Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Detects a secret being revealed in the Secret Server interface. Launching a session
uses a credential without exposing it; displaying it puts the plaintext in front of
a human, where it can be copied, photographed or written down and used outside every
control the vault provides.
Display is materially more serious than use, and the two are worth separating.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action='PASSWORD_DISPLAYED'
| groupby user, file, filetype, srcip
uses a credential without exposing it; displaying it puts the plaintext in front of
a human, where it can be copied, photographed or written down and used outside every
control the vault provides.
Display is materially more serious than use, and the two are worth separating.
Onboarding: SECRET-SERVER is ingested via Syslog (CEF) (Bloo extractor 844).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=secretserver-secret where sourcename='SECRET-SERVER'
and action='PASSWORD_DISPLAYED'
| groupby user, file, filetype, srcip
Detects a pattern of previewing many files then downloading a subset. This is
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
browsing behaviour — an intruder assessing what is worth taking before taking it —
and it differs from normal use, where a user opens files they already know about.
The preview-to-download ratio is the discriminator, not the raw volume of either.
Onboarding: BOX is ingested via Box native connector (Bloo extractor 711).
Integration guide: https://bloo.io/docs/hypercloud/box-connector
BQL (Bloo Query Language):
stream=documents where sourcename='BOX' and action='PREVIEWED'
| duration 1h
| groupby user
| select user, distinct_count(file)
| having distinct_count_col1 > 30
Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs. This detection monitors /api/generate and /api/chat endpoints for requests exceeding 30 seconds, which may indicate sophisticated jailbreak techniques, multi-stage prompt injections, or attempts to extract sensitive information from the model.
This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection.
Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt.
Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
Detects when an SAP process opens an FTP session to a host that is not on the approved server list.
A privileged SAP account attempted logons across multiple systems or clients from a single source IP address within a 6-hour window, potentially indicating credential compromise or lateral movement.
The following analytic detects the disablement of security steps in a CircleCI pipeline. It leverages CircleCI logs, using field renaming, joining, and statistical analysis to identify instances where mandatory security steps are not executed. This activity is significant because disabling security steps can introduce vulnerabilities, unauthorized changes, or malicious code into the pipeline. If confirmed malicious, this could lead to potential attacks, data breaches, or compromised infrastructure. Investigate by reviewing job names, commit details, and user information associated with the disablement, and examine any relevant artifacts and concurrent processes.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Detects when an SAP audit message ID appears in security audit logs but is absent from the defined monitoring configuration table, which could indicate attempts to bypass or disable monitoring controls.
Detects when a user performs a bulk data download (large volume of data) shortly after accessing restricted or sensitive SAP objects such as sensitive tables, ABAP programs, or transactions.
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
This rule detects when a user starts an ABAP program that is on a list of deprecated or unsafe programs within an SAP environment using SAP Security Audit logs.
Detects when a user invokes a function module on the deprecated or unsafe module list within SAP environments based on SAP security audit logs.
Detects users authenticating to SAP via Dialog Logons from IP addresses that are outside of approved network ranges and RFC1918 internal networks, potentially indicating unauthorized or external access.
Detects dynamic ABAP programming events (Insert, Generate, Delete) in SAP environments, excluding pre-defined authorized transactions.
Detects when a privileged SAP account modifies the master record of a different user within a specified timeframe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
Detects modifications to privileged SAP accounts' user master records or authorizations, indicating potential account manipulation or privilege abuse.
This rule detects when a user executes a sensitive or restricted transaction code in an SAP system, as identified by SAP security audit logs (AU3/AU4 messages). It tracks non-excluded users performing these transactions and aggregates them over a 75-minute window.
Page 2 of 52