RSA NetWitness Rules RSA NetWitness Rules
This table lists all of the delivered RSA NetWitness Rules.
Note: For content that has been discontinued, see Discontinued Content.
Display Name | File Name | Description | Medium | Tag |
---|---|---|---|---|
11.1-11.2 Autoruns and Scheduled Tasks from or referencing AppData | 11.1-11.2 Autoruns and Scheduled Tasks from or referencing AppData | Compliance Rule- Anti-Virus Signature Update | endpoint | assurance, compliance, audit, operations, event analysis, situation awareness |
11.1-11.2 Autoruns and Scheduled Tasks from Root of ProgramData | 11.1-11.2 Autoruns and Scheduled Tasks from Root of ProgramData | Autoruns and Tasks details when accessed from or referencing AppData. Task name, Autorun type, Directory, Command, Launch Arguments and number of hosts associated will be reflected. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Autoruns and Scheduled Tasks Invoking Command Shell | 11.1-11.2 Autoruns and Scheduled Tasks Invoking Command Shell | Attackers will often use registry autoruns and scheduled tssks to maintain persistence on a compromised machine. A common technique leverages %SYSTEMROOT%\\\\ProgramData as a storage location for malicious payloads set to run at a particular time or upon trigger (i.e. login). It is not common for executables to be launching from the root of ProgramData, so any instance should be considered suspicious. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Autoruns and Scheduled Tasks Invoking Windows Script Host | 11.1-11.2 Autoruns and Scheduled Tasks Invoking Windows Script Host | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will invoke trusted system shells (cmd.exe and powershell.exe) to perform malicious activity in an effort to evade anti-malware solutions. While not all autoruns invoking these commands are inherently malicious, an analyst should understand which of those are normal or require for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Autoruns and Scheduled Tasks Running Scripts | 11.1-11.2 Autoruns and Scheduled Tasks Running Scripts | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will invoke Windows Script Host (cscript.exe and wscript.exe) to launch scripts in an effort to evade anti-malware solutions. While not all autoruns invoking these commands are inherently malicious, an analyst should understand which of those are normal or required for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Autoruns and Tasks on Host | 11.1-11.2 Autoruns and Tasks on Host | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will call and execute various scripts to provide further instructions for attack. Detecting arguments being passed to an executable that look like common script file formats can be a good indicator of compromise, particularly when attackers choose to obfuscate the name of the launching binary (e.g. create a copy of cmd.exe under a different name), While not all autoruns invoking these scripts are inherently malicious, an analyst should understand which of those are normal or require for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 DLLs on Host | 11.1-11.2 DLLs on Host | Aggregates sessions that contain CDNs, which are listed in the Content Delivery Networks List.Filter these sites to reduce the amount of "noise" from non-dangerous traffic. | endpoint | operations, event analysis, application analysis, situation awareness |
11.1-11.2 Endpoint Operating Systems Summary | 11.1-11.2 Endpoint Operating Systems Summary | For each Dynamic DNS hosts, associated IP Addresses, Ports and Module accessing domain name will be reflected. The dynamic DNS are maintained in a list which can be altered as per needs. DDNS provides flexibility to adversaries and help them in evasion and persistence. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher CONFIGURATION If this rule is used with the Endpoint Network Activity Report or custom report, before the report is scheduled to run, you must enter a domain name or configure and use a NetWitness List of domain names to return this network data information. |
endpoint | assurance, audit, compliance, operations, risk, threat |
11.1-11.2 Endpoint Version Summary | 11.1-11.2 Endpoint Version Summary | Operating System Details associated with the host(s). VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | assurance, audit, compliance, operations, risk |
11.1-11.2 Files on Host | 11.1-11.2 Files on Host | Displays files transported over uncommon protocols such as ICMP and those identified as unknown. This report will ignore files transferred over common protocols of HTTP, FTP, SMTP, POP, RSYNC and TFTP | endpoint | operations, event analysis, protocol analysis |
11.1-11.2 Machine Details on Host | 11.1-11.2 Machine Details on Host | Detects logouts for users on a watchlist by user name. | endpoint | assurance, compliance, audit, identity, authentication |
11.1-11.2 Processes on Host | 11.1-11.2 Processes on Host | Details related to external domain names accessed by PowerShell. Host associated, Source IP Address, Destination IP Address, domain name and Launch argument used with PowerShell are reflected. Connection to external domain can help adversary in executing remote script or fetching files or other useful information. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | assurance, attack phase, operations, risk, threat |
11.1-11.2 Rarest Autorun Registry Keys | 11.1-11.2 Rarest Autorun Registry Keys | There are numerous registry autorun keys that allow for command execution without interaction by the end user. Two common keys used by attackers are the HKCU\\\\Sofware\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run and \\\\RunOnce keys. Outliers in an enterprise environment should be inspected. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Rarest Child Processes of Web Server Processes | 11.1-11.2 Rarest Child Processes of Web Server Processes | Filename, Launch Arguments and number of hosts associated are reflected when registry contains autorun registry keys. Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.1-11.2 Rarest Code Signing Certificate CNs | 11.1-11.2 Rarest Code Signing Certificate CNs | Details of Child Processes of web server. Web Shells can be used to run malicious tools, commands and scripts by adversaries. Parent Process, Checksum, Directory and number of hosts associated are reflected. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | assurance, operations, risk, threat |
11.1-11.2 Rarest Parent Processes of cmd | 11.1-11.2 Rarest Parent Processes of cmd | List of Filenames with their checksum, directory and number of hosts associated with. This information can be helpful in investigations. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | assurance, operations, risk, threat |
11.1-11.2 Rarest Parent Processes of powershell | 11.1-11.2 Rarest Parent Processes of powershell | Attackers will often use trusted Windows processes as part of their attack. In a corporate environment, the number of unique parent processes invoking cmd.exe should be minimal. Very unique parent processes could indicate malware or alternate execution paths used by malware and attackers and should be investigated. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Rarest Processes Running from AppData | 11.1-11.2 Rarest Processes Running from AppData | Attackers will often use trusted Windows processes as part of their attack. In a corporate environment, the number of unique parent processes invoking powershell.exe should be minimal. Very unique parent processes could indicate malware or alternate execution paths used by malware and attackers and should be investigated. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.1-11.2 Services on Host | 11.1-11.2 Services on Host | Detects the meta key service generated through a network parser, which match a list of configured source IPs. | endpoint | operations, event analysis, protocol analysis, situation awareness |
11.1-11.2 Windows Process Parent Child Mismatch | 11.1-11.2 Windows Process Parent Child Mismatch | Indicates a possible pass-the-hash attack on Windows systems configured to use the NTLM authentication protocol. This rule does not apply to systems which use the Kerberos authentication protocol. This ruler reduces false positives for anonymous logons and eliminates all DC or machine logons by removing any usernames that end in a $. | endpoint | action on objectives, attack phase, authentication, identity, lateral movement, threat |
11.3 Autoruns and Scheduled Tasks from or referencing AppData | 11.3 Autoruns and Scheduled Tasks from or referencing AppData | Compliance Rule- Anti-Virus Signature Update | endpoint | assurance, compliance, audit, operations, event analysis, situation awareness |
11.3 Autoruns and Scheduled Tasks from Root of ProgramData | 11.3 Autoruns and Scheduled Tasks from Root of ProgramData | Autoruns and Tasks details when accessed from or referencing AppData. Task name, Autorun type, Directory, Command, Launch Arguments and number of hosts associated will be reflected. These locations are used often by malware authors to store malicious payloads, with autoruns in place to ensure persistence. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Autoruns and Scheduled Tasks Invoking Command Shell | 11.3 Autoruns and Scheduled Tasks Invoking Command Shell | Attackers will often use registry autoruns and scheduled tssks to maintain persistence on a compromised machine. A common technique leverages %SYSTEMROOT%\\\\ProgramData as a storage location for malicious payloads set to run at a particular time or upon trigger (i.e. login). It is not common for executables to be launching from the root of ProgramData, so any instance should be considered suspicious. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Autoruns and Scheduled Tasks Invoking Windows Script Host | 11.3 Autoruns and Scheduled Tasks Invoking Windows Script Host | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will invoke trusted system shells (cmd.exe and powershell.exe) to perform malicious activity in an effort to evade anti-malware solutions. While not all autoruns invoking these commands are inherently malicious, an analyst should understand which of those are normal or require for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Autoruns and Scheduled Tasks Running Scripts | 11.3 Autoruns and Scheduled Tasks Running Scripts | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will invoke Windows Script Host (cscript.exe and wscript.exe) to launch scripts in an effort to evade anti-malware solutions. While not all autoruns invoking these commands are inherently malicious, an analyst should understand which of those are normal or required for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Autoruns and Tasks on Host | 11.3 Autoruns and Tasks on Host | Attackers will often use registry autoruns and scheduled tasks to maintain persistence on a compromised machine. A common technique will call and execute various scripts to provide further instructions for attack. Detecting arguments being passed to an executable that look like common script file formats can be a good indicator of compromise, particularly when attackers choose to obfuscate the name of the launching binary (e.g. create a copy of cmd.exe under a different name), While not all autoruns invoking these scripts are inherently malicious, an analyst should understand which of those are normal or require for IT operations and be suspicious of all others. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 DLLs on Host | 11.3 DLLs on Host | Aggregates sessions that contain CDNs, which are listed in the Content Delivery Networks List.Filter these sites to reduce the amount of "noise" from non-dangerous traffic. | endpoint | operations, event analysis, application analysis, situation awareness |
11.3 Endpoint Host State | 11.3 Endpoint Host State | Compliance Rule- Encryption Key Generation and Changes | endpoint | assurance, compliance, audit |
11.3 Endpoint Indicators Analysis | 11.3 Endpoint Indicators Analysis | Details of host state with the rarest occurring state on top. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, compliance, operations, risk |
11.3 Endpoint Indicators by Tactic | 11.3 Endpoint Indicators by Tactic | Number of risk indicators associated with each host broken down in risk levels i.e. critical, high, medium and low. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, compliance, operations, risk, threat |
11.3 Endpoint Indicators by Tactic and Technique | 11.3 Endpoint Indicators by Tactic and Technique | Number of indicators associated with adversarial tactics described in MITRE ATT&CK™ Enterprise framework. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, compliance, operations, risk, threat |
11.3 Endpoint Indicators Summary | 11.3 Endpoint Indicators Summary | Number of indicators associated with adversarial tactics and techniques described in MITRE ATT&CK™ Enterprise framework. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, compliance, operations, risk, threat |
11.3 Endpoint Module and Dynamic DNS | 11.3 Endpoint Module and Dynamic DNS | Number of risk indicators associated with each host. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, compliance, operations, risk, threat |
11.3 Endpoint Operating Systems Summary | 11.3 Endpoint Operating Systems Summary | For each Dynamic DNS hosts, associated IP Addresses, Ports and Module accessing domain name will be reflected. The dynamic DNS are maintained in a list which can be altered as per needs. DDNS provides flexibility to adversaries and help them in evasion and persistence. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher CONFIGURATION If this rule is used with the Endpoint Network Activity Report or custom report, before the report is scheduled to run, you must enter a domain name or configure and use a NetWitness List of domain names to return this network data information. |
endpoint | assurance, audit, compliance, operations, risk, threat |
11.3 Endpoint Version Summary | 11.3 Endpoint Version Summary | Operating System Details associated with the host(s). VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, audit, compliance, operations, risk |
11.3 Files on Host | 11.3 Files on Host | Displays files transported over uncommon protocols such as ICMP and those identified as unknown. This report will ignore files transferred over common protocols of HTTP, FTP, SMTP, POP, RSYNC and TFTP | endpoint | operations, event analysis, protocol analysis |
11.3 Machine Details on Host | 11.3 Machine Details on Host | Detects logouts for users on a watchlist by user name. | endpoint | assurance, compliance, audit, identity, authentication |
11.3 Multiple Arguments for Same Task | 11.3 Multiple Arguments for Same Task | Summarizes a list of hosts with mismatched HREFs | endpoint | operations, event analysis, protocol analysis |
11.3 Multiple Filename for Task Name | 11.3 Multiple Filename for Task Name | Filename, number of parameters and parameters will be displayed for the tasks will all the supplied arguments. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.3 Multiple Task Name for Filename | 11.3 Multiple Task Name for Filename | Filename, Directory and number of files will be displayed when the number of files associated with task is more then one. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.3 Powershell to External Domain | 11.3 Powershell to External Domain | Compliance Rule- Password Changes | endpoint | assurance, compliance, audit, identity, authorization |
11.3 Processes on Host | 11.3 Processes on Host | Details related to external domain names accessed by PowerShell. Host associated, Source IP Address, Destination IP Address, domain name and Launch argument used with PowerShell are reflected. Connection to external domain can help adversary in executing remote script or fetching files or other useful information. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, attack phase, operations, risk, threat |
11.3 Rare Extension for Task | 11.3 Rare Extension for Task | List of vendors associated with unsigned files. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, malware, threat |
11.3 Rarest Autorun Registry Keys | 11.3 Rarest Autorun Registry Keys | There are numerous registry autorun keys that allow for command execution without interaction by the end user. Two common keys used by attackers are the HKCU\\\\Sofware\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run and \\\\RunOnce keys. Outliers in an enterprise environment should be inspected. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.1 and higher |
endpoint | attack phase, exploit, threat |
11.3 Rarest Child Processes of Web Server Processes | 11.3 Rarest Child Processes of Web Server Processes | Filename, Launch Arguments and number of hosts associated are reflected when registry contains autorun registry keys. Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.3 Rarest Code Signing Certificate CNs | 11.3 Rarest Code Signing Certificate CNs | Details of Child Processes of web server. Web Shells can be used to run malicious tools, commands and scripts by adversaries. Parent Process, Checksum, Directory and number of hosts associated are reflected. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, risk, threat |
11.3 Rarest File Names Across Endpoints | 11.3 Rarest File Names Across Endpoints | Less careful malware authors may attempt to sign an executable with an untrusted CA to appear more legitimate to the untrained eye. In a corporate environment, looking for rarity of the common name assigned to the certificate can turn up unwanted applications. The analyst should investigate the rarest instances. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, risk, threat |
11.3 Rarest Parent Processes of cmd | 11.3 Rarest Parent Processes of cmd | List of Filenames with their checksum, directory and number of hosts associated with. This information can be helpful in investigations. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, risk, threat |
11.3 Rarest Parent Processes of powershell | 11.3 Rarest Parent Processes of powershell | Attackers will often use trusted Windows processes as part of their attack. In a corporate environment, the number of unique parent processes invoking cmd.exe should be minimal. Very unique parent processes could indicate malware or alternate execution paths used by malware and attackers and should be investigated. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Rarest Processes Running from AppData | 11.3 Rarest Processes Running from AppData | Attackers will often use trusted Windows processes as part of their attack. In a corporate environment, the number of unique parent processes invoking powershell.exe should be minimal. Very unique parent processes could indicate malware or alternate execution paths used by malware and attackers and should be investigated. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, exploit, threat |
11.3 Rarest Unsigned Service Names Across Endpoints | 11.3 Rarest Unsigned Service Names Across Endpoints | A common malware characteristic is to run out of temporary and low security folders. Rare processes running out of the AppData\\\\Local or AppData\\\\Roaming folders should be investigated. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | attack phase, malware, threat |
11.3 Rarest Unsigned Task Names Across Endpoints | 11.3 Rarest Unsigned Task Names Across Endpoints | Services which are unsigned will be reflected along with module details, directory, checksum and number of hosts associated with it. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.3 Rarest Vendor of Unsigned Files Across Endpoints | 11.3 Rarest Vendor of Unsigned Files Across Endpoints | Tasks which are unsigned will be reflected along with module details, directory, checksum and number of hosts associated with it. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, reconnaissance, risk, threat |
11.3 Same Arguments for Different Task Filename | 11.3 Same Arguments for Different Task Filename | Returns all usernames that have performed failed authentications as declared by RSA SecurID. This rule populates users who have entered an unregistered username within the SecurID Server database (invalid username). It has a limit of returning 5,000 users. Note: You will need to index the non-standard meta key 'result' on the Log Decoder and Concentrator in order to fully populate this report. See the report documentation for more details at https://community.rsa.com/docs/DOC-43406. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
endpoint | authentication, identity |
11.3 Services on Host | 11.3 Services on Host | Detects the meta key service generated through a network parser, which match a list of configured source IPs. | endpoint | operations, event analysis, protocol analysis, situation awareness |
11.3 Task Present on one Machine | 11.3 Task Present on one Machine | Compliance Rule- System Clock Synchronization | endpoint | assurance, compliance, audit |
11.3 Uncommon Directory for Task | 11.3 Uncommon Directory for Task | Displays internal users communicating over tunneling protocols that may indicate inappropriate or anonymous access. This rule includes SSH and Tor tunneling protocols. | endpoint | operations, event analysis, protocol analysis, flow analysis, situation awareness |
11.3 User Created Unique Task | 11.3 User Created Unique Task | Compliance Rule- User Session Terminated Summary | endpoint | identity, authentication |
11.3 User Defined Domain Name Analysis | 11.3 User Defined Domain Name Analysis | Unique Task that is created or authored by a user. VERSIONS SUPPORTED * RSA NetWitness Endpoint 11.3 and higher |
endpoint | assurance, operations, risk, threat |
11.3 Windows Process Parent Child Mismatch | 11.3 Windows Process Parent Child Mismatch | Indicates a possible pass-the-hash attack on Windows systems configured to use the NTLM authentication protocol. This rule does not apply to systems which use the Kerberos authentication protocol. This ruler reduces false positives for anonymous logons and eliminates all DC or machine logons by removing any usernames that end in a $. | endpoint | action on objectives, attack phase, authentication, identity, lateral movement, threat |
Access to Compliance Data Details | Access to Compliance Data Details | Access to Compliance Data Details | log | assurance, compliance, audit, identity, authorization |
Access to Compliance Data Summary | Access to Compliance Data Summary | Compliance Rule- Access to Compliance Data Summary | log | assurance, compliance, audit, identity, authorization |
Accounts Created | Accounts Created | Compliance Rule- Accounts Created | log | assurance, compliance, audit, identity, authorization |
Accounts Deleted | Accounts Deleted | Compliance Rule- Accounts Deleted | log | assurance, compliance, audit, identity, authorization |
Accounts Disabled | Accounts Disabled | Compliance Rule- Accounts Disabled | log | assurance, compliance, audit, identity, authorization |
Accounts Modified | Accounts Modified | Compliance Rule- Accounts Modified | log | assurance, compliance, audit, identity, authorization |
Ad Servers by Bandwidth | Ad Servers by Bandwidth | Aggregates sessions that contain ad sites, which are listed in the Ad Servers List.Ad services consume a lot of disk space. If the traffic is acceptable, ad servers are a good candidate for filtering.This rule feeds data to the Global Filtering Candidate report. | log, packet | assurance, audit, compliance, operations, situation awareness |
Admin Access to Compliance Systems Details | Admin Access to Compliance Systems Details | Compliance Rule- Admin Access to Compliance Systems Details | log | assurance, audit, authorization, compliance, identity |
Admin Access to Compliance Systems Summary | Admin Access to Compliance Systems Summary | Compliance Rule- Admin Access to Compliance Systems Summary | log | assurance, audit, authorization, compliance, identity |
Alert IDs By Profiled Source IP | Alert IDs by Profiled Source IP | Detects the meta key alert.id generated through basic correlation rules, which match a list of configured source IPs. | log, packet | threat, identity, assurance, operations, situation awareness |
Alerts By Profiled Source IP | Alerts by Profiled Source IP | Detects the meta key alert generated through application rules, which match a list of configured source IPs. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Suspicious by Destination IP | All Risk Suspicious by Destination IP | Aggregates sessions by risk.suspicious and displays all results by ip.dst in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Suspicious by Session Size | All Risk Suspicious by Session Size | Aggregates sessions by risk.suspicious and displays all results by session size in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Suspicious by Source IP | All Risk Suspicious by Source IP | Aggregates sessions by risk.suspicious and displays all results by ip.src in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Warning by Destination IP | All Risk Warning by Destination IP | Aggregates sessions by risk.warning and displays all results by ip.dst in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Warning by Session Size | All Risk Warning by Session Size | Aggregates sessions by risk.warning and displays all results by session size in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
All Risk Warning by Source IP | All Risk Warning by Source IP | Aggregates sessions by risk.warning and displays all results by ip.src in descending order. | log, packet | threat, identity, assurance, operations, situation awareness |
Amazon VPC Top Accepted Destination IP | Amazon VPC Top Accepted Destination IP | The report rule fetches the top 10 accepted Destination IP addresses on the basis of the total bytes transferred. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Accepted Destination Ports | Amazon VPC Top Accepted Destination Ports | The report rule fetches the details of top accepted Destination Ports with their occurrences. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Accepted Source IP | Amazon VPC Top Accepted Source IP | The report rule fetches the top 10 accepted Source IP addresses on the basis of total bytes transferred. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Rejected Destination IP | Amazon VPC Top Rejected Destination IP | The report rule fetches the top 10 rejected Destination IP addresses on the basis of total bytes transferred. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Rejected Destination Ports | Amazon VPC Top Rejected Destination Ports | The report rule fetches the details of top rejected Destination Ports with their occurrences. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Rejected Source IP | Amazon VPC Top Rejected Source IP | The report rule fetches the top 10 rejected Source IP addresses on the basis of total bytes transferred. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Amazon VPC Top Source and Destination IP Pair | Amazon VPC Top Source and Destination IP Pair | The report rule fetch the top 10 accepted Source IP and Destination IP address pair on the basis of total bytes transferred. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Anonymous Access by Suspicious Source | Anonymous Access by Suspicious Source | Displays when a user enters or exists through a suspected criminal SOCKS or VPN node.RSA feeds populate the meta keys used within the rule.The rule requires the following:threat.category equal to "anonymous access" AND threat.desc as any of the following:"suspicious-ip" or "criminal vpn service exit node" or "criminal vpn service entry node" or "criminal socks node". | log, packet | assurance, compliance, audit, operations, event analysis, situation awareness |
Anonymous Proxy Service Connection | Anonymous Proxy Service Connection | Detects use of common proxy services. It uses a list of domains matched against the alias host meta key. Use of an HTTP network parser is required. | log, packet | assurance, compliance, audit, operations, event analysis, situation awareness |
Anti-Virus Signature Update | Anti-Virus Signature Update | Compliance Rule- Anti-Virus Signature Update | log | assurance, compliance, audit, operations, event analysis, situation awareness |
AWS Access Permissions Modified | AWS Access Permissions Modified | 10.5 and higher. Detects when Amazon Web Services (AWS) instance permissions are modified. The AWS CloudTrail log parser is a required dependency. | log | assurance, compliance, audit, identity, authorization |
AWS Critical VM Modified | AWS Critical VM Modified | 10.5 and higher. Detects when Amazon Web Services (AWS) critical virtual machine instances are modified. Actions detected by this module include instances being terminated, stopped and rebooted as well as modification of instance attributes and monitoring status. In order to trigger an alert, a custom feed of critical instance source IPs must be created to populate the alert meta key with the value "critical_vm". The AWS CloudTrail log parser is a required dependency. | log | assurance, compliance, audit, identity, authorization |
Azure Monitor Operations by Resource Group | Azure Monitor Operations by Resource Group | The report rule fetches the top 10 operations by Resource Groups with their occurrences monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: group. Please index group meta in the Concentrator and make it in None in table-map.xml |
log | event analysis, operations |
Azure Monitor Operations by Resource Provider | Azure Monitor Operations by Resource Provider | The report rule fetches the top 10 operations by Resource Providers with their occurrences monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | event analysis, operations |
Azure Monitor Resource Providers by Resource Group | Azure Monitor Resource Providers by Resource Group | The report rule fetches the top 10 Resource Providers by Resource Group with their occurrences monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: group. Please index group meta in the Concentrator and make it in None in table-map.xml |
log | event analysis, operations |
Azure Monitor Top IP Addresses | Azure Monitor Top IP Addresses | The report rule fetches the top 10 caller IP addresses which would make an API call resulting in an operation monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | event analysis, operations |
Azure Monitor Top Operations | Azure Monitor Top Operations | The report rule fetches the top 10 Operation names monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | event analysis, operations |
Azure Monitor Top Resource Groups | Azure Monitor Top Resource Groups | The report rule fetches the top 10 Resource Groups in the operations monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: group. Please index group meta in the Concentrator and make it in None in table-map.xml |
log | event analysis, operations |
Azure Monitor Top Virtual Machines | Azure Monitor Top Virtual Machines | The report rule fetches the top 10 Virtual Machine names monitored by Azure Monitor. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Azure Monitor plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | event analysis, operations |
Bandwidth By Profiled Source IP | Bandwidth by Profiled Source IP | Displays aggregated session size of each source IP configured in the report list. | log, packet | operations, event analysis, situation awareness |
Behaviors of Compromise | Behaviors of Compromise | Designated for suspect or nefarious behavior outside the standard signature-based detection. This rule displays output when the meta key, Behaviors of Compromise, is populated. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, threat |
Behaviors of Compromise Detail | Behaviors of Compromise Detail | Designated for suspect or nefarious behavior outside the standard signature-based detection. This rule displays output when the meta key, Behaviors of Compromise, is populated. Additional context is provided to an analyst by grouping with additional meta keys of Service Type and Device Type. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, threat |
Browsers By Profiled Source IP | Browsers by Profiled Source IP | Detects the meta key browser generated through a network parser, which match a list of configured source IPs. | packet | operations, event analysis, application analysis, situation awareness |
Bulk Data Transfer | Bulk Data Transfer | Displays events where the amount of data transferred between the Source-Destination IP pairs is over 20 Mb or 50 Mb. | packet | assurance, compliance, audit |
Change in Audit Settings | Change in Audit Settings | Compliance Rule- Change in Audit Settings | log | assurance, compliance, audit |
Cleartext Authentications | Cleartext Authentications | This rule displays events in which passwords were sent over cleartext using network protocols such as FTP, HTTP, POP3 and SMTP. | packet | assurance, risk, organizational hazard, operations, event analysis, protocol analysis |
Cleartext Authentications By Service | Cleartext Authentications By Service | Displays the top authentications detected in clear text by service through packet traffic. | packet | authentication, identity |
Cleartext Authentications By User Watchlist | Cleartext Authentications by User Watchlist | Detects events for users on a watchlist in which passwords were sent over cleartext using network protocols such as FTP, HTTP, POP3 and SMTP. | packet | assurance, risk, organizational hazard, operations, event analysis, protocol analysis, identity, authentication |
Cleartext Passwords By Service | Cleartext Passwords By Service | Displays the top passwords detected in clear text by service through packet traffic. | packet | authentication, identity |
Clients by Profiled Source IP | Clients by Profiled Source IP | Detects the meta key client generated through a network parser, which match a list of configured source IPs. | log, packet | operations, event analysis, application analysis, situation awareness |
Content Delivery Networks by Bandwidth | Content Delivery Networks by Bandwidth | Aggregates sessions that contain CDNs, which are listed in the Content Delivery Networks List.Filter these sites to reduce the amount of "noise" from non-dangerous traffic. | log, packet | operations, event analysis, application analysis, situation awareness |
Email Address Activity By User Watchlist | Email Address Activity by User Watchlist | Detects all email activity using the email.src meta key for users on a watchlist by email address. | log, packet | assurance, compliance, corporate, identity, operations, situation awareness |
Email Senders | Email Senders | Displays the top email senders from packet traffic. | packet | identity |
Email User Activity By User Watchlist | Email User Activity by User Watchlist | Detects all email activity using the email and username meta keys for users on a watchlist by user name. | log, packet | assurance, compliance, corporate, identity, operations, situation awareness |
Enablers of Compromise | Enablers of Compromise | Instances of poor information or operational security. Post-mortem often ties these to the root cause. This rule displays output when the meta key, Enablers of Compromise, is populated. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, threat |
Enablers of Compromise Detail | Enablers of Compromise Detail | Instances of poor information or operational security. Post-mortem often ties these to the root cause. This rule displays output when the meta key, Enablers of Compromise, is populated. Additional context is provided to an analyst by grouping with additional meta keys of Service Type and Device Type. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, threat |
Encrypted Traffic over Non-Standard Port | Encrypted Traffic over Non-Standard Port | Summarizes sessions containing encrypted traffic that is not communicating on port 22, 993, 995 or 443. | packet | event analysis, operations, protocol analysis |
Encryption Failures | Encryption Failures | Compliance Rule- Encryption Failures | log | assurance, compliance, audit |
Encryption Key Generation and Changes | Encryption Key Generation and Changes | Compliance Rule- Encryption Key Generation and Changes | log | assurance, compliance, audit |
Executables by Country | Executables by Country | Summarizes a list of executables by country | packet | operations, event analysis, file analysis, situation awareness |
Executables by Domain | Executables by Domain | Summarizes a list of executables by domain | packet | operations, event analysis, file analysis, situation awareness |
Executables with Abnormal Characteristics - Suspicious | Executables with Abnormal Characteristics - Suspicious | Summarizes a list of executables with suspicious abnormal characteristics | log, packet | operations, event analysis, file analysis, situation awareness |
Executables with Abnormal Characteristics - Warning | Executables with Abnormal Characteristics - Warning | Summarizes a list of executables with warning abnormal characteristics | log, packet | operations, event analysis, file analysis, situation awareness |
Failed Escalation of Privileges Details | Failed Escalation of Privileges Details | Compliance Rule- Failed Escalation of Privileges Details | log | assurance, compliance, audit, identity, authorization |
Failed Escalation of Privileges Summary | Failed Escalation of Privileges Summary | Compliance Rule- Failed Escalation of Privileges Summary | log | assurance, compliance, audit, identity, authorization |
Failed Remote Access Details | Failed Remote Access Details | Compliance Rule- Failed Remote Access Details | log | assurance, compliance, audit, identity, authentication |
Failed Remote Access Summary | Failed Remote Access Summary | Compliance Rule- Failed Remote Access Summary | log | assurance, compliance, audit, identity, authentication |
File Analysis | File Analysis | A large inspection library that highlights file characteristics and anomalies. This rule displays output when the meta key, File Analysis, is populated. The Hunting Pack is a required dependency. | log, packet, endpoint | event analysis, file analysis, operations |
File Analysis Detail | File Analysis Detail | A large inspection library that highlights file characteristics and anomalies. This rule displays output when the meta key, File Analysis, is populated. Additional context is provided to an analyst by grouping with the additional meta key of Filename. The Hunting Pack is a required dependency. | log, packet, endpoint | event analysis, file analysis, operations |
File Transport Over Uncommon Protocol | File Transport Over Uncommon Protocol | Displays files transported over uncommon protocols such as ICMP and those identified as unknown. This report will ignore files transferred over common protocols of HTTP, FTP, SMTP, POP, RSYNC and TFTP | log, packet | operations, event analysis, protocol analysis |
Firewall Configuration Changes | Firewall Configuration Changes | Compliance Rule- Firewall Configuration Changes | log | assurance, compliance, audit |
Firewall Denied Connections | Firewall Denied Connections | Displays destination IP addresses using the 'ip.dst' meta with an 'action' showing a denied connection as populated by event class of Firewall. | log | operations, situation awareness |
Firewall Destination IP Addresses | Firewall Destination IP Addresses | Displays destination IP addresses using the 'ip.dst' meta as populated by event class of Firewall. | log | operations, situation awareness |
Firewall Events | Firewall Events | Displays firewall events with the 'action' meta key as populated by event class of Firewall. | log | operations, situation awareness |
Firewall Systems | Firewall Systems | Displays firewall systems by system IP using the 'ip.addr' meta key as populated by event class of Firewall. | log | operations, situation awareness |
Firewall Users | Firewall Users | Displays the destination users using the 'user.dst' meta as populated by event class of Firewall. | log | operations, situation awareness |
Firmware Changes on Wireless Devices | Firmware Changes on Wireless Devices | Compliance Rule- Firmware Changes on Wireless Devices | log | assurance, compliance, audit |
G Suite Activity by IP Address | G Suite Activity by IP Address | The report rule fetches the activities by IP Address with the admin email who performed the activity. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: stransaddr. Please index stransaddr meta in the Concentrator and make it in None in table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Admin Activity | G Suite Admin Activity | The report rule fetches the G Suite admin activities. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite App Token Actions | G Suite App Token Actions | The report rule fetches the details of G Suite app token actions . VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Count by Login State | G Suite Count by Login State | The report rule fetches the G Suite login state statistics . VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Group Members - Added or Removed | G Suite Group Members - Added or Removed | The report rule fetches the information on Groups, with users added or removed. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Logins with Multiple IPs | G Suite Logins with Multiple IPs | The report rule fetches the logins from multiple IP addresses by a user. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required:\ stransaddr. Please index stransaddr meta in the Concentrator and make it in None in table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Most Active IPs | G Suite Most Active IPs | The report rule the most active IP addresses based on the number of events performed by that IP address. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required:\ stransaddr. Please index stransaddr meta in the Concentrator and make it in None in table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Top Five Admin Actions | G Suite Top Five Admin Actions | The report rule provides information on the top G Suite admin actions. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Top Ten Apps by Count | G Suite Top Ten Apps by Count | The report rule provides information on the top G Suite Apps. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite User Login Failures | G Suite User Login Failures | The report rule provides information on login failures by a G Suite user. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required:\ stransaddr. Please index stransaddr meta in the Concentrator and make it in None in table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
G Suite Users-Created or Deleted | G Suite Users-Created or Deleted | The report rule provides information on users created and deleted. VERSIONS SUPPORTED 11.2.1 and higher CONFIGURATION Configure the G Suite plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, log analysis, operations |
Group Management | Group Management | Compliance Rule- Group Management | log | assurance, compliance, audit, identity, authorization |
IDS Signatures | IDS Signatures | Displays the possible intrusions through the meta key 'policy.name' as populated by event class of IDS, IPS or Intrusion. | log | operations, situation awareness |
Inbound Network Traffic | Inbound Network Traffic | Compliance Rule- Inbound Network Traffic | log | operations, event analysis, protocol analysis, flow analysis |
Indicators of Compromise | Indicators of Compromise | Possible intrusions into the network or at the endpoint that can be identified through malware signatures or IPs and domains associated with command and control campaigns. This rule displays output when the meta key, Indicators of Compromise, is populated. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, malware, threat |
Indicators of Compromise Detail | Indicators of Compromise Detail | Possible intrusions into the network or at the endpoint that can be identified through malware signatures or IPs and domains associated with command and control campaigns. This rule displays output when the meta key, Indicators of Compromise, is populated. Additional context is provided to an analyst by grouping with additional meta keys of Service Type and Device Type. The Hunting Pack is a required dependency. | log, packet, endpoint | attack phase, malware, threat |
Known Service detected over Non Standard Network Port | Known Service detected over Non Standard Network Port | Displays sessions whose service is detected on a non-standard network port. For example, DNS detected on port 555 when the default port is 53. | packet | operations, event analysis, protocol analysis |
Large Outbound Encrypted Sessions | Large Outbound Encrypted Sessions | Summarizes a list of executables by country,Summarizes sessions containing encrypted traffic that has a session size of 5MB or greater, those being indicative of a large file transfer from RFC 1918 to non RFC 1918 address. | packet | assurance, event analysis, flow analysis, operations, organizational hazard, risk |
Large Outbound Sessions | Large Outbound Sessions | Summarizes sessions which have a session size of 5MB or greater, those being indicative of a large file transfer from RFC 1918 to non RFC 1918 address | packet | assurance, risk, organizational hazard, operations, event analysis, flow analysis |
Log Destination Ports | Log Destination Ports | Displays the destinations ports using the 'ip.dstport' meta as populated by log event traffic. | log | operations, situation awareness |
Log Event Categories | Log Event Categories | Displays the log event categories using the 'event.category' meta as populated by log event traffic. | log | operations, situation awareness |
Log Event Classes | Log Event Classes | Displays the log event classes using the 'device.class' meta as populated by log event source traffic. | log | operations, situation awareness |
Log Event Types | Log Event Types | Displays the log event types using the 'device.type' meta as populated by the log event traffic. | log | operations, situation awareness |
Log Event Users | Log Event Users | Displays the top 10 users as populated by log event traffic. | log | identity |
Login Failures By User Watchlist | Login Failures By User Watchlist | Detects login failures for users on a watchlist by user name. | log | assurance, compliance, audit, identity, authentication |
Login Success By User Watchlist | Login Success By User Watchlist | Detects login successes for users on a watchlist by user name. | log | assurance, compliance, audit, identity, authentication |
Logon Failures Details | Logon Failures Details | Compliance Rule- Logon Failures Details | log | assurance, compliance, audit, identity, authentication |
Logon Failures Summary | Logon Failures Summary | Displays the top logon failures as populated by log event traffic. | log | authentication, identity |
Logon Success Summary | Logon Success Summary | Displays the top logon success as populated by log event traffic. | log | authentication, identity |
Logouts By User Watchlist | Logouts By User Watchlist | Detects logouts for users on a watchlist by user name. | log | assurance, compliance, audit, identity, authentication |
Malware Activity DNS | Malware Activity DNS | Displays DNS packet traffic that is going to a known malicious IP address or references a hostname that is known to be malicious. This could indicate an infected host on your network is making DNS queries. The native NETWORK packet parser must be enabled in order to identify the DNS service. This parser is enabled by default. You will also need to have at least one of the following feeds deployed. Feeds * Investigation * RSA FirstWatch C2 Domains * RSA FirstWatch C2 IPs * RSA FirstWatch APT Domains * RSA FirstWatch APT IPs If deploying the Investigation feed, you will need at least one of the related Lua parsers. Lua Parsers * DNS_verbose_lua * DynDNS Note: For deployments prior to 10.6.2, you will also need to configure a set of new meta keys: inv.context and inv.category. See product documentation of the Investigation Feed for more details: https://community.rsa.com/docs/DOC-62303. |
packet | malware, threat |
Malware Activity Unidentified | Malware Activity Unidentified | Displays packet and log traffic other than DNS and Web that has been going to a known malicious IP address or references a hostname that is known to be malicious. This could indicate an infected host on your network. The native NETWORK packet parser must be enabled. This parser is enabled by default. You will also need to have at least one of the following feeds deployed. Feeds * Investigation * RSA FirstWatch C2 Domains * RSA FirstWatch C2 IPs * RSA FirstWatch APT Domains * RSA FirstWatch APT IPs If collecting logs you need at least one of the following event source types: * Firewall * IDS * IPS * Netflow (rsaflow) Note: For deployments prior to 10.6.2, you will also need to configure a set of new meta keys: inv.context and inv.category. See product documentation of the Investigation Feed for more details: https://community.rsa.com/docs/DOC-62303. |
log, packet | malware, threat |
Malware Activity Web | Malware Activity Web | Displays web-based packet and web logs traffic that has been going to a known malicious IP address or references a hostname that is known to be malicious. This could indicate an infected host on your network is making web requests. The native NETWORK packet parser must be enabled in order to identify the web service. This parser is enabled by default. You will also need to have at least one of the following feeds deployed. Feeds * Investigation * RSA FirstWatch C2 Domains * RSA FirstWatch C2 IPs * RSA FirstWatch APT Domains * RSA FirstWatch APT IPs If deploying the Investigation feed, you will need at least one of the related Lua parsers. Lua Parsers * HTTP_lua * TLS_lua If collecting logs you will need at least one event source with device class of web logs. This includes web proxy and security products such as Cisco WSA and SQUID. Note: For deployments prior to 10.6.2, you will also need to configure a set of new meta keys: inv.context and inv.category. See product documentation of the Investigation Feed for more details: https://community.rsa.com/docs/DOC-62303. |
log, packet | malware, threat |
Mismatched HREF Header | Mismatched HREF Header | Summarizes a list of hosts with mismatched HREFs | packet | operations, event analysis, protocol analysis |
Netflow - Excesssive DNS Responses by Client IP | Netflow - Excesssive DNS Responses by Client IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays Excesssive DNS Responses by Client IP. This could indicate someone collecting information for a possible attack.For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabled and meta-keys "direction" and "Source Port (ip.srcport) " are indexed in table-map.xml and index-concentrator-custom.xml | log | operations, event analysis, protocol analysis, flow analysis |
Netflow - Excesssive DNS Responses by Server IP | Netflow - Excesssive DNS Responses by Server IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays Excesssive DNS Responses by Server IP. This could indicate someone collecting information for a possible attack. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabled and meta-keys "direction" and "Source Port (ip.srcport) " are indexed in table-map.xml and index-concentrator-custom.xml | log | operations, event analysis, protocol analysis, flow analysis |
Netflow - First Heard by Destination IP | Netflow - First Heard by Destination IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays the Source IP address of any system not observed from previous flow data. It lists only the new IP addresses in the time range mentioned at the time of running of the rule. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabled and meta-keys "direction" is indexed in table-map.xml and index-concentrator-custom.xml.This Rule is a part of the Report: Netflow - Filtering Candidates. | log | operations, event analysis, protocol analysis, flow analysis |
Netflow - First Heard by Source IP | Netflow - First Heard by Source IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays the Source IP address of any system not observed from previous flow data. It lists only the new IP addresses in the time range mentioned at the time of running of the rule. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabled and meta-keys "direction" is indexed in table-map.xml and index-concentrator-custom.xml. This Rule is a part of the Report: Netflow - Filtering Candidates. | log | operations, event analysis, protocol analysis, flow analysis |
Netflow - TCP Resets by Source IP | Netflow - TCP Resets by Source IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays TCP Resets by Source IP. Useful in determining devices that are behaving abnormally. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder and Feed - TCP Flags Seen are enabled. and meta-keys "direction" is indexed in table-map.xml and index-concentrator-custom.xml. Also ensure that the meta-key "TCP Flags Seen (tcp.flags.seen)" is indexed index-concentrator-custom.xml | log | operations, event analysis, protocol analysis, flow analysis |
Netflow - Top Applications | Netflow - Top Applications | 10.4 or higher Log Collector required for Netflow collection protocol.This rule displays the list of Top Applications in the network. Provides an overview of the network and helps to analyse the network traffic. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabledand meta-keys "direction" is indexed in table-map.xml and index-concentrator-custom.xml. This Rule is a part of the Report: Netflow - Filtering Candidates. | log | operations, event analysis, application analysis, flow analysis, situation awareness |
Netflow - Top Protocols | Netflow - Top Protocols | 10.4 or higher Log Collector required for Netflow collection protocol.This rule displays the list of Top Protocols in the network. Provides an overview of the network and helps to analyse the network traffic. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabledand meta-keys "direction" is indexed in table-map.xml and index-concentrator-custom.xml. This Rule is a part of the Report: Netflow - Filtering Candidates. | log | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Netflow - Top Talkers by Source IP | Netflow - Top Talkers by Source IP | 10.4 or higher Log Collector required for Netflow collection protocol.Displays Top Talking IP pairs via Netflow summarized by the number of flows. This rule can be used for identifying possible sources of DoS or disruption. It can also be used to identify sources for Data Ex-filtration.For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabledand meta-key "direction" is indexed in table-map.xml and index-concentrator-custom.xmlThis Rule is a part of the Report: Netflow - Top Communicants. | log | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Netflow - Volume - Top Talkers by Destination Port | Netflow - Volume - Top Talkers by Destination Port | 10.4 or higher Log Collector required for Netflow collection protocol.This rule displays Top Talkers by Destination Port summarized by volume via Netflow. This rule can be used for identifying possible sources of DoS or disruption. It can also be used to identify sources for Data Ex-filtration. For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabledand meta-key "direction" is indexed in table-map.xml and index-concentrator-custom.xml. This Rule is a part of the Report: Netflow - Top Communicants. | log | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Netflow - Volume - Top Talkers by Source IP | Netflow - Volume - Top Talkers by Source IP | 10.4 or higher Log Collector required for Netflow collection protocol.This rule displays Top Talkers by Source IP summarized by volume via Netflow. This rule can be used for identifying possible sources of DoS or disruption. It can also be used to identify sources for Data Ex-filtration.For this rule to fire, ensure that device parser "RSAFlow" for 10.3 logdecoder or "CEF" for 10.4 logdecoder is enabledand meta-key "direction" is indexed in table-map.xml and index-concentrator-custom.xml.This Rule is a part of the Report: Netflow - Top Communicants. | log | operations, event analysis, protocol analysis, flow analysis, situation awareness |
NetWitness Administration - Events Classification Summary | NetWitness Administration - Events Classification Summary | This Rule gives a summary of event types and sub types with its count and the last time the event occurred. | log | threat, identity, assurance, operations, situation awareness |
NetWitness Administration - Hosts and Events Summary | NetWitness Administration - Hosts and Events Summary | This rule gives a summary of all the events that occurred under each host along with its count. | log | threat, identity, assurance, operations, situation awareness |
NetWitness Administration - User Activity by Source IP Summary | NetWitness Administration - User Activity by Source IP Summary | This rule gives a break-down of the user activity for each user along with its Source Address, Count and the last time the event occurred. | log | identity, operations, situation awareness |
NetWitness Administration - User Authentication Attempt Details | NetWitness Administration - User Authentication Attempt Details | This rule gives a detailed list of authentication (success and failures) with Source IP address, Hostname, time and etc. | log | authentication, identity, operations, situation awareness |
NetWitness Administration - User Authentication Failure Details | NetWitness Administration - User Authentication Failure Details | This rule gives a detailed list of authentication failures with Hostname, Source IP address, time and etc. | log | authentication, identity, operations, situation awareness |
NetWitness Administration - User Authentication Failure Reason Summary | NetWitness Administration - User Authentication Failure Reason Summary | This rule gives a break-down of the reasons for authentication failures for each user along with its occurrence count and last time the event occurred. | log | authentication, identity, operations, situation awareness |
NetWitness Respond - Alert Details | NetWitness Respond - Alert Details | The rule displays a detailed view of the alerts generated using NetWitness Respond. REFERENCES On RSA Link, see the NetWitness Respond Configuration and User Guides for details. VERSIONS SUPPORTED 10.6.2 and higher CONFIGURATION You must configure the Respond service and database, alert data sources and aggregation rules for this report to populate. DEPENDENCIES * Common Event Format Log Parser |
log, packet | assurance, audit, compliance |
NetWitness Respond - Alert Summary | NetWitness Respond - Alert Summary | The rule displays a summary view of the alerts generated using NetWitness Respond. REFERENCES On RSA Link, see the NetWitness Respond Configuration and User Guides for details. VERSIONS SUPPORTED 10.6.2 and higher CONFIGURATION You must configure the Respond service and database, alert data sources and aggregation rules for this report to populate. DEPENDENCIES * Common Event Format Log Parser |
log, packet | assurance, audit, compliance |
NetWitness Respond - Incident Summary | NetWitness Respond - Incident Summary | The rule displays a summary view of the incidents generated using NetWitness Respond. REFERENCES On RSA Link, see the NetWitness Respond Configuration and User Guides for details. VERSIONS SUPPORTED 10.6.2 and higher CONFIGURATION You must configure the Respond service and database, alert data sources and aggregation rules for this report to populate. DEPENDENCIES * Common Event Format Log Parser |
log, packet | assurance, audit, compliance |
News Portals by Bandwidth | News Portals by Bandwidth | Aggregates sessions that contain news sites, which are listed in the News Portal List.If you are not worried about these sites, you should filter them from capture. | log, packet | operations, event analysis, application analysis, situation awareness |
OS By Profiled Source IP | OS by Profiled Source IP | Detects the meta key OS generated through a network parser, which match a list of configured source IPs. | log, packet | operations, event analysis, application analysis, situation awareness |
Outbound Network Traffic | Outbound Network Traffic | Compliance Rule- Outbound Network Traffic | log | operations, event analysis, protocol analysis, flow analysis |
Password Change on Privileged Account | Password Change on Privileged Account | Detects events that triggered an application rule for a password change, which match a list of configured administrative users. | log | assurance, compliance, audit, identity, authorization |
Password Changes | Password Changes | Compliance Rule- Password Changes | log | assurance, compliance, audit, identity, authorization |
Password Changes Summary | Password Changes Summary | Compliance Rule- Password Changes Summary | log | assurance, compliance, audit, identity, authorization |
Remote Control Client Site | Remote Control Client Site | Detects use of common remote client download sites. It uses a list of domains matched against the alias host meta key. Use of an HTTP network parser is required. | log, packet | assurance, compliance, corporate, operations, event analysis, protocol analysis |
Remote Control or Proxy Client Download | Remote Control or Proxy Client Download | Detects proxy and remote client file downloads by looking for the file name and extension within the filename meta key. Use of an HTTP network parser is required. | log, packet | assurance, compliance, corporate, operations, event analysis, protocol analysis, file analysis |
Risk Info By Profiled Source IP | Risk Info by Profiled Source IP | Detects all risks registered by the meta key risk.info through the Alert IDs Information feed, which match a list of configured source IPs. | log, packet | threat, identity, assurance, operations, situation awareness |
Risk Suspicious By Profiled Source IP | Risk Suspicious by Profiled Source IP | Detects all risks registered by the meta key risk.suspicious through the Alert IDs Suspicious feed, which match a list of configured source IPs. | log, packet | threat, identity, assurance, operations, situation awareness |
Risk Suspicious By User Watchlist | Risk Suspicious by User Watchlist | Detects all risks registered by the meta key risk.suspicious through the Alert IDs Suspicious feed on a watchlist by user name. | log, packet | threat, identity, assurance, operations, situation awareness |
Risk Warning By Profiled Source IP | Risk Warning by Profiled Source IP | Detects all risks registered by the meta key risk.warning through the Alert IDs Warning feed, which match a list of configured source IPs. | log, packet | threat, identity, assurance, operations, situation awareness |
Risk Warning By User Watchlist | Risk Warning by User Watchlist | Detects all risks registered by the meta key risk.warning through the Alert IDs Warning feed on a watchlist by user name. | log, packet | threat, identity, assurance, operations, situation awareness |
Router Configuration Changes | Router Configuration Changes | Compliance Rule- Router Configuration Changes | log | assurance, compliance, audit |
RSA SecurID Cloud Latest Failed User Authentications | RSA SecurID Cloud Latest Failed User Authentications | The report rule fetches the top 10 latest failed user authentication details. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | authentication, identity |
RSA SecurID Cloud Super Admin Logon Summary | RSA SecurID Cloud Super Admin Logon Summary | The report rule fetches the Logon summary of Super Admin based on the occurrences. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: user.role. Please index user.role in the Concentrator and make it None in the table-map.xml |
log | authentication, identity |
RSA SecurID Cloud Top Failed User Event IP Addresses | RSA SecurID Cloud Top Failed User Event IP Addresses | The report rule fetches the top 10 IP addresses of failed user events. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: severity. Please index severity meta in the Concentrator and make it None in the table-map.xml |
log | authentication, identity |
RSA SecurID Cloud Top Failed User Event Reasons | RSA SecurID Cloud Top Failed User Event Reasons | The report rule fetches the top 10 failed user event reasons. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: severity. Please index severity meta in the Concentrator and make it None in the table-map.xml |
log | authentication, identity |
RSA SecurID Cloud Top Failed User Events | RSA SecurID Cloud Top Failed User Events | The report rule fetches the top 10 failed user events. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml Metas required: severity. Please index severity meta in the Concentrator and make it None in the table-map.xml |
log | authentication, identity |
RSA SecurID Cloud Top Successful User Authentications | RSA SecurID Cloud Top Successful User Authentications | The report rule fetches the top 10 successful user authentications. VERSIONS SUPPORTED 10.6.5.x and higher This is supported only for the SecurID Cloud platform CONFIGURATION Configure the RSA SecurID Access plugin with valid credentials as per the plugin configuration document Use the latest table-map.xml |
log | authentication, identity |
RSA SecurID-Account Lockouts | RSA SecurID-Account Lockouts | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who attempt to login too many times without successfully logging in, and have locked their SecurID account. It has a limit of returning 5,000 users. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Bad PIN Good Token Code | RSA SecurID-Bad PIN Good Token Code | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who have entered an incorrect PIN but are using a valid SecurID token code (hard or soft). It has a limit of returning 5,000 users. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Bad PIN Previous Token Code | RSA SecurID-Bad PIN Previous Token Code | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who have entered a previous token code. The token code reached the end of it's validity period (usually 60 seconds) and rolled out of the system before authentication completed. It has a limit of returning 5,000 users. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Bad Token Code Bad PIN | RSA SecurID-Bad Token Code Bad PIN | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who have attempted to login with a valid username but have entered the SecurID Token Code and PIN incorrectly. It has a limit of returning 5,000 users. Note: You will need to index the non-standard meta key 'result' on the Log Decoder and Concentrator in order to fully populate this report. See the report documentation for more details at https://community.rsa.com/docs/DOC-43406. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Bad Token Code Good PIN | RSA SecurID-Bad Token Code Good PIN | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who have entered a valid pin for a given username, but the SecurID token code was typed incorrectly. It has a limit of returning 5,000 users. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Static Passcode Authentication | RSA SecurID-Static Passcode Authentication | Returns users that have successfully authenticated using a static passcode and not with an RSA SecurID token. It has a limit of returning 5,000 users. Note: You will need to index the non-standard meta key 'result' on the Log Decoder and Concentrator in order to fully populate this report. See the report documentation for more details at https://community.rsa.com/docs/DOC-43406. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Token Code Reuse | RSA SecurID-Token Code Reuse | Returns usernames that have failed to authenticate as declared by RSA SecurID. This rule populates users who have entered a valid pin for a given username, but the SecurID token code was used previously. The user did not allow the token code to change prior to attempting a new logon. It has a limit of returning 5,000 users. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
RSA SecurID-Unknown User Failed Login | RSA SecurID-Unknown User Failed Login | Returns all usernames that have performed failed authentications as declared by RSA SecurID. This rule populates users who have entered an unregistered username within the SecurID Server database (invalid username). It has a limit of returning 5,000 users. Note: You will need to index the non-standard meta key 'result' on the Log Decoder and Concentrator in order to fully populate this report. See the report documentation for more details at https://community.rsa.com/docs/DOC-43406. DEPENDENCIES: RSA Authentication Manager and User Credential Manager event source (log parser rsaacesrv) |
log | authentication, identity |
Service Analysis | Service Analysis | Core application protocols identification and inspection. This rule displays output when the meta key, Service Analysis, is populated. The Hunting Pack is a required dependency. | packet | event analysis, operations |
Service Analysis Detail | Service Analysis Detail | Core application protocols identification and inspection. This rule displays output when the meta key, Service Analysis, is populated. Additional context is provided to an analyst by grouping with additional meta keys of Service Type and Alias Host. The Hunting Pack is a required dependency. | packet | event analysis, operations |
Services By Profiled Source IP | Services by Profiled Source IP | Detects the meta key service generated through a network parser, which match a list of configured source IPs. | packet | operations, event analysis, protocol analysis, situation awareness |
Session Analysis | Session Analysis | Client-server communication deviations. This rule displays output when the meta key, Session Analysis, is populated. The Hunting Pack is a required dependency. | packet | event analysis, operations |
Session Analysis Detail | Session Analysis Detail | Client-server communication deviations. This rule displays output when the meta key, Session Analysis, is populated. Additional context is provided to an analyst by grouping with additional meta keys of Service Type and Alias Host. The Hunting Pack is a required dependency. | packet | event analysis, operations |
Shadow IT Use by BYOD | Shadow IT Use by BYOD | Shadow IT by Bring Your Own Device (BYOD) is detected through the application rule, nw110125, for byod mobile web agent. | log, packet | assurance, risk, organizational hazard |
Shadow IT Use by Category - Event Count | Shadow IT Use by Category - Event Count | Shadow IT use is detected through a set of application rules. The application rules have been divided by category: stealth email use (nw110105), voice chat apps (nw30050) and file sharing apps (nw110150). This rule summarizes the results in descending order by event count. | log, packet | assurance, risk, organizational hazard |
Shadow IT Use by Category - Session Size | Shadow IT Use by Category - Session Size | Shadow IT use is detected through a set of application rules. The application rules have been divided by category: stealth email use (nw110105), voice chat apps (nw30050) and file sharing apps (nw110150). This rule summarizes the results in descending order by session size. | log, packet | assurance, risk, organizational hazard |
Shadow IT Use by IP Source | Shadow IT Use by IP Source | Shadow IT use is detected through a set of application rules. The application rules have been divided by category: stealth email use (nw110105), voice chat apps (nw30050) and file sharing apps (nw110150). This rule aggregates the results by source IP. | log, packet | assurance, risk, organizational hazard |
Shadow IT Use High Risk | Shadow IT Use High Risk | Displays high risk events based on detection of shadow IT. High risk events are defined as either a large outbound session size as detected with application rule, nw110060, or a match to a user-defined watchlist of source IPs. | log, packet | assurance, risk, organizational hazard |
SSH Over Non Standard Port | SSH over Non Standard Port | Fires when ssh traffic is detected over a port that is not typically used for ssh. | packet | operations, event analysis, protocol analysis |
SSH to External Address | SSH to External Address | Detects when an internal IP address initiates an SSH connection to an external IP address.An SSH connection is identified by the following service=22.An Internal IP address is a private address space defined by RFC-1918. Any IP address not in the private space is considered external. | packet | operations, event analysis, protocol analysis, flow analysis |
Streaming Media by Bandwidth | Streaming Media by Bandwidth | Aggregates sessions that contain streaming media sites, which are listed in the Streaming Media List. Capturing streaming media is a huge problem for disk retention. These are good filtering candidates. | log, packet | assurance, compliance, corporate, operations, event analysis, application analysis |
Successful Escalation of Privileges Details | Successful Escalation of Privileges Details | Compliance Rule- Successful Escalation of Privileges Details | log | assurance, compliance, audit, identity, authorization |
Successful Escalation of Privileges Summary | Successful Escalation of Privileges Summary | Compliance Rule- Successful Escalation of Privileges Summary | log | assurance, compliance, audit, identity, authorization |
Successful Remote Access Details | Successful Remote Access Details | Compliance Rule- Successful Remote Access Details | log | assurance, compliance, audit, identity, authentication |
Successful Remote Access Summary | Successful Remote Access Summary | Compliance Rule- Successful Remote Access Summary | log | assurance, compliance, audit, identity, authentication |
Successful Use of Encryption | Successful Use of Encryption | Compliance Rule- Successful Use of Encryption | log | assurance, compliance, audit, operations, event analysis, protocol analysis |
System Clock Synchronization | System Clock Synchronization | Compliance Rule- System Clock Synchronization | log | assurance, compliance, audit |
Threat Categories | Threat Categories | Displays threat categories based on network traffic. The threat.category meta key is populated by feeds and LUA parsers. | log, packet | threat |
Threat Categories By Profiled Source IP | Threat Categories by Profiled Source IP | Detects events through the meta key threat.category, which match a list of configured source IPs. The meta key is generated through alert and threat feeds. | log, packet | threat, identity, assurance, operations, situation awareness |
Threat Sources | Threat Sources | Displays threat sources based on network traffic. The threat.source meta key is populated by feeds and LUA parsers. | log, packet | threat |
Threat Sources By Profiled Source IP | Threat Sources by Profiled Source IP | Detects events through the meta key threat.source, which match a list of configured source IPs. The meta key is generated through alert and threat feeds. | log, packet | threat, identity, assurance, operations, situation awareness |
Top 10 Categorized Sites | Top 10 Categorized Sites | Summarizes a list of categorized sites | packet | assurance, compliance, operations, situation awareness |
Top 10 Destination Countries | Top 10 Destination Countries | Summarizes a list of destination countries | log, packet | operations, event analysis, situation awareness |
Top 10 Destination Countries by Service Type | Top 10 Destination Countries by Service Type | Summarizes a list of destination countries based on services | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top 10 Destination Countries with Warning and Suspicious Level Alerts | Top 10 Destination Countries with Warning and Suspicious Level Alerts | Summarizes a list of countries with warning and suspicious alerts | log, packet | threat, identity, assurance, operations, event analysis, protocol analysis, situation awareness |
Top 10 Destination IP Addresses | Top 10 Destination IP Addresses | Summarizes a list of destination IP addresses | log, packet | operations, event analysis, situation awareness |
Top 10 Search Engine Queries | Top 10 Search Engine Queries | Summarizes a list of search engine queries | packet | operations, event analysis, application analysis, situation awareness |
Top 10 Services | Top 10 Services | Summarizes a list of services | packet | operations, event analysis, protocol analysis, situation awareness |
Top 10 Uncategorized Sites | Top 10 Uncategorized Sites | Summarizes a list of uncategorized sites | packet | operations, event analysis, application analysis, situation awareness |
Top 10 Websites | Top 10 Websites | Summarizes a list of most commonly accessed websites | packet | operations, event analysis, application analysis, situation awareness |
Top Alias Host Destination by Session Count | Top Alias Host Destination by Session Count | Aggregates sessions by alias.host and displays the top five results by session count in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Alias Host Destination by Source IP | Top Alias Host Destination by Source IP | Aggregates sessions by alias.host and displays the top five results grouped by ip.src and summarized by session count in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Destination Country by Session Count | Top Destination Country by Session Count | Aggregates sessions by country.dst and displays the top five results by session count in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Destination Country by Session Size | Top Destination Country by Session Size | Aggregates sessions by country.dst and displays the top five results by session size in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Destination Country by Source IP | Top Destination Country by Source IP | Aggregates sessions by country.dst and displays the top five results grouped by ip.src and summarized by session count in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Destinations By Profiled Source IP - Bandwidth | Top Destinations by Profiled Source IP - Bandwidth | Displays events with the meta key of ip.dst aggregated by seesion size, which match a list of configured source IPs. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Destinations By Profiled Source IP - Sessions | Top Destinations by Profiled Source IP - Sessions | Displays events with the meta key of ip.dst aggregated by number of sesssions, which match a list of configured source IPs. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Email Addresses by Frequency | Top Email Addresses by Frequency | Summarizes a list of email addresses based on frequency of occurence | packet | operations, event analysis, protocol analysis, situation awareness |
Top Email Destinations by Frequency | Top Email Destinations by Frequency | Summarizes a list of email destination countries | packet | operations, event analysis, protocol analysis, situation awareness |
Top Email Subjects | Top Email Subjects | Summarizes a list of email subjects | packet | operations, event analysis, protocol analysis, situation awareness |
Top File Extensions by Frequency | Top File Extensions by Frequency | Summarizes a list of file extensions based on frequency of occurence. | log, packet | operations, event analysis, protocol analysis, file analysis, situation awareness |
Top Foreign Countries | Top Foreign Countries | Summarizes a list of foreign countries from where network traffic is very high other than the local country. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Foreign Domains | Top Foreign Domains | Summarizes a list of foreign domains from where network traffic is very high other than the local domains. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top HTTPS Destination IP by Session Size | Top HTTPS Destination IP by Session Size | Aggregates sessions by ip.dst and displays the top five results where the tcp.dstport equals 443 or the client equals HTTPS. The results are summarized by session count in descending order. | log, packet | operations, event analysis, protocol analysis, situation awareness |
Top Network Service by Session Count | Top Network Service by Session Count | Aggregates sessions by service and displays the top five results by session count in descending order. | packet | operations, event analysis, protocol analysis, situation awareness |
Top Outbound Protocols | Top Outbound Protocols | Summarizes a list of outbound protocols in a network. | packet | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Top Outbound Source IP | Top Outbound Source IP | Summarizes a list of outbound source IPs in a network. | log, packet | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Top Protocols | Top Protocols | Summarizes a list of top protocols in a network. | packet | operations, event analysis, protocol analysis, situation awareness |
Top Social Sites by Bandwidth | Top Social Sites by Bandwidth | Aggregates sessions that contain social sites, which are listed in the Social Sites List. If social media is not blocked or considered a risk, filter traffic to reduce amount of data captured. | log, packet | operations, event analysis, protocol analysis, application analysis, situation awareness |
Top Source Countries | Top Source Countries | Displays the top source countries as populated by the country.src meta key. To populate this key, the GeoIP parser must be enabled on the network decoder and log decoder. | log, packet | operations, situation awareness |
Top Source IP Addresses | Top Source IP Addresses | Displays the top source IP addresses as populated by the ip.src meta key. | log, packet | operations, situation awareness |
Top TCP Destination Ports | Top TCP Destination Ports | Displays the top TCP destination ports as populated by the tcp.dstport meta key. | packet | operations, situation awareness |
Tox P2P Activity | Tox P2P Activity | The Tox protocol is used for P2P instant messaging and video calling. An actor may use as an encrypted communication channel for malicious purposes. This rule displays all IP sources that have been identified as communicating with a Tox supernode, so an analyst may conduct further investigation. The feed, Tox Supernode, is a required dependency. |
log, packet | operations, situation awareness |
Traffic Flow Direction | Traffic Flow Direction | Displays traffic flow as populated with the Traffic Flow LUA parser or as parsed from a log event source. | log, packet | flow analysis, operations |
Traffic Flow in Azure NSG and Amazon VPC | Traffic Flow in Azure NSG and Amazon VPC | The report rule fetches details of the traffic flow from Azure NSG and/or Amazon VPC. VERSIONS SUPPORTED 10.6.5.x and higher CONFIGURATION Configure the Amazon VPC and Microsoft Azure NSG plugin with valid credentials as per the plugin configuration documents Use the latest table-map.xml DEPENDENCIES CEF log parser |
log | event analysis, flow analysis, operations |
Tunneling Protocols Outbound | Tunneling Protocols Outbound | Displays internal users communicating over tunneling protocols that may indicate inappropriate or anonymous access. This rule includes SSH and Tor tunneling protocols. | log, packet | operations, event analysis, protocol analysis, flow analysis, situation awareness |
Unknown Service detected over Standard Network Port | Unknown Service detected over Standard Network Port | Displays sessions where unknown service is detected on the standard network port. For example, unknown service detected on port 53, which is the standard DNS port | packet | operations, event analysis, protocol analysis |
User Access Revoked | User Access Revoked | Compliance Rule- User Access Revoked | log | assurance, compliance, audit, identity, authorization |
User Access to Compliance Systems Details | User Access to Compliance Systems Details | Compliance Rule- User Access to Compliance Systems Details | log | assurance, compliance, audit, identity, authorization |
User Access to Compliance Systems Summary | User Access to Compliance Systems Summary | Compliance Rule- User Access to Compliance Systems Summary | log | assurance, compliance, audit, identity, authorization |
User Session Terminated Summary | User Session Terminated Summary | Compliance Rule- User Session Terminated Summary | log | identity, authentication |
Vendor Update Sites by Bandwidth | Vendor Update Sites by Bandwidth | Rule aggregates sessions that contain vendor update sites defined in Vendor Update SitesList. Traffic from most of vendor sites is considered normal and hence can act as good filtering candidates. | log, packet | operations, event analysis, protocol analysis, application analysis, situation awareness |
Virus Detection | Virus Detection | Displays possible virus infections by name using the 'virusname' meta key as populated by event class of Anti Virus. | log | operations, situation awareness |
Windows Credential Harvesting Services | Windows Credential Harvesting Services | This rule monitors the installation of Windows services known to be used for pass the hash and brute force attacks. These may include psexec, wce, pwdump, cachedump, gsecdump. | log | action on objectives, application analysis, attack phase, event analysis, lateral movement, operations, threat |
Windows Logon to High Value Assets | Windows Logon to High Value Assets | Rule looks for logon types of 3, 8 or 10 to high value assets. It is required to set-up a High Value Assets custom feed. The feed should populate custom meta keys of High Value Asset Group, fd.hv.group, and Escalation Contact, fd.escalate. The feed may populate these keys based on a callback to the event computer or device IP. | log | assurance, audit, authentication, compliance, identity, lateral movement |
Windows NTLM Network Logon Successful | Windows NTLM Network Logon Successful | Indicates a possible pass-the-hash attack on Windows systems configured to use the NTLM authentication protocol. This rule does not apply to systems which use the Kerberos authentication protocol. This ruler reduces false positives for anonymous logons and eliminates all DC or machine logons by removing any usernames that end in a $. | log | action on objectives, attack phase, authentication, identity, lateral movement, threat |