Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
This rule detects successful user authentications to Okta that occur outside of typical business hours or on weekends. It specifically flags logins on Saturdays and Sundays, and logins between 8 PM and 7 AM UTC on weekdays. The rule calculates a risk score based on the day and time of the login, with higher scores for weekend logins and late-night/early-morning logins.
This rule detects suspicious user login activity where a single user attempts to log in from multiple distinct countries within a 24-hour period. This behavior can indicate a compromised account being used by an attacker from a different geographic location than the legitimate user, or a user attempting to bypass security controls. The rule also assigns a higher risk score if the login originates from specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria).
Detects user logins for same user from different cities within 24 hours.
Identifies when a user account is unsuspended in Google Workspace.
Detects API Calls from AWS accounts that are not part of the organization.
Detects multiple user logins with invalid credentials from a single IP.
Detects successfully authenticated user logins based on Okta's Behavior Detection pattern analysis.
An Okta user reports suspicious activity in response to an end user security notification.
Detect when a user logs into AWS console without MFA.
Detects create, update or delete events of a SAML provider in AWS.
Detect when GCP Workload identity pools are disabled or deleted. Disabling or deleting a pool will prevent any connected identities from accessing all GCP resources.
Detects when a new API token is created.
Detects multiple users login failures from a single IP.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Identifies SAML provider configuration changes in Google Workspace. Security teams can monitor for changes to SAML provider configuration that may weaken the organization's security posture.
Detects when AWS IAM AdministratorAccess policy is attached to a user, group or role which can be used for privilege escalation.
Detects successful login after multiple failed attempts
Detects when an AWS IAM user creates an AWS Access Key for programmatic calls.
Detects when a user's account is locked out or a user account has reached the lockout limit.
Detects out of hours successful authentication.
Detects when a user is assigned super user privileges.
Page 58 of 59