Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
65 detections
Filters
Last updated
All Time
Detection languages
37
16
5
5
1
Contributors
17
9
8
7
4
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
38
14
10
5
3
Products / Services
19
15
8
6
5
MITRE Techniques
17
16
13
10
10
CVEs
1
Detects a burst of denied requests at the load balancer. The appliance sits in front
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
of the application and sees attempts the application never receives, which makes it
an early warning layer that most estates collect and never query.
Onboarding: BARRACUDA-LOADBALANCER is ingested via Syslog (CEF) (Bloo extractor 859).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webserver where sourcename='BARRACUDA-LOADBALANCER'
and action='REQUEST_DENIED'
| duration 15m
| groupby srcip, useragent
| select srcip, useragent, distinct_count(url)
| having distinct_count_col1 > 20
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
Detects repeated blocked access requests through Zscaler Private Access. ZPA brokers
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
access to internal applications without exposing the network, so a user repeatedly
blocked is probing for applications they are not entitled to reach — the zero trust
equivalent of internal port scanning.
Onboarding: ZSCALER-SPA is ingested via the Zscaler connector (Bloo extractor 176).
Integration guide: https://bloo.io/docs/integrations
BQL (Bloo Query Language):
stream=zpa-connector where sourcename='ZSCALER-SPA' and action='REQUEST_BLOCKED'
| duration 1h
| groupby user, srcip
| select user, srcip, distinct_count(app)
| having distinct_count_col1 > 5
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
This rule identifies potential brute force or password spraying attacks against network edge devices, such as firewalls and VPN gateways. It aggregates authentication failures and denied connection attempts by source IP address. The rule differentiates between brute force attacks, characterized by a high volume of failed attempts against one or more users from a single source, and password spraying, indicated by multiple unique usernames failing authentication from the same source.
The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
Detects high-velocity, automated authentication failures originating from a single IP against internet-exposed management interfaces. The rule monitors for a rapid sequence of distinct user accounts being targeted in a short time window, indicating AI-driven or automated credential stuffing/brute force activity targeting VPNs or firewalls.
Detects high-volume activity (BLOCK or COUNT actions) from the AWS Shield Advanced managed DDoS protection rule set within a 1-minute time window. The rule alerts on potential Layer 7 DDoS attacks by monitoring for significant spikes in event volume or the number of unique source IP addresses targeting a specific AWS WAF Web ACL.
Detects instances where Windows Filtering Platform (WFP) has blocked outbound network connections initiated by critical Microsoft Defender components (e.g., MsSense.exe, MsMpEng.exe). Such blocks may indicate security software interference, misconfiguration, or attempts to disrupt endpoint security monitoring.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects high or critical severity Data Loss Prevention (DLP) alerts triggered by the Zscaler NSS platform. The rule identifies web traffic involving sensitive information categories such as Personally Identifiable Information (PII), financial data, or source code, which have been either allowed or blocked by Zscaler policy.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
Detects anomalous activity where a user account experiences access denials across a high number of distinct applications (>= 5) within a 15-minute window via Zscaler Private Access. This pattern often indicates unauthorized exploration, directory probing, or automated credential testing against enterprise resources.
Page 1 of 4