Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Identifies devices running Request Tracker (RT) applications, processes, files, or network services, and flags instances with vulnerable versions or specific CVEs (CVE-2025-61873, CVE-2026-41075, CVE-2026-41076, CVE-2026-6841, CVE-2026-44229, CVE-2026-44230, CVE-2026-44231) below version 5.0.10.
Detects repeated Ollama warning-level network errors, such as DNS lookup failures, TCP connection issues, or host resolution problems. These events can indicate a connectivity issue and warrant investigation, but do not by themselves establish unauthorized access or reconnaissance.
Detects potential abuse of WordPress application passwords by correlating an authorization mint request (authorize-application.php) from an administrator's browser with a subsequent REST API page creation request to the same destination server from a different source IP address within a short time window.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Finds BeyondTrust Remote Support (Bomgar) appliances at version 26.2.3 or earlier that have a public IP address, indicating a potentially internet-facing vulnerable appliance (CVE-2026-102764). Index and field names are placeholders to adapt.
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Detects a Slack workflow being published. Workflows run automation inside the
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
workspace — they can post, collect responses, and reach external endpoints via
webhooks — which makes a malicious one a credential-harvesting form or an
exfiltration channel that looks like an internal tool.
Onboarding: SLACK is ingested via Slack native connector (Bloo extractor 833).
Integration guide: https://bloo.io/docs/integrations/slack
BQL (Bloo Query Language):
stream=slack-workflow where sourcename='SLACK' and action='PUBLISHED'
| groupby user, workflow
Detects clusters of unreachable-service and no-connector-available events. Where
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
these concentrate on one application they suggest the connector serving it has been
disrupted — which, during an intrusion, denies access to the application while the
outage is treated as an infrastructure problem rather than a security one.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA'
and action in ('SERVICE_NOT_REACHABLE', 'NO_CONNECTOR_AVAILABLE')
| duration 15m
| groupby app, reason
| select app, reason, count(*) as cnt
| having cnt > 15
Detects a privileged session beginning with no preceding credential retrieval by the
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
same account. The expected sequence is checkout then session. A session without one
suggests the credential was obtained outside the vault — cached, shared, or stolen —
which defeats the control the vault exists to provide.
Correlate SESSION_STARTED in the audit stream against PASSWORD_RETRIEVED in the iam
stream for the same user within a preceding window.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=audit where sourcename='PAM360' and action='SESSION_STARTED'
| groupby user, targetuser, srcip, devicetype
Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.
Detects a source repeatedly denied by WebSEAL authorisation. Denials indicate
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
requests for resources the identity is not entitled to reach, and a pattern of them
is enumeration of the protected application estate from a position already inside
the authentication boundary.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_DENIED'
| duration 1h
| groupby srcip, user
| select srcip, user, distinct_count(url)
| having distinct_count_col1 > 15
Detects unusual volumes of redirects through WebSEAL. Open or manipulable redirects
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
on an authentication gateway are valuable to an attacker: a link that genuinely
begins on the organisation's own trusted domain will survive scrutiny that an
external link would not.
Onboarding: ISAM-WEBSEAL is ingested via Syslog (Bloo extractor 85).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='ISAM-WEBSEAL' and action='REQUEST_REDIRECTED'
| duration 1h
| groupby srcip, url, uriquery, returncode
Detects creation of a GitHub Actions workflow. A workflow executes code on runners
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
with access to repository secrets, so a malicious one is both a code-execution
primitive and a route to every credential the repository holds — a supply chain
foothold reached entirely through legitimate platform features.
Onboarding: GITHUB is ingested via GitHub connector (Bloo extractor 870).
Integration guide: https://bloo.io/docs/hypercloud/github-connector
BQL (Bloo Query Language):
stream=github where sourcename='GITHUB' and action='WORKFLOW_CREATED'
| groupby target, repositoryid, headbranch, operationtype
Detects repeated Ollama application error events as a possible availability issue. Ollama application logs do not reliably record process termination, so this search cannot confirm a service crash without operating system or service manager telemetry.
Detects searches for the specific Android application package name 'com.ballbounce.Hizbartech', which may indicate investigation into potentially malicious or unwanted applications.
Detects heartbeat and synchronisation events in Secret Server. Heartbeat verifies a
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
stored credential still works on the target. Repeated failures mean the credential
has changed outside the vault — which happens when an attacker rotates it to lock the
organisation out of its own privileged account.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action in ('HEARTBEAT', 'SYNCHRONIZED')
| duration 1h
| groupby user, file, filetype
Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data.
These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.
Summarizes the installed hotfixes and QFE descriptions across Windows devices to provide an overview of patch levels.
Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.
This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
Page 2 of 83