Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
Platforms
1
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Event Ingestion Volume Drop Anomaly
Cortex XDR
This rule detects an anomalous drop in the daily volume of events in a dataset. It calculates the average daily volume over the past 6 days (excluding the current day) as a baseline. It then flags if the current day's volume is less than 80% of this baseline, but only if the baseline itself is greater than 1000 events. This indicates a significant decrease in expected activity, which could suggest a sensor outage, tampering, or a system being taken offline unexpectedly.
View Defender for Endpoint telemetry URLs and their connection status, view trendline over 30 days.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
Use to investigate possible telemetry and/or connectivity issues.
Jesse.esquivel@microsoft.com.
