Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,932
7,263
6,535
3,865
3,643
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
This rule detects when an end-user within an Okta environment reports suspicious activity associated with their account. This event indicates that a user has actively flagged an action or login as potentially unauthorized or malicious, prompting further investigation.
This rule detects when a user account in OneLogin is locked or suspended, either through the API or other system actions. This could indicate an attempt to disrupt user access or a response to suspicious activity.
Detects a suspicious Salesforce OAuth login followed by high-volume data exfiltration activity within a short period. This pattern is associated with the threat actor UNC6040, which uses malicious or compromised OAuth applications to steal data.
Detects when a user has potentially entered their password into the username field during a failed Okta login attempt. This can lead to the password being retained in log files, posing a security risk.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
Detects global permissions change activity.
Detects unauthorized access attempts to a resource.
Detects when a new member is added or invited to a github organization.
Detects access to Okta admin functions through proxy.
Detects when an user assumed another user account.
Detects GitHub activity associated with the 'Shai-Hulud' NPM supply chain attack. The attack involves malicious NPM packages that use stolen GitHub tokens to create a new branch, inject a malicious workflow file to exfiltrate secrets, and make private repositories public.
Detects when a user successfully logs on to sanctioned applications from an IP address identified as risky by Microsoft Cloud App Security. This indicates a potential compromise of the user's account or an attempt to access resources from an unusual and potentially malicious location.
Detects when full data export is attempted.
Detects when full data export is attempted an unauthorized user.
Detects user data export activity.
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared).
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a GitHub Pages site of a repository is made public. This usually is part of a publishing process but could indicate or lead to potential unauthorized exposure of sensitive information or code.
Detects when a repository or an organization is being transferred to another location.
Detects when an user account is locked or suspended.
Page 126 of 142