'lastEventRuleFiles': len(affected_files), + 'lastEventFieldOccurrences': len(aliases), + 'lastEventDistinctPaths': len({record['field'] for record in aliases}), + 'lastEventRuleFilesByKind': { + kind: len({r['file'] for r in aliases if r['kind'] == kind}) + for kind in ('groupBy', 'deduplicateBy') + }, + 'lastEventRuleFilesByDirectory': dict(sorted(Counter(path.split('/')[1] for path in affected_files).items())), + 'runtimeStatus': 'Potential query changes only. Scalar value presence, deployed rules and alert-volume impact are not established by static inventory.', + 'fields': records, + } + print(json.dumps(result, indent=2, ensure_ascii=False)) + + +if __name__ == '__main__': + main() diff --git a/plugins/alerts/filter_contract_test.go b/plugins/alerts/filter_contract_test.go new file mode 100644 index 000000000..2ecbe260a --- /dev/null +++ b/plugins/alerts/filter_contract_test.go @@ -0,0 +1,254 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" + "path/filepath" + "regexp" + "strings" + "testing" + "time" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/reflect/protoreflect" +) + +func contractPaths(d protoreflect.MessageDescriptor, prefix string, out map[string]bool) { + for i := 0; i < d.Fields().Len(); i++ { + f := d.Fields().Get(i) + p := prefix + f.JSONName() + out[p] = true + if f.Message() != nil && !f.IsMap() && !strings.HasPrefix(string(f.Message().FullName()), "google.protobuf.") { + contractPaths(f.Message(), p+".", out) + } + } +} + +// The documented Draft lifecycle finalizes after every step has run. Unknown +// top-level scratch namespaces are permitted only with unconditional whole-root +// cleanup as the final step of that same stage. Children of known schema namespaces are never +// exempted, even if a cleanup happens to name them. +func contractTemporaryRoots(steps []*plugins.Step, eventPaths map[string]bool) map[string]bool { + out := map[string]bool{} + if len(steps) == 0 { + return out + } + cleanup := steps[len(steps)-1].Delete + if cleanup == nil || cleanup.Where != "" { + return out + } + for _, p := range cleanup.Fields { + if p != "" && !strings.Contains(p, ".") && !eventPaths[p] { + out[p] = true + } + } + return out +} + +// Manifests let independent technology fixes validate their own producers and +// consumers without requiring unrelated, not-yet-merged normalization fixes. +func TestFilterAndRuleContracts(t *testing.T) { + selected := map[string]bool{} + for _, manifest := range loadFilterContracts(t) { + for _, p := range append(manifest.Filters, manifest.Rules...) { + if _, err := os.Stat(filepath.Join("../..", p)); err != nil { + t.Fatal(err) + } + selected[filepath.Clean(filepath.Join("../..", p))] = true + } + } + all := os.Getenv("UTMSTACK_CONTRACT_ALL") == "1" + + eventPaths := map[string]bool{} + alertPaths := map[string]bool{} + contractPaths(new(plugins.Event).ProtoReflect().Descriptor(), "", eventPaths) + contractPaths(new(plugins.Alert).ProtoReflect().Descriptor(), "", alertPaths) + arrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`) + eventPath := func(p string) bool { + p = strings.TrimSuffix(p, ".keyword") + p = arrayIndex.ReplaceAllString(p, "$1") + return eventPaths[p] || strings.HasPrefix(p, "log.") || strings.HasPrefix(p, "compliance.") + } + alertPath := func(p string) bool { + p = strings.TrimSuffix(p, ".keyword") + if strings.HasPrefix(p, "lastEvent.") { + return eventPath(strings.TrimPrefix(p, "lastEvent.")) + } + p = arrayIndex.ReplaceAllString(p, "$1") + return alertPaths[p] + } + cache := plugins.NewCELCache("filter-rule-contract-test") + sample := `{"log":{"messageId":0,"severity":0},"origin":{},"target":{},"action":"","actionResult":"","protocol":"","severity":"","connectionStatus":"","raw":"","dataType":"","dataSource":"","deviceTime":"","tenantId":"","tenantName":"","statusCode":0}` + var expressions func(*testing.T, any) + expressions = func(t *testing.T, v any) { + switch n := v.(type) { + case map[string]any: + for k, x := range n { + if k == "where" { + if w, ok := x.(string); ok && w != "" { + _, err := cache.Eval(w, sample) + // Direct selectors can fail on this empty sample after a successful compile. + // Their presence is not a syntax error or evidence that parsed logs fail. + if err != nil && !strings.Contains(err.Error(), "failed to evaluate program") { + t.Errorf("CEL compilation: %v", err) + } + } + } else { + expressions(t, x) + } + } + case []any: + for _, x := range n { + expressions(t, x) + } + } + } + for _, dir := range []string{"filters", "rules"} { + err := filepath.WalkDir(filepath.Join("../..", dir), func(path string, d os.DirEntry, err error) error { + if err != nil { + return err + } + if d.IsDir() || (filepath.Ext(path) != ".yml" && filepath.Ext(path) != ".yaml") { + return nil + } + if !all && !selected[filepath.Clean(path)] { + return nil + } + t.Run(path, func(t *testing.T) { + b, err := utils.ReadPbYaml(path) + if err != nil { + t.Fatal(err) + } + var doc any + if err = json.Unmarshal(b, &doc); err != nil { + t.Fatal(err) + } + expressions(t, doc) + if dir == "filters" { + cfg := new(plugins.Config) + if err = protojson.Unmarshal(b, cfg); err != nil { + t.Fatal(err) + } + for _, stage := range cfg.Pipeline { + temporary := contractTemporaryRoots(stage.Steps, eventPaths) + for _, step := range stage.Steps { + fields := []string{} + if s := step.Rename; s != nil { + fields = append(fields, s.To) + } + if s := step.Grok; s != nil { + for _, p := range s.Patterns { + if p.FieldName != "" { // Empty grok names are non-capturing separators. + fields = append(fields, p.FieldName) + } + } + } + if s := step.Csv; s != nil { + fields = append(fields, s.Headers...) + } + if s := step.Add; s != nil { + fields = append(fields, s.Params["key"].GetStringValue()) + } + if s := step.Cast; s != nil { + fields = append(fields, s.Fields...) + } + for _, p := range fields { + if !eventPath(p) && !temporary[strings.SplitN(p, ".", 2)[0]] { + t.Errorf("unknown event write/cast field %q", p) + } + } + } + } + } else { + rule := new(plugins.Rule) + if err = protojson.Unmarshal(b, rule); err != nil { + t.Fatal(err) + } + rule.Normalize() + if len(rule.GroupBy) > 0 && len(rule.DeduplicateBy) > 0 { + t.Error("groupBy and deduplicateBy are mutually exclusive") + } + if rule.Adversary != "" && rule.Adversary != "origin" && rule.Adversary != "target" { + t.Errorf("unknown adversary %s", rule.Adversary) + } + for _, p := range append(rule.GroupBy, rule.DeduplicateBy...) { + if !alertPath(p) { + t.Errorf("unknown alert grouping field %q", p) + } + } + var checkSearch func([]*plugins.SearchRequest) + checkSearch = func(searches []*plugins.SearchRequest) { + for _, s := range searches { + if s.Within != "" { + if _, err := time.ParseDuration(s.Within); err != nil { + t.Error(err) + } + } + for _, x := range s.With { + valid := eventPath(x.Field) + if strings.Contains(s.IndexPattern, "-alert-") { + valid = alertPath(x.Field) + } + if !valid { + t.Errorf("unknown search field %q", x.Field) + } + if x.Value == nil { + t.Errorf("missing search value for %s", x.Field) + continue + } + v := x.Value.GetStringValue() + if strings.HasPrefix(v, "{{.") && strings.HasSuffix(v, "}}") { + p := strings.TrimSuffix(strings.TrimPrefix(v, "{{."), "}}") + if !eventPath(p) { + t.Errorf("unknown event placeholder %q", p) + } + } + switch x.Operator { + case "filter_term", "filter_match", "must_not_term", "must_not_match": + default: + t.Error(fmt.Sprintf("unknown search operator %s", x.Operator)) + } + } + checkSearch(s.Or) + } + } + checkSearch(rule.Correlation) + } + }) + return nil + }) + if err != nil { + t.Fatal(err) + } + } +} + +func TestContractTemporaryRoots(t *testing.T) { + paths := map[string]bool{} + contractPaths(new(plugins.Event).ProtoReflect().Descriptor(), "", paths) + for _, tc := range []struct { + name string + steps []*plugins.Step + want bool + }{ + {"final whole root", []*plugins.Step{{Delete: &plugins.Delete{Fields: []string{"scratch", "origin.hostname", "origin", "raw"}}}}, true}, + {"conditional", []*plugins.Step{{Delete: &plugins.Delete{Fields: []string{"scratch"}, Where: "false"}}}, false}, + {"not final", []*plugins.Step{{Delete: &plugins.Delete{Fields: []string{"scratch"}}}, {}}, false}, + {"no cleanup", nil, false}, + } { + t.Run(tc.name, func(t *testing.T) { + got := contractTemporaryRoots(tc.steps, paths) + if got["scratch"] != tc.want { + t.Error("scratch cleanup classification") + } + for _, invalid := range []string{"origin.hostname", "origin", "raw"} { + if got[invalid] { + t.Errorf("schema field exempted %s", invalid) + } + } + }) + } +} diff --git a/plugins/alerts/filter_history_placeholders_test.go b/plugins/alerts/filter_history_placeholders_test.go new file mode 100644 index 000000000..e4dc206ba --- /dev/null +++ b/plugins/alerts/filter_history_placeholders_test.go @@ -0,0 +1,61 @@ +package main + +import ( + "fmt" + "strings" + "testing" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/tidwall/gjson" + "google.golang.org/protobuf/types/known/structpb" +) + +// fixtureHistoryPlaceholders is an opt-in, all-branch preflight. The SDK may not +// visit an OR branch when the parent count passes, so this is deliberately not +// applied to every positive rule fixture. It proves value availability only; +// technology tests must exercise SearchRequest.Execute for query/threshold proof. +func fixtureHistoryPlaceholders(searches []*plugins.SearchRequest, event string) []string { + var issues []string + var visit func([]*plugins.SearchRequest, string) + visit = func(requests []*plugins.SearchRequest, path string) { + for i, request := range requests { + location := fmt.Sprintf("%s[%d]", path, i) + for j, expression := range request.With { + if expression.Value == nil { + issues = append(issues, fmt.Sprintf("%s.with[%d]: nil value", location, j)) + continue + } + value := expression.Value.GetStringValue() + if strings.HasPrefix(value, "{{.") && strings.HasSuffix(value, "}}") { + // Match the pinned SDK's exact-token placeholder lookup. + field := strings.ReplaceAll(strings.ReplaceAll(value, "{{.", ""), "}}", "") + if gjson.Get(event, field).Value() == nil { + issues = append(issues, fmt.Sprintf("%s.with[%d]: unresolved %s", location, j, value)) + } + } + } + visit(request.Or, location+".or") + } + } + visit(searches, "correlation") + return issues +} + +func TestHistoryPlaceholderPreflightIncludesNestedOr(t *testing.T) { + with := func(field string) *plugins.Expression { + return &plugins.Expression{Field: "unused-indexed-key", Value: structpb.NewStringValue("{{." + field + "}}")} + } + requests := []*plugins.SearchRequest{{ + With: []*plugins.Expression{with("origin.user")}, + Or: []*plugins.SearchRequest{{Or: []*plugins.SearchRequest{{ + With: []*plugins.Expression{with("origin.ip"), with("log.zero"), with("log.false")}, + }}}}, + }} + issues := fixtureHistoryPlaceholders(requests, `{"origin":{"user":"synthetic"},"log":{"zero":0,"false":false}}`) + if len(issues) != 1 || !strings.Contains(issues[0], "correlation[0].or[0].or[0].with[0]") || !strings.Contains(issues[0], "origin.ip") { + t.Fatalf("expected only nested missing IP, got %v", issues) + } + if issues := fixtureHistoryPlaceholders(requests, `{"origin":{"user":"synthetic","ip":"192.0.2.1"},"log":{"zero":0,"false":false}}`); len(issues) != 0 { + t.Fatal(issues) + } +} diff --git a/plugins/alerts/filter_manifest_test.go b/plugins/alerts/filter_manifest_test.go new file mode 100644 index 000000000..4ed3c94b6 --- /dev/null +++ b/plugins/alerts/filter_manifest_test.go @@ -0,0 +1,42 @@ +package main + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" +) + +type filterContract struct { + Technology string `json:"technology"` + Filters []string `json:"filters"` + Rules []string `json:"rules"` + Fixtures []Fixture `json:"fixtures"` +} + +func loadFilterContracts(t *testing.T) []filterContract { + t.Helper() + paths, err := filepath.Glob("testdata/filter-contracts/*.json") + if err != nil { + t.Fatal(err) + } + if len(paths) == 0 { + t.Fatal("no filter contract manifests") + } + var out []filterContract + for _, p := range paths { + data, err := os.ReadFile(p) + if err != nil { + t.Fatal(err) + } + var manifest filterContract + if err := json.Unmarshal(data, &manifest); err != nil { + t.Fatalf("%s: %v", p, err) + } + if manifest.Technology == "" || len(manifest.Filters) == 0 || len(manifest.Fixtures) == 0 { + t.Fatalf("%s: technology, filters and fixtures are required", p) + } + out = append(out, manifest) + } + return out +} diff --git a/plugins/alerts/filter_normalization_test.go b/plugins/alerts/filter_normalization_test.go new file mode 100644 index 000000000..10a1ebe4b --- /dev/null +++ b/plugins/alerts/filter_normalization_test.go @@ -0,0 +1,331 @@ +package main + +// This is a normalization-stage model, NOT the closed EventProcessor parser. +// It uses the real SDK for YAML decoding, CEL evaluation and final Event conversion. +// Synthetic-input fixtures skip complex grok, CSV, KV, JSON and dynamic plugins. +// Opt-in raw fixtures model JSON decoding/key sanitization and reject unsupported +// executed steps. Only one-field {{.greedy}}, (.*) and (?s:.*) copy captures are modeled. +import ( + "encoding/json" + "fmt" + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "github.com/tidwall/gjson" + "google.golang.org/protobuf/encoding/protojson" + "path/filepath" + "reflect" + "regexp" + "strconv" + "strings" + "testing" +) + +type Fixture struct { + Name string `json:"name"` + Filter string `json:"filter"` + Input map[string]any `json:"input"` + Raw *string `json:"raw"` + DataType string `json:"dataType"` + DataSource string `json:"dataSource"` + Expected map[string]any `json:"expected"` + Absent []string `json:"absent"` + Rules map[string]bool `json:"rules"` + CheckHistoryPlaceholders bool `json:"checkHistoryPlaceholders"` +} + +func valueAt(m map[string]any, p string) (any, bool) { + var v any = m + for _, k := range strings.Split(p, ".") { + switch n := v.(type) { + case map[string]any: + var ok bool + v, ok = n[k] + if !ok { + return nil, false + } + case []any: + i, e := strconv.Atoi(k) + if e != nil || i < 0 || i >= len(n) { + return nil, false + } + v = n[i] + default: + return nil, false + } + } + return v, true +} +func put(m map[string]any, p string, v any, remove bool) { + parts := strings.Split(p, ".") + for _, k := range parts[:len(parts)-1] { + next, ok := m[k].(map[string]any) + if !ok { + if remove { + return + } + next = map[string]any{} + m[k] = next + } + m = next + } + if remove { + delete(m, parts[len(parts)-1]) + } else { + m[parts[len(parts)-1]] = v + } +} +func normalize(root string, f Fixture, cache *plugins.CELCache) (string, []string, error) { + b, err := utils.ReadPbYaml(filepath.Join(root, "filters", f.Filter)) + if err != nil { + return "", nil, err + } + cfg := new(plugins.Config) + if err = protojson.Unmarshal(b, cfg); err != nil { + return "", nil, err + } + if (f.Raw == nil) == (f.Input == nil) { + return "", nil, fmt.Errorf("fixture requires exactly one of input or raw") + } + data, _ := json.Marshal(f.Input) + draft := map[string]any{} + json.Unmarshal(data, &draft) + if f.Raw != nil { + if f.DataType == "" || f.DataSource == "" { + return "", nil, fmt.Errorf("raw fixture requires ingress dataType and dataSource") + } + draft = map[string]any{"raw": *f.Raw, "dataType": f.DataType, "dataSource": f.DataSource} + } + issues := []string{} + matchedStage := false + for _, stage := range cfg.Pipeline { + if f.Raw != nil && len(stage.DataTypes) != 0 { + matched := false + for _, dataType := range stage.DataTypes { + matched = matched || dataType == f.DataType + } + if !matched { + continue + } + } + matchedStage = true + for i, step := range stage.Steps { + sb, _ := protojson.Marshal(step) + obj := map[string]map[string]any{} + json.Unmarshal(sb, &obj) + for kind, body := range obj { + if f.Raw == nil && (kind == "dynamic" || kind == "json" || kind == "kv" || kind == "csv" || kind == "xml" || kind == "reformat") { + continue + } + simpleGrok := step.Grok != nil && len(step.Grok.Patterns) == 1 && (step.Grok.Patterns[0].Pattern == "{{.greedy}}" || step.Grok.Patterns[0].Pattern == "(.*)" || step.Grok.Patterns[0].Pattern == "(?s:.*)") + if f.Raw == nil && kind == "grok" && !simpleGrok { + continue + } + if w, ok := body["where"].(string); ok && w != "" { + snapshot, _ := json.Marshal(draft) + match, e := cache.Eval(w, string(snapshot)) + if e != nil { + issues = append(issues, fmt.Sprintf("step %d %s: %v", i, kind, e)) + continue + } + if !match { + continue + } + } + switch kind { + case "json": + source := step.Json.Source + if source == "" { + source = "raw" + } + value, ok := valueAt(draft, source) + if !ok { + continue + } + str, ok := value.(string) + if !ok { + return "", issues, fmt.Errorf("JSON source %s is not a string", source) + } + parsed, err := fixtureJSON(str) + if err != nil { + return "", issues, err + } + for key, value := range parsed { + put(draft, "log."+key, value, false) + } + case "rename": + for _, src := range step.Rename.From { + if v, ok := valueAt(draft, src); ok { + put(draft, step.Rename.To, v, false) + put(draft, src, nil, true) + break + } + } + case "add": + p := step.Add.Params + if f.Raw != nil { + if step.Add.Function != "string" { + return "", issues, fmt.Errorf("raw model does not support add function %q", step.Add.Function) + } + if p["key"].GetStringValue() == "" || p["value"] == nil { + return "", issues, fmt.Errorf("raw model add requires key and value") + } + put(draft, p["key"].GetStringValue(), utils.CastString(p["value"].AsInterface()), false) + } else { + put(draft, p["key"].GetStringValue(), p["value"].AsInterface(), false) + } + case "delete": + for _, p := range step.Delete.Fields { + put(draft, p, nil, true) + } + case "cast": + for _, p := range step.Cast.Fields { + if v, ok := valueAt(draft, p); ok { + switch step.Cast.To { + case "int": + put(draft, p, utils.CastInt64(v), false) + case "float": + put(draft, p, utils.CastFloat64(v), false) + case "string": + put(draft, p, utils.CastString(v), false) + default: + if f.Raw != nil { + return "", issues, fmt.Errorf("raw model does not support cast %s", step.Cast.To) + } + } + } + } + case "trim": + for _, p := range step.Trim.Fields { + if v, ok := valueAt(draft, p); ok { + str, isString := v.(string) + if !isString { + continue + } + switch step.Trim.Function { + case "prefix": + str = strings.TrimPrefix(str, step.Trim.Substring) + case "suffix": + str = strings.TrimSuffix(str, step.Trim.Substring) + case "substring": + str = strings.ReplaceAll(str, step.Trim.Substring, "") + case "regex": + r, e := regexp.Compile(step.Trim.Substring) + if e == nil { + str = r.ReplaceAllString(str, "") + } else if f.Raw != nil { + return "", issues, e + } + default: + if f.Raw != nil { + return "", issues, fmt.Errorf("raw model does not support trim %s", step.Trim.Function) + } + } + put(draft, p, str, false) + } + } + case "grok": + if !simpleGrok { + return "", issues, fmt.Errorf("raw model does not support complex grok") + } + g := step.Grok + source := g.Source + if f.Raw != nil && source == "" { + source = "raw" + } + if v, ok := valueAt(draft, source); ok { + if str, ok := v.(string); ok { + if f.Raw != nil && g.Patterns[0].Pattern != "(?s:.*)" && strings.ContainsAny(str, "\r\n") { + return "", issues, fmt.Errorf("raw model does not support multiline copy grok") + } + if f.Raw != nil && g.Patterns[0].Pattern == "{{.greedy}}" && cfg.Patterns["greedy"] != "" && cfg.Patterns["greedy"] != ".*" { + return "", issues, fmt.Errorf("raw model does not support custom greedy pattern") + } + put(draft, g.Patterns[0].FieldName, str, false) + } + } + case "drop": + return "", issues, fmt.Errorf("fixture dropped") + default: + if f.Raw != nil { + return "", issues, fmt.Errorf("raw model does not support step %s", kind) + } + } + } + } + } + if f.Raw != nil && !matchedStage { + return "", issues, fmt.Errorf("no pipeline stage matches raw fixture dataType %s", f.DataType) + } + data, _ = json.Marshal(draft) + str := string(data) + event := new(plugins.Event) + if err = utils.StringToProtoMessage(&str, event); err != nil { + return str, issues, err + } + out, err := utils.ProtoMessageToString(event) + if err != nil { + return "", issues, err + } + return *out, issues, nil +} + +// TestFilterNormalization accepts synthetic extraction results or opt-in raw +// JSON model fixtures. Neither mode executes the closed EventProcessor. +func TestFilterNormalization(t *testing.T) { + var fixtures []Fixture + for _, manifest := range loadFilterContracts(t) { + fixtures = append(fixtures, manifest.Fixtures...) + } + cache := plugins.NewCELCache("filter-normalization-test") + for _, f := range fixtures { + t.Run(f.Name, func(t *testing.T) { + if f.Raw == nil { + t.Log("synthetic normalization input: raw extraction is not tested") + } else { + t.Log("raw JSON model: closed EventProcessor execution is not tested") + } + if len(f.Rules) == 0 { + t.Log("rule validation: not requested by this fixture") + } + out, issues, err := normalize("../..", f, cache) + if err != nil { + t.Fatal(err) + } + for _, issue := range issues { + t.Error(issue) + } + for p, want := range f.Expected { + got := gjson.Get(out, p) + if !got.Exists() || !reflect.DeepEqual(got.Value(), want) { + t.Errorf("%s: got %v, want %v", p, got.Value(), want) + } + } + for _, p := range f.Absent { + if gjson.Get(out, p).Exists() { + t.Errorf("unexpected %s in %s", p, out) + } + } + for path, want := range f.Rules { + b, err := utils.ReadPbYaml(filepath.Join("../..", path)) + if err != nil { + t.Fatal(err) + } + got, err := cache.Eval(gjson.GetBytes(b, "where").String(), out) + if err != nil || got != want { + t.Errorf("%s: got %v (%v), want %v", path, got, err, want) + } + if got && want && f.CheckHistoryPlaceholders { + rule := new(plugins.Rule) + if err := protojson.Unmarshal(b, rule); err != nil { + t.Fatal(err) + } + rule.Normalize() + for _, issue := range fixtureHistoryPlaceholders(rule.Correlation, out) { + t.Errorf("%s: %s", path, issue) + } + t.Log("all-branch history placeholder preflight only: queries, counts and alerts are not executed") + } + } + }) + } +} diff --git a/plugins/alerts/filter_raw_json_test.go b/plugins/alerts/filter_raw_json_test.go new file mode 100644 index 000000000..71d7eba92 --- /dev/null +++ b/plugins/alerts/filter_raw_json_test.go @@ -0,0 +1,179 @@ +package main + +import ( + "encoding/json" + "fmt" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "github.com/tidwall/gjson" +) + +// fixtureJSON models only documented JSON-to-log extraction. Key sanitization +// uses the pinned SDK. This is not the closed pipeline executor; ambiguous keys +// are rejected instead of guessing its overwrite/flattening behavior. +func fixtureJSON(raw string) (map[string]any, error) { + var parsed map[string]any + if err := json.Unmarshal([]byte(raw), &parsed); err != nil { + return nil, err + } + if parsed == nil { + return nil, fmt.Errorf("raw JSON model requires an object") + } + value, err := sanitizeFixtureJSON(parsed) + if err != nil { + return nil, err + } + return value.(map[string]any), nil +} + +func sanitizeFixtureJSON(value any) (any, error) { + switch input := value.(type) { + case map[string]any: + output := make(map[string]any, len(input)) + for key, child := range input { + utils.SanitizeField(&key) + if key == "" || strings.Contains(key, ".") { + return nil, fmt.Errorf("raw JSON model cannot establish empty/dotted key semantics: %q", key) + } + if _, exists := output[key]; exists { + return nil, fmt.Errorf("raw JSON model has sanitization collision: %q", key) + } + clean, err := sanitizeFixtureJSON(child) + if err != nil { + return nil, err + } + output[key] = clean + } + return output, nil + case []any: + output := make([]any, len(input)) + for i, child := range input { + clean, err := sanitizeFixtureJSON(child) + if err != nil { + return nil, err + } + output[i] = clean + } + return output, nil + default: + return value, nil + } +} + +func TestRawJSONFixtureNormalization(t *testing.T) { + root := t.TempDir() + if err := os.Mkdir(filepath.Join(root, "filters"), 0700); err != nil { + t.Fatal(err) + } + filter := `pipeline: + - dataTypes: [fixture-json] + steps: + - json: {source: raw} + - rename: + from: [log.SourceIP] + to: origin.ip + where: inCIDR("log.SourceIP", "0.0.0.0/0") || inCIDR("log.SourceIP", "::/0") + - rename: {from: [log.EventID], to: action} + - cast: {fields: [action], to: string} +` + if err := os.WriteFile(filepath.Join(root, "filters", "fixture.yml"), []byte(filter), 0600); err != nil { + t.Fatal(err) + } + cache := plugins.NewCELCache("raw-json-model-test") + for _, ip := range []string{"203.0.113.7", "-"} { + raw := fmt.Sprintf(`{"Source_IP":%q,"Event-ID":4769,"Nested_Items":[{"Child-Name":"preserved"}]}`, ip) + fixture := Fixture{Filter: "fixture.yml", Raw: &raw, DataType: "fixture-json", DataSource: "synthetic-host"} + out, issues, err := normalize(root, fixture, cache) + if err != nil || len(issues) != 0 { + t.Fatalf("normalize: %v / %v", err, issues) + } + if gjson.Get(out, "action").String() != "4769" || gjson.Get(out, "log.NestedItems.0.ChildName").String() != "preserved" { + t.Fatalf("JSON sanitization/normalization failed: %s", out) + } + if gjson.Get(out, "origin.ip").Exists() != (ip != "-") { + t.Fatalf("IP promotion guard failed: %s", out) + } + if ip == "-" && gjson.Get(out, "log.SourceIP").String() != "-" { + t.Fatalf("invalid vendor IP should remain at its source: %s", out) + } + fixture.Input = map[string]any{"log": map[string]any{}} + if _, _, err := normalize(root, fixture, cache); err == nil { + t.Fatal("raw and synthetic input must be mutually exclusive") + } + } + unsupported := strings.Replace(filter, "- json: {source: raw}", "- kv: {source: raw}", 1) + if err := os.WriteFile(filepath.Join(root, "filters", "fixture.yml"), []byte(unsupported), 0600); err != nil { + t.Fatal(err) + } + raw := `{"SourceIP":"203.0.113.7"}` + fixture := Fixture{Filter: "fixture.yml", Raw: &raw, DataType: "fixture-json", DataSource: "synthetic-host"} + if _, _, err := normalize(root, fixture, cache); err == nil || !strings.Contains(err.Error(), "does not support step kv") { + t.Fatalf("raw fixture must reject unsupported extraction: %v", err) + } +} + +func TestRawJSONFixtureRejectsAmbiguousInput(t *testing.T) { + for _, raw := range []string{`null`, `[]`, `{`, `{"key-name":1,"key_name":2}`, `{"source.ip":"192.0.2.1"}`, `{"!!!":1}`} { + if _, err := fixtureJSON(raw); err == nil { + t.Errorf("expected model boundary error for %s", raw) + } + } +} + +func TestRawFixtureRejectsUnsupportedAddAndMultilineGrok(t *testing.T) { + root := t.TempDir() + if err := os.Mkdir(filepath.Join(root, "filters"), 0700); err != nil { + t.Fatal(err) + } + cache := plugins.NewCELCache("raw-json-boundaries-test") + for _, function := range []string{"string", "uuid", "time", "join", ""} { + filter := fmt.Sprintf(`pipeline: + - dataTypes: [fixture-json] + steps: + - add: + function: %q + params: {key: log.literal, value: 17} +`, function) + if err := os.WriteFile(filepath.Join(root, "filters", "fixture.yml"), []byte(filter), 0600); err != nil { + t.Fatal(err) + } + raw := `{}` + fixture := Fixture{Filter: "fixture.yml", Raw: &raw, DataType: "fixture-json", DataSource: "synthetic-host"} + out, _, err := normalize(root, fixture, cache) + if function == "string" { + if err != nil || gjson.Get(out, "log.literal").Type != gjson.String || gjson.Get(out, "log.literal").String() != "17" { + t.Fatalf("add string must use SDK string conversion: %s / %v", out, err) + } + } else if err == nil || !strings.Contains(err.Error(), "does not support add function") { + t.Fatalf("unsupported add %q was silently accepted: %v", function, err) + } + } + for _, pattern := range []string{"{{.greedy}}", "(.*)", "(?s:.*)"} { + filter := fmt.Sprintf(`pipeline: + - dataTypes: [fixture-json] + steps: + - grok: + source: raw + patterns: [{fieldName: log.message, pattern: %q}] +`, pattern) + if err := os.WriteFile(filepath.Join(root, "filters", "fixture.yml"), []byte(filter), 0600); err != nil { + t.Fatal(err) + } + for _, raw := range []string{"first line\nsecond line", "first line\r\nsecond line"} { + fixture := Fixture{Filter: "fixture.yml", Raw: &raw, DataType: "fixture-json", DataSource: "synthetic-host"} + out, _, err := normalize(root, fixture, cache) + if pattern == "(?s:.*)" { + if err != nil || gjson.Get(out, "log.message").String() != raw { + t.Fatalf("explicit dot-all copy must preserve the complete message: %s / %v", out, err) + } + } else if err == nil || !strings.Contains(err.Error(), "multiline copy grok") { + t.Fatalf("multiline %s must not be treated as whole-field copy: %v", pattern, err) + } + } + } +} diff --git a/plugins/alerts/grouping.go b/plugins/alerts/grouping.go new file mode 100644 index 000000000..793ed1a33 --- /dev/null +++ b/plugins/alerts/grouping.go @@ -0,0 +1,66 @@ +package main + +import ( + "regexp" + "strconv" + "strings" + + sdkos "github.com/threatwinds/go-sdk/os" + "github.com/tidwall/gjson" +) + +var groupingArrayIndex = regexp.MustCompile(`\.[0-9]+(\.|$)`) + +// addAlertGroupingTerms keeps indexed query paths separate from wire value +// paths. Both grouping and deduplication use this same query construction. +// False means there is no usable key: callers must not run a name-only search. +func addAlertGroupingTerms(builder *sdkos.BoolBuilder, alertJSON string, fields []string) bool { + added := false + for _, field := range fields { + field = strings.TrimSuffix(field, ".keyword") + value, ok := scalarGroupingValue(alertGroupingValue(alertJSON, field)) + if !ok { + continue + } + // OpenSearch flattens array elements under the indexed field name. + searchField := groupingArrayIndex.ReplaceAllStringFunc(field, func(index string) string { + if strings.HasSuffix(index, ".") { + return "." + } + return "" + }) + builder.FilterTerm(searchField, value) + added = true + } + return added +} + +// alertGroupingValue resolves the fields that rules can use in groupBy and +// deduplicateBy. The wire Alert has events, while the indexed document exposes +// the final event as lastEvent. Resolve that alias before building the search, +// using the same event as newAlert. Keep the search field itself as lastEvent.*. +func alertGroupingValue(alertJSON, field string) gjson.Result { + if strings.HasPrefix(field, "lastEvent.") { + count := gjson.Get(alertJSON, "events.#").Int() + if count == 0 { + return gjson.Result{} + } + field = "events." + strconv.FormatInt(count-1, 10) + "." + strings.TrimPrefix(field, "lastEvent.") + } + return gjson.Get(alertJSON, field) +} + +// A map or array is not an exact-match grouping term. In particular, finding only +// a non-scalar must not enable a name-only search that groups unrelated alerts. +func scalarGroupingValue(value gjson.Result) (any, bool) { + switch value.Type { + case gjson.String: + return value.String(), true + case gjson.Number: + return value.Float(), true + case gjson.True, gjson.False: + return value.Bool(), true + default: + return nil, false + } +} diff --git a/plugins/alerts/grouping_test.go b/plugins/alerts/grouping_test.go new file mode 100644 index 000000000..a16acb719 --- /dev/null +++ b/plugins/alerts/grouping_test.go @@ -0,0 +1,154 @@ +package main + +import ( + "context" + "encoding/json" + "reflect" + "strings" + + sdkos "github.com/threatwinds/go-sdk/os" + "github.com/tidwall/gjson" + "testing" + + "github.com/threatwinds/go-sdk/plugins" + "github.com/threatwinds/go-sdk/utils" + "google.golang.org/protobuf/types/known/structpb" +) + +func TestAlertGroupingValue(t *testing.T) { + eventLog, err := structpb.NewStruct(map[string]any{"eventCode": 4625, "isFailure": true, "accounts": []any{"alice", "bob"}}) + if err != nil { + t.Fatal(err) + } + alert := &plugins.Alert{ + Adversary: &plugins.Side{Ip: "203.0.113.7"}, + Target: &plugins.Side{Host: "dc01"}, + Events: []*plugins.Event{ + {Action: "previous", Origin: &plugins.Side{User: "previous-user"}}, + {Action: "login", Origin: &plugins.Side{User: "alice"}, Log: eventLog.Fields}, + }, + } + serialized, err := utils.ProtoMessageToString(alert) + if err != nil { + t.Fatal(err) + } + for _, tc := range []struct{ field, want string }{ + {"adversary.ip", "203.0.113.7"}, {"target.host", "dc01"}, + {"lastEvent.action", "login"}, {"lastEvent.origin.user", "alice"}, + {"lastEvent.log.eventCode", "4625"}, {"lastEvent.log.isFailure", "true"}, + {"lastEvent.log.accounts.1", "bob"}, + } { + t.Run(tc.field, func(t *testing.T) { + got := alertGroupingValue(*serialized, tc.field) + if !got.Exists() || got.String() != tc.want { + t.Fatalf("got %v, want %s", got, tc.want) + } + }) + } + for _, field := range []string{"lastEvent.log.missing", "origin.ip"} { + if alertGroupingValue(*serialized, field).Exists() { + t.Errorf("unexpected value for %s", field) + } + } +} +func TestAlertGroupingValueWithoutEvents(t *testing.T) { + for _, input := range []string{`{}`, `{"events":[]}`, `{"events":[null]}`} { + if alertGroupingValue(input, "lastEvent.origin.ip").Exists() { + t.Errorf("unexpected lastEvent for %s", input) + } + } +} + +func TestScalarGroupingValue(t *testing.T) { + for _, tc := range []struct { + input string + valid bool + }{ + {`"alice"`, true}, {`0`, true}, {`false`, true}, {`true`, true}, + {`null`, false}, {`[]`, false}, {`["alice"]`, false}, {`{"user":"alice"}`, false}, + } { + if _, ok := scalarGroupingValue(gjson.Parse(tc.input)); ok != tc.valid { + t.Errorf("scalarGroupingValue(%s) = %v, want %v", tc.input, ok, tc.valid) + } + } +} + +// Exercise the same SDK query construction used by both production callers. +// Empty indices keep this unit test offline: live mapping/.keyword resolution +// remains a separate OpenSearch integration check. +func TestAlertGroupingIndexedTerms(t *testing.T) { + log, err := structpb.NewStruct(map[string]any{ + "accounts": []any{map[string]any{"id": "first"}, map[string]any{"id": "selected"}}, + "attempts": 0, "blocked": false, "object": map[string]any{"nested": true}, + }) + if err != nil { + t.Fatal(err) + } + alert := &plugins.Alert{ + Name: "Synthetic grouping contract", + Adversary: &plugins.Side{Ip: "203.0.113.7"}, + Events: []*plugins.Event{ + {Action: "previous-action", Origin: &plugins.Side{User: "previous-user", Ip: "192.0.2.2"}}, + {Action: "final-action", Origin: &plugins.Side{User: "final-user"}, Log: log.Fields}, + }, + } + wire, err := utils.ProtoMessageToString(alert) + if err != nil { + t.Fatal(err) + } + builder := sdkos.NewBoolBuilder(context.Background(), nil, "grouping-query-test") + fields := []string{ + "lastEvent.action.keyword", "lastEvent.origin.user", "adversary.ip", + "lastEvent.log.accounts.1.id.keyword", "lastEvent.log.attempts", "lastEvent.log.blocked", + "lastEvent.origin.ip", // Only present on the older event: do not fall back. + "lastEvent.log.accounts", "lastEvent.log.object", "lastEvent.log.missing", + } + if !addAlertGroupingTerms(builder, *wire, fields) { + t.Fatal("expected usable grouping terms") + } + query, errors := builder.BuildWithErrors() + if len(errors) != 0 { + t.Fatal(errors) + } + encoded, err := json.Marshal(query) + if err != nil { + t.Fatal(err) + } + terms := map[string]any{} + for _, clause := range query.Bool.Filter { + for field, term := range clause.Term { + if strings.HasPrefix(field, "events.") { + t.Errorf("wire path leaked into indexed query: %s", field) + } + terms[field] = term["value"] + } + } + want := map[string]any{ + "lastEvent.action": "final-action", "lastEvent.origin.user": "final-user", + "adversary.ip": "203.0.113.7", "lastEvent.log.accounts.id": "selected", + "lastEvent.log.attempts": float64(0), "lastEvent.log.blocked": false, + } + if !reflect.DeepEqual(terms, want) { + t.Fatalf("indexed terms differ: got %s, want %v", encoded, want) + } +} + +func TestAlertGroupingDoesNotEnableNameOnlyQuery(t *testing.T) { + for _, wire := range []string{ + `{}`, `{"events":[]}`, + `{"events":[{"action":"older"},{}]}`, + `{"events":[{"log":{"items":[1],"object":{"id":"x"},"empty":null}}]}`, + } { + builder := sdkos.NewBoolBuilder(context.Background(), nil, "grouping-query-test") + builder.FilterTerm("name", "Synthetic grouping contract") + if addAlertGroupingTerms(builder, wire, []string{ + "lastEvent.action", "lastEvent.log.items", "lastEvent.log.object", "lastEvent.log.empty", + }) { + t.Fatalf("caller would execute a name-only query for %s", wire) + } + query := builder.Build() + if len(query.Bool.Filter) != 1 { + t.Fatalf("unexpected grouping term: %v", query) + } + } +} diff --git a/plugins/alerts/main.go b/plugins/alerts/main.go index 064926285..b444bf7cc 100644 --- a/plugins/alerts/main.go +++ b/plugins/alerts/main.go @@ -3,15 +3,12 @@ package main import ( "context" "os" - "regexp" - "strings" "time" "github.com/threatwinds/go-sdk/catcher" sdkos "github.com/threatwinds/go-sdk/os" "github.com/threatwinds/go-sdk/plugins" "github.com/threatwinds/go-sdk/utils" - "github.com/tidwall/gjson" "google.golang.org/protobuf/types/known/emptypb" ) @@ -124,39 +121,7 @@ func isDuplicate(alert *plugins.Alert) bool { bb.FilterRange("@timestamp", "gte", time.Now().UTC().Add(-24*7*time.Hour).Format(time.RFC3339Nano)) bb.FilterRange("@timestamp", "lte", time.Now().UTC().Format(time.RFC3339Nano)) - // Compile regex for array index stripping - reArrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`) - - var execute bool = false - - for _, d := range alert.DeduplicateBy { - d = strings.TrimSuffix(d, ".keyword") - - value := gjson.Get(*alertString, d) - if value.Type == gjson.Null { - continue - } - - execute = true - - // Calculate OpenSearch field name by removing array indices - searchField := reArrayIndex.ReplaceAllStringFunc(d, func(s string) string { - if strings.HasSuffix(s, ".") { - return "." - } - return "" - }) - - if value.Type == gjson.String { - bb.FilterTerm(searchField, value.String()) - } else if value.Type == gjson.Number { - bb.FilterTerm(searchField, value.Float()) - } else if value.IsBool() { - bb.FilterTerm(searchField, value.Bool()) - } - } - - if !execute { + if !addAlertGroupingTerms(bb, *alertString, alert.DeduplicateBy) { return false } @@ -220,39 +185,7 @@ func getPreviousAlertId(alert *plugins.Alert) *string { // Original logic: MustNot exists field "parentId" bb.MustNotExists("parentId") - // Compile regex for array index stripping - reArrayIndex := regexp.MustCompile(`\.[0-9]+(\.|$)`) - - var execute bool = false - - for _, d := range alert.GroupBy { - d = strings.TrimSuffix(d, ".keyword") - - value := gjson.Get(*alertString, d) - if value.Type == gjson.Null { - continue - } - - execute = true - - // Calculate OpenSearch field name by removing array indices - searchField := reArrayIndex.ReplaceAllStringFunc(d, func(s string) string { - if strings.HasSuffix(s, ".") { - return "." - } - return "" - }) - - if value.Type == gjson.String { - bb.FilterTerm(searchField, value.String()) - } else if value.Type == gjson.Number { - bb.FilterTerm(searchField, value.Float()) - } else if value.IsBool() { - bb.FilterTerm(searchField, value.Bool()) - } - } - - if !execute { + if !addAlertGroupingTerms(bb, *alertString, alert.GroupBy) { return nil } diff --git a/plugins/alerts/testdata/filter-contracts/README.md b/plugins/alerts/testdata/filter-contracts/README.md new file mode 100644 index 000000000..f8be7ff42 --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/README.md @@ -0,0 +1,31 @@ +# Filter and rule contracts + +Each technology draft adds one independent JSON manifest with the filter paths, +all matching shipped rule paths, and synthetic normalization cases. The shared +runner discovers manifests automatically, so technology PRs do not duplicate Go +helpers or unrelated changes. Merge this test support before relying on `go test` +to execute those manifests. Technology YAML changes remain separate. + +Run `go test ./...` from `plugins/alerts`. To check every filter and rule after the +technology corrections are combined, run `UTMSTACK_CONTRACT_ALL=1 go test ./...`. +Before those corrections merge, the all-files mode intentionally reports existing +schema and CEL defects in uncorrected technologies. + +Contract tests use the pinned go-sdk v1.1.31 protobuf descriptors and CEL functions. +They check config keys, explicit output paths, Event versus Alert namespaces, +correlation search/placeholder paths, supported operators, and CEL compilation. +Normalization fixtures supply **synthetic extraction results**. The model handles +rename, add, delete, selected casts, trim and one-field copy captures, followed by +real SDK Event conversion and actual rule trigger evaluation. It skips complex +grok, JSON/KV/XML/CSV extraction, timestamp reformatting and dynamic plugins. + +These tests do not replace raw-log replay through the EventProcessor or historical +OpenSearch/alert testing. A passing case validates its stated input and assertions; +it does not certify all vendor log variants or live threat-intelligence behavior. + +Authority: [filter steps](https://github.com/threatwinds/go-sdk/wiki/Filter-Steps-Reference), +[event schema](https://github.com/threatwinds/go-sdk/wiki/Standard-Event-Schema), +[rule implementation](https://github.com/threatwinds/go-sdk/wiki/Implementing-Rules), +[SDK schema](https://github.com/threatwinds/go-sdk/blob/v1.1.31/plugins/plugins.proto). +`afterEvents`, empty noncapturing grok names, open `log.*` fields and supported +numeric strings are valid and deliberately accepted. diff --git a/plugins/alerts/testdata/filter-contracts/core.json b/plugins/alerts/testdata/filter-contracts/core.json new file mode 100644 index 000000000..5d3985816 --- /dev/null +++ b/plugins/alerts/testdata/filter-contracts/core.json @@ -0,0 +1,36 @@ +{ + "technology": "UTMStack shared contract runner", + "filters": [ + "filters/utmstack/utmstack.yml" + ], + "rules": [], + "fixtures": [ + { + "name": "core_unstructured_message", + "filter": "utmstack/utmstack.yml", + "input": { + "raw": "internal test event" + }, + "expected": { + "raw": "internal test event", + "log.message": "internal test event" + } + }, + { + "name": "core_raw_json_model", + "filter": "utmstack/utmstack.yml", + "raw": "{\"msg\":\"synthetic JSON event\",\"args\":{\"event-id\":17}}", + "dataType": "utmstack", + "dataSource": "synthetic-host", + "expected": { + "log.msg": "synthetic JSON event", + "log.args.eventid": 17, + "dataSource": "synthetic-host" + }, + "absent": [ + "log.message" + ], + "rules": {} + } + ] +}