Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,931
7,261
6,535
3,864
3,642
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects successfully authenticated user logins based on Okta's Behavior Detection pattern analysis.
An Okta user reports suspicious activity in response to an end user security notification.
Detects a successful login after multiple failed OTP intents
Generates alerts based on Google Workspace alerts center and aggregates them based on severity.
Identifies when a Marketplace app is added in a Google Workspace organization. Installing certain apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when the Google Workspace Marketplace allowlist is configured to allow users to install and run any apps from the Marketplace. Allowing users to install and run any apps may increase the organization's risk of data exfiltration/leakage and increase its attack surface.
Identifies when a user deletes multiple files from Google Drive, which may indicate data destruction.
Identifies when a user downloads multiple files from Google Drive, which may indicate data exfiltration.
Detects a successful login after multiple failed MFA pushes
Okta Mismatch Between Source and Response for Verify Push Request
Detects multiple failed requests to access applications
Detects when a new API token is created.
Okta ThreatInsight detects multiple login failures from the same IP across one or more Okta orgs.
Okta's ThreatInsight can identify Password Spray attacks.
Detects when an Okta user failed a number challenge during push notification.
Detects when a user revealed another user's application password.
Detects when a user assumes multiple user accounts.
Detects multiple users login failures from a single IP.
Identifies when an external user account is added to a group in Google Workspace. Security teams can monitor for unexpected user accounts being added to Google Workspace groups to prevent unauthorized access to data.
Alerts when a permission on the watchlist is applied to an Entra ID application.
Application creation is a legitimate activity but doesn't occur frequently. Alerts when a new application is created in Entra ID (formerly Azure AD).
Page 141 of 142