admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix_risky_command_csv
splunk-security_content/dist/DA-ESS-ContentUpdate/default/macros.conf
T
Bhavin Patel 8960c82fd7 removing BA detections
2024-07-08 17:34:47 -07:00

7343 lines
316 KiB
Plaintext
Raw Permalink Blame History

#############
# Automatically generated by 'contentctl build' from
# https://github.com/splunk/contentctl
# On Date: 2024-07-09T00:27:47 UTC
# Author: Splunk Threat Research Team - Splunk
# Contact: research@splunk.com
#############
[admon]
definition = source=ActiveDirectory
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[amazon_security_lake]
definition = sourcetype=aws:cloudtrail:lake
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[applocker]
definition = (source="WinEventLog:Microsoft-Windows-AppLocker/*" OR source="XmlWinEventLog:Microsoft-Windows-AppLocker/*")
description = This macro is designed to simplify the search for AppLocker events by providing a predefined search query. AppLocker, a feature in Windows, helps administrators control which executables, scripts, and libraries can run on their systems. By using this macro, analysts can quickly query AppLocker logs to monitor application control policies and investigate potential unauthorized software executions or policy violations. To modify this macro for a customer environment, you may need to adjust the source field to match the specific log source or index where AppLocker events are stored. Additionally, if the organization uses custom naming conventions or has AppLocker logs aggregated with other data, further refinement of the search query might be necessary to accurately filter for relevant events.
[audit_searches]
definition = index=_audit sourcetype=audittrail action=search
description = Macro to enable easy searching of audittrail logs for searches
[audittrail]
definition = index=_audit sourcetype=audittrail
description = Macro to enable easy searching of audittrail logs
[aws_cloudwatchlogs_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_config]
definition = sourcetype=aws:config
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_description]
definition = sourcetype="aws:description"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_ecr_users]
definition = userName IN (user)
description = specify the user allowed to push Images to AWS ECR.
[aws_ecr_users_asl]
definition = actor.user.name IN (admin)
description = specify the user allowed to push Images to AWS ECR.
[aws_s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_securityhub_finding]
definition = sourcetype="aws:securityhub:finding"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[aws_securityhub_firehose]
definition = sourcetype="aws:securityhub:firehose"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[azure_audit]
definition = sourcetype=mscs:azure:audit
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[azure_monitor_aad]
definition = sourcetype=azure:monitor:aad
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[azuread]
definition = sourcetype=mscs:azure:eventhub
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[base64decode(1)]
args = b64in
definition = eval b64x_split=split($b64in$,"") | lookup char_conversion_matrix base64char as b64x_split OUTPUT base64bin as b64x_bin | eval b64x_join=mvjoin(b64x_bin,"") | rex field=b64x_join "(?<b64x_by8>.{8})" max_match=0 | lookup char_conversion_matrix bin as b64x_by8 output ascii as b64x_out | eval $b64in$_decode=mvjoin(b64x_out,"") | fields - b64x_* | eval $b64in$_decode = replace(replace($b64in$_decode,":NUL:",""),":SPACE:"," ") | rex field=$b64in$_decode mode=sed "s/\x00//g"
description = Content based conversion of UTF8/UTF16 based base64 encoding. Not a full implementation, but good enough for context without additional app installation.
[bootloader_inventory]
definition = sourcetype = PwSh:bootloader
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[brand_abuse_dns]
definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[brand_abuse_email]
definition = lookup update=true brandMonitoring_lookup domain as src_user OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[brand_abuse_web]
definition = lookup update=true brandMonitoring_lookup domain as urls OUTPUT domain_abuse | search domain_abuse=true
description = This macro limits the output to only domains that are in the brand monitoring lookup file
[capi2_operational]
definition = (source=XmlWinEventLog:Microsoft-Windows-CAPI2/Operational)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[certificateservices_lifecycle]
definition = (source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational OR source=XmlWinEventLog:Microsoft-Windows-CertificateServicesClient-Lifecycle-User/Operational)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[circleci]
definition = sourcetype=circleci
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[cisco_networks]
definition = eventtype=cisco_ios
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[cloud_api_calls_from_previously_unseen_user_roles_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new commands from user roles
[cloudtrail]
definition = sourcetype=aws:cloudtrail
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatch_eks]
definition = sourcetype="aws:cloudwatchlogs:eks"
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch eks logs. Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatch_vpc]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
[cloudwatchlogs_vpcflow]
definition = sourcetype=aws:cloudwatchlogs:vpcflow
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[crushftp]
definition = sourcetype="crushftp:sessionlogs"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[driverinventory]
definition = sourcetype=PwSh:DriverInventory
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[dynamic_dns_providers]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as query OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as query OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_local,isDynDNS_default) |fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This macro limits the output of the query field to dynamic dns domains. It looks up the domains in a file provided by Splunk and one intended to be updated by the end user.
[dynamic_dns_web_traffic]
definition = lookup update=true dynamic_dns_providers_default dynamic_dns_domains as url OUTPUTNEW isDynDNS_default | lookup update=true dynamic_dns_providers_local dynamic_dns_domains as url OUTPUTNEW isDynDNS_local| eval isDynDNS = coalesce(isDynDNS_default, isDynDNS_local)|fields - isDynDNS_default, isDynDNS_local| search isDynDNS=True
description = This is a description
[ec2_modification_api_calls]
definition = (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
description = This is a list of AWS event names that have to do with modifying Amazon EC2 instances
[evilginx_phishlets_0365]
definition = (query=login* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Office 365
[evilginx_phishlets_amazon]
definition = (query=fls-na* AND query = www* AND query=images*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Amazon
[evilginx_phishlets_aws]
definition = (query=www* AND query=aws* AND query=console.aws* AND query=signin.aws* AND api-northeast-1.console.aws* AND query=fls-na* AND query=images-na*)
description = This limits the query fields to domains that are associated with evilginx masquerading as an AWS console
[evilginx_phishlets_facebook]
definition = (query=www* AND query = m* AND query=static*)
description = This limits the query fields to domains that are associated with evilginx masquerading as FaceBook
[evilginx_phishlets_github]
definition = (query=api* AND query = github*)
description = This limits the query fields to domains that are associated with evilginx masquerading as GitHub
[evilginx_phishlets_google]
definition = (query=accounts* AND query=ssl* AND query=www*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Google
[evilginx_phishlets_outlook]
definition = (query=outlook* AND query=login* AND query=account*)
description = This limits the query fields to domains that are associated with evilginx masquerading as Outlook
[exchange]
definition = sourcetype="MSWindows:IIS"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[f5_bigip_rogue]
definition = index=netops sourcetype="f5:bigip:rogue"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[fillnull_config]
definition = null
description = Used inside security_content_summariesonly to adjust the fillnull configuration
[filter_rare_process_allow_list]
definition = lookup update=true lookup_rare_process_allow_list_default process as process OUTPUTNEW allow_list | where allow_list="false" | lookup update=true lookup_rare_process_allow_list_local process as process OUTPUT allow_list | where allow_list="false"
description = This macro is intended to allow_list processes that have been definied as rare
[github]
definition = sourcetype=aws:firehose:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[github_known_users]
definition = user IN (user_names_here)
description = specify the user allowed to create PRs in Github projects.
[google_gcp_pubnet_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Google GCP. Replace the macro definition with configurations for your Splunk Environmnent.
[google_gcp_pubsub_message]
definition = sourcetype="google:gcp:pubsub:message"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gsuite_calendar]
definition = sourcetype=gsuite:calendar:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gsuite_drive]
definition = sourcetype=gsuite:drive:json
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gsuite_gmail]
definition = sourcetype=gsuite:gmail:bigquery
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gws_login_mfa_methods]
definition = event.parameters{}.multiValue{} IN ("backup_code", "google_authenticator", "google_prompt", "idv_any_phone", "idv_preregistered_phone", "internal_two_factor", "knowledge_employee_id", "knowledge_preregistered_email", "login_location", "knowledge_preregistered_phone", "offline_otp", "security_key", "security_key_otp")
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gws_reports_admin]
definition = sourcetype=gws:reports:admin
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[gws_reports_login]
definition = sourcetype=gws:reports:login
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[iis_get_webglobalmodule]
definition = sourcetype="Pwsh:InstalledIISModules"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[iis_operational_logs]
definition = sourcetype="IIS:Configuration:Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[is_net_windows_file_macro]
definition = lookup update=true is_net_windows_file filename as process_name OUTPUT netFile | lookup update=true is_net_windows_file originalFileName as original_file_name OUTPUT netFile | search netFile=true
description = This macro limits the output to process names that are .net binaries on Windows Server 2016 and Windows 11.
[is_nirsoft_software_macro]
definition = lookup update=true is_nirsoft_software filename as process_name OUTPUT nirsoftFile | search nirsoftFile=true
description = This macro is related to potentially identifiable software related to NirSoft. Remove or filter as needed based.
[is_windows_system_file_macro]
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory
[kube_allowed_images]
definition = objectRef.name IN (*splunk*, *falco*)
description = Define your images which are allowed to connect to your kubernetes cluster.
[kube_allowed_locations]
definition = Country="United States"
description = Define your locations which are allowed to connect to your kubernetes cluster.
[kube_allowed_user_agents]
definition = userAgent=Helm/3.13.2
description = Define your user agents which are allowed to connect to your kubernetes cluster.
[kube_allowed_user_groups]
definition = user.groups{} IN (admin)
description = Define your user groups which are allowed to connect to your kubernetes cluster.
[kube_allowed_user_names]
definition = user.username=admin
description = Define your user names which are allowed to connect to your kubernetes cluster.
[kube_audit]
definition = source="kubernetes"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes audit data. Replace the macro definition with configurations for your Splunk Environmnent.
[kube_container_falco]
definition = sourcetype="kube:container:falco"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes audit data. Replace the macro definition with configurations for your Splunk Environmnent.
[kube_objects_events]
definition = sourcetype=kube:objects:events
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[kubernetes_azure]
definition = sourcetype=mscs:storage:blob:json
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data from Azure. Replace the macro definition with configurations for your Splunk Environmnent.
[kubernetes_container_controller]
definition = sourcetype=kube:container:controller
description = customer specific splunk configurations(eg- index, source, sourcetype) for Kubernetes data. Replace the macro definition with configurations for your Splunk Environmnent.
[kubernetes_metrics]
definition = index=kubernetes_metrics
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[linux_hosts]
definition = index=*
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[linux_shells]
definition = (Processes.process_name IN ("sh", "ksh", "zsh", "bash", "dash", "rbash", "fish", "csh", "tcsh", "ion", "eshell"))
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[ms_defender]
definition = source="WinEventLog:Microsoft-Windows-Windows Defender/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[msexchange_management]
definition = sourcetype=MSExchange:management
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[netbackup]
definition = sourcetype="netbackup_logs"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[network_acl_events]
definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation)
description = This is a list of AWS event names that are associated with Network ACLs
[nginx_access_logs]
definition = (sourcetype="nginx:plus:kv" OR sourcetype="nginx:plus:access")
description = This is the base macro for Nginx sourcetypes
[o365_graph]
definition = sourcetype=o365:graph:api
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[o365_management_activity]
definition = sourcetype=o365:management:activity
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[okta]
definition = eventtype=okta_log OR sourcetype = "OktaIM2:log"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[oldsummaries_config]
definition = true
description = Used inside security_content_summariesonly to adjust the allow_old_summaries configuration
[osquery]
definition = sourcetype=osquery:results
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[osquery_process]
definition = eventtype="osquery-process"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[papercutng]
definition = sourcetype="papercutng"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[path_traversal_spl_injection]
definition = index=_internal sourcetype=splunkd_ui_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[pingid]
definition = source=PINGID
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[potential_password_in_username_false_positive_reduction]
definition = search *
description = Add customer specific known false positives to the map command used in detection - Potential password in username
[potentially_malicious_code_on_cmdline_tokenize_score]
definition = eval orig_process=process, process=replace(lower(process), "`", "") | makemv tokenizer="([\w\d\-]+)" process | eval unusual_cmdline_feature_for=if(match(process, "^for$"), mvcount(mvfilter(match(process, "^for$"))), 0), unusual_cmdline_feature_netsh=if(match(process, "^netsh$"), mvcount(mvfilter(match(process, "^netsh$"))), 0), unusual_cmdline_feature_readbytes=if(match(process, "^readbytes$"), mvcount(mvfilter(match(process, "^readbytes$"))), 0), unusual_cmdline_feature_set=if(match(process, "^set$"), mvcount(mvfilter(match(process, "^set$"))), 0), unusual_cmdline_feature_unrestricted=if(match(process, "^unrestricted$"), mvcount(mvfilter(match(process, "^unrestricted$"))), 0), unusual_cmdline_feature_winstations=if(match(process, "^winstations$"), mvcount(mvfilter(match(process, "^winstations$"))), 0), unusual_cmdline_feature_-value=if(match(process, "^-value$"), mvcount(mvfilter(match(process, "^-value$"))), 0), unusual_cmdline_feature_compression=if(match(process, "^compression$"), mvcount(mvfilter(match(process, "^compression$"))), 0), unusual_cmdline_feature_server=if(match(process, "^server$"), mvcount(mvfilter(match(process, "^server$"))), 0), unusual_cmdline_feature_set-mppreference=if(match(process, "^set-mppreference$"), mvcount(mvfilter(match(process, "^set-mppreference$"))), 0), unusual_cmdline_feature_terminal=if(match(process, "^terminal$"), mvcount(mvfilter(match(process, "^terminal$"))), 0), unusual_cmdline_feature_-name=if(match(process, "^-name$"), mvcount(mvfilter(match(process, "^-name$"))), 0), unusual_cmdline_feature_catch=if(match(process, "^catch$"), mvcount(mvfilter(match(process, "^catch$"))), 0), unusual_cmdline_feature_get-wmiobject=if(match(process, "^get-wmiobject$"), mvcount(mvfilter(match(process, "^get-wmiobject$"))), 0), unusual_cmdline_feature_hklm=if(match(process, "^hklm$"), mvcount(mvfilter(match(process, "^hklm$"))), 0), unusual_cmdline_feature_streamreader=if(match(process, "^streamreader$"), mvcount(mvfilter(match(process, "^streamreader$"))), 0), unusual_cmdline_feature_system32=if(match(process, "^system32$"), mvcount(mvfilter(match(process, "^system32$"))), 0), unusual_cmdline_feature_username=if(match(process, "^username$"), mvcount(mvfilter(match(process, "^username$"))), 0), unusual_cmdline_feature_webrequest=if(match(process, "^webrequest$"), mvcount(mvfilter(match(process, "^webrequest$"))), 0), unusual_cmdline_feature_count=if(match(process, "^count$"), mvcount(mvfilter(match(process, "^count$"))), 0), unusual_cmdline_feature_webclient=if(match(process, "^webclient$"), mvcount(mvfilter(match(process, "^webclient$"))), 0), unusual_cmdline_feature_writeallbytes=if(match(process, "^writeallbytes$"), mvcount(mvfilter(match(process, "^writeallbytes$"))), 0), unusual_cmdline_feature_convert=if(match(process, "^convert$"), mvcount(mvfilter(match(process, "^convert$"))), 0), unusual_cmdline_feature_create=if(match(process, "^create$"), mvcount(mvfilter(match(process, "^create$"))), 0), unusual_cmdline_feature_function=if(match(process, "^function$"), mvcount(mvfilter(match(process, "^function$"))), 0), unusual_cmdline_feature_net=if(match(process, "^net$"), mvcount(mvfilter(match(process, "^net$"))), 0), unusual_cmdline_feature_com=if(match(process, "^com$"), mvcount(mvfilter(match(process, "^com$"))), 0), unusual_cmdline_feature_http=if(match(process, "^http$"), mvcount(mvfilter(match(process, "^http$"))), 0), unusual_cmdline_feature_io=if(match(process, "^io$"), mvcount(mvfilter(match(process, "^io$"))), 0), unusual_cmdline_feature_system=if(match(process, "^system$"), mvcount(mvfilter(match(process, "^system$"))), 0), unusual_cmdline_feature_new-object=if(match(process, "^new-object$"), mvcount(mvfilter(match(process, "^new-object$"))), 0), unusual_cmdline_feature_if=if(match(process, "^if$"), mvcount(mvfilter(match(process, "^if$"))), 0), unusual_cmdline_feature_threading=if(match(process, "^threading$"), mvcount(mvfilter(match(process, "^threading$"))), 0), unusual_cmdline_feature_mutex=if(match(process, "^mutex$"), mvcount(mvfilter(match(process, "^mutex$"))), 0), unusual_cmdline_feature_cryptography=if(match(process, "^cryptography$"), mvcount(mvfilter(match(process, "^cryptography$"))), 0), unusual_cmdline_feature_computehash=if(match(process, "^computehash$"), mvcount(mvfilter(match(process, "^computehash$"))), 0)
description = Performs the tokenization and application of the malicious commandline classifier
[powershell]
definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational")
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[previously_seen_cloud_api_calls_per_user_role_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud api calls per user role
[previously_seen_cloud_compute_creations_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
[previously_seen_cloud_compute_image_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the image is new or not
[previously_seen_cloud_compute_images_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance images
[previously_seen_cloud_compute_instance_type_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud instance types
[previously_seen_cloud_compute_instance_types_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the instance type is new or not
[previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the user is new or not
[previously_seen_cloud_provisioning_activity_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud provisioning locations
[previously_seen_cloud_region_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of cloud regions
[previously_seen_cloud_regions_search_window_begin_offset]
definition = "-70m@m"
description = Use this macro to determine how far into the past the window should be to determine if the region is new or not
[previously_seen_windows_services_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of Windows services
[previously_seen_windows_services_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new Windows services
[previously_seen_zoom_child_processes_forget_window]
definition = "-90d@d"
description = Use this macro to determine how long to keep track of zoom child processes
[previously_seen_zoom_child_processes_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new zoom child processes
[previously_unseen_cloud_provisioning_activity_window]
definition = "-70m@m"
description = Use this macro to determine how far back you should be checking for new provisioning activities
[printservice]
definition = source="wineventlog:microsoft-windows-printservice/operational" OR source="WinEventLog:Microsoft-Windows-PrintService/Admin"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[process_bitsadmin]
definition = (Processes.process_name=bitsadmin.exe OR Processes.original_file_name=bitsadmin.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_certutil]
definition = (Processes.process_name=certutil.exe OR Processes.original_file_name=CertUtil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_cmd]
definition = (Processes.process_name=cmd.exe OR Processes.original_file_name=Cmd.Exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_copy]
definition = (Processes.process_name=copy.exe OR Processes.original_file_name=copy.exe OR Processes.process_name=xcopy.exe OR Processes.original_file_name=xcopy.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_csc]
definition = (Processes.process_name=csc.exe OR Processes.original_file_name=csc.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_curl]
definition = (Processes.process_name=curl.exe OR Processes.original_file_name=Curl.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_diskshadow]
definition = (Processes.process_name=diskshadow.exe OR Processes.original_file_name=diskshadow.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_dllhost]
definition = (Processes.process_name=dllhost.exe OR Processes.original_file_name=dllhost.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_dsquery]
definition = (Processes.process_name=dsquery.exe OR Processes.original_file_name=dsquery.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_dxdiag]
definition = (Processes.process_name=dxdiag.exe OR Processes.original_file_name=dxdiag.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_esentutl]
definition = (Processes.process_name=esentutl.exe OR Processes.original_file_name=esentutl.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_fodhelper]
definition = (Processes.process_name=fodhelper.exe OR Processes.original_file_name=FodHelper.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_gpupdate]
definition = (Processes.process_name=gpupdate.exe OR Processes.original_file_name=GPUpdate.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_hh]
definition = (Processes.process_name=hh.exe OR Processes.original_file_name=HH.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_installutil]
definition = (Processes.process_name=installutil.exe OR Processes.original_file_name=InstallUtil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_microsoftworkflowcompiler]
definition = (Processes.process_name=microsoft.workflow.compiler.exe OR Processes.original_file_name=Microsoft.Workflow.Compiler.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_msbuild]
definition = (Processes.process_name=msbuild.exe OR Processes.original_file_name=MSBuild.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_mshta]
definition = (Processes.process_name=mshta.exe OR Processes.original_file_name=MSHTA.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_msiexec]
definition = (Processes.process_name=msiexec.exe OR Processes.original_file_name=msiexec.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_net]
definition = (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe")
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_netsh]
definition = (Processes.process_name=netsh.exe OR Processes.original_file_name=netsh.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_nltest]
definition = (Processes.process_name=nltest.exe OR Processes.original_file_name=nltestrk.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_ntdsutil]
definition = (Processes.process_name=ntdsutil.exe OR Processes.original_file_name=ntdsutil.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_ping]
definition = (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_powershell]
definition = (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_procdump]
definition = (Processes.process_name=procdump.exe OR Processes.process_name=procdump64.exe OR Processes.original_file_name=procdump)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_psexec]
definition = (Processes.process_name=psexec.exe OR Processes.process_name=psexec64.exe OR Processes.original_file_name=psexec.c)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_rclone]
definition = (Processes.original_file_name=rclone.exe OR Processes.process_name=rclone.exe)
description = Matches the process with its original file name.
[process_reg]
definition = (Processes.process_name=reg.exe OR Processes.original_file_name=reg.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_regasm]
definition = (Processes.process_name=regasm.exe OR Processes.original_file_name=RegAsm.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_regsvcs]
definition = (Processes.process_name=regsvcs.exe OR Processes.original_file_name=RegSvcs.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_regsvr32]
definition = (Processes.process_name=regsvr32.exe OR Processes.original_file_name=REGSVR32.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_route]
definition = (Processes.process_name=route.exe OR Processes.original_file_name=route.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_runas]
definition = (Processes.process_name=runas.exe OR Processes.original_file_name=runas.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_rundll32]
definition = (Processes.process_name=rundll32.exe OR Processes.original_file_name=RUNDLL32.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_schtasks]
definition = (Processes.process_name=schtasks.exe OR Processes.original_file_name=schtasks.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_sdelete]
definition = (Processes.process_name=sdelete.exe OR Processes.original_file_name=sdelete.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_setspn]
definition = (Processes.process_name=setspn.exe OR Processes.original_file_name=setspn.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_verclsid]
definition = (Processes.process_name=verclsid.exe OR Processes.original_file_name=verclsid.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_vssadmin]
definition = (Processes.process_name=vssadmin.exe OR Processes.original_file_name=VSSADMIN.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_wbadmin]
definition = (Processes.process_name=wbadmin.exe OR Processes.original_file_name=WBADMIN.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_wermgr]
definition = (Processes.process_name=wermgr.exe OR Processes.original_file_name=wermgr.EXE)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[process_wmic]
definition = (Processes.process_name=wmic.exe OR Processes.original_file_name=wmic.exe)
description = Matches the process with its original file name, data for this macro came from https://strontic.github.io/
[prohibited_apps_launching_cmd_macro]
definition = | inputlookup prohibited_apps_launching_cmd | rename prohibited_applications as parent_process_name | eval parent_process_name="*" . parent_process_name | table parent_process_name
description = This macro outputs a list of process that should not be the parent process of cmd.exe
[prohibited_softwares]
definition = search *
description = This macro is deprecated. Update this macro to look for prohibited softwares in your environment
[ransomware_extensions]
definition = lookup update=true ransomware_extensions_lookup Extensions AS file_extension OUTPUT Name | search Name !=False
description = This macro limits the output to files that have extensions associated with ransomware
[ransomware_notes]
definition = lookup ransomware_notes_lookup ransomware_notes as file_name OUTPUT status as "Known Ransomware Notes" | search "Known Ransomware Notes"=True
description = This macro limits the output to files that have been identified as a ransomware note
[remoteconnectionmanager]
definition = source="WinEventLog:Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[remove_valid_domains]
definition = eval domain=trim(domain,"*") | search NOT[| inputlookup domains] NOT[ |inputlookup cim_corporate_email_domain_lookup] NOT[inputlookup cim_corporate_web_domain_lookup] | eval domain="*"+domain+"*"
description = This macro removes valid domains from the output
[risk_index]
definition = index=risk
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[s3_accesslogs]
definition = sourcetype=aws:s3:accesslogs
description = customer specific splunk configurations(eg- index, source, sourcetype) for AWS cloudwatch vpc logs. Replace the macro definition with configurations for your Splunk Environmnent.
[security_content_ctime(1)]
args = field
definition = convert timeformat="%Y-%m-%dT%H:%M:%S" ctime($field$)
description = convert epoch time to string
[security_content_summariesonly]
definition = summariesonly=`summariesonly_config` allow_old_summaries=`oldsummaries_config` fillnull_value=`fillnull_config`
description = search data model's summaries only
[security_group_api_calls]
definition = (eventName=AuthorizeSecurityGroupIngress OR eventName=CreateSecurityGroup OR eventName=DeleteSecurityGroup OR eventName=DescribeClusterSecurityGroups OR eventName=DescribeDBSecurityGroups OR eventName=DescribeSecurityGroupReferences OR eventName=DescribeSecurityGroups OR eventName=DescribeStaleSecurityGroups OR eventName=RevokeSecurityGroupIngress OR eventName=UpdateSecurityGroupRuleDescriptionsIngress)
description = This macro is a list of AWS event names associated with security groups
[splunk_crash_log]
definition = (index=_internal AND sourcetype=splunkd_crash_log)
description = Searches through the Splunk Crash Log for low-level errors and crashes
[splunk_python]
definition = index=_internal sourcetype=splunk_python
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd]
definition = index=_internal sourcetype=splunkd
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_failed_auths]
definition = index=_audit "action=login attempt" "info=failed"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_investigation_rest_handler]
definition = index=_internal sourcetype=investigation_rest_handler
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_ui]
definition = index=_internal sourcetype=splunkd_ui_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_web]
definition = index=_internal sourcetype=splunk_web_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_webs]
definition = index=_internal sourcetype=splunk_web_service
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkd_webx]
definition = index=_internal sourcetype=splunk_web_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[splunkda]
definition = index=_internal sourcetype=splunkd_access
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[stream_dns]
definition = sourcetype=stream:dns
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[stream_http]
definition = sourcetype=stream:http
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[stream_tcp]
definition = sourcetype=stream:tcp
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[subjectinterfacepackage]
definition = sourcetype="PwSh:SubjectInterfacePackage"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[summariesonly_config]
definition = false
description = Used inside security_content_summariesonly to adjust the summariesonly configuration
[suricata]
definition = sourcetype=suricata
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[suspicious_email_attachments]
definition = lookup update=true is_suspicious_file_extension_lookup file_name OUTPUT suspicious | search suspicious=true
description = This macro limits the output to email attachments that have suspicious extensions
[suspicious_writes]
definition = lookup suspicious_writes_lookup file as file_name OUTPUT note as "Reference" | search "Reference" != False
description = This macro limites the output to file names that have been marked as suspicious
[sysmon]
definition = sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[system_network_configuration_discovery_tools]
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description = This macro is a list of process that can be used to discover the network configuration
[uacbypass_process_name]
definition = BitlockerWizardElev.exe,cliconfg.exe,clipup.exe,cmstp.exe,CompMgmtLauncher.exe,consent.exe,control.exe,credwiz.exe,dccw.exe,dismhost.exe,EventVwr.exe,fodhelper.exe,GWXUXWorker.exe,inetmgr.exe,iscsicli.exe,mcx2prov.exe,migwiz.exe,mmc.exe,msconfig.exe,oobe.exe,osk.exe,pkgmgr.exe,recdisc.exe,rstrui.exe,sdclt.exe,setupsqm.exe,slui.exe,sysprep.exe,SystemPropertiesAdvanced.exe,taskhost.exe,TpmInit.exe,tzsync.exe,w32tm.exe,WerFault.exe,WSReset.exe,wusa.exe
description = A listing of processes known to be abused for User Account Control bypass exploitation.
[uncommon_processes]
definition = lookup update=true lookup_uncommon_processes_default process_name as process_name outputnew uncommon_default,category_default,analytic_story_default,kill_chain_phase_default,mitre_attack_default | lookup update=true lookup_uncommon_processes_local process_name as process_name outputnew uncommon_local,category_local,analytic_story_local,kill_chain_phase_local,mitre_attack_local | eval uncommon = coalesce(uncommon_default, uncommon_local), analytic_story = coalesce(analytic_story_default, analytic_story_local), category=coalesce(category_default, category_local), kill_chain_phase=coalesce(kill_chain_phase_default, kill_chain_phase_local), mitre_attack=coalesce(mitre_attack_default, mitre_attack_local) | fields - analytic_story_default, analytic_story_local, category_default, category_local, kill_chain_phase_default, kill_chain_phase_local, mitre_attack_default, mitre_attack_local, uncommon_default, uncommon_local | search uncommon=true
description = This macro limits the output to processes that have been marked as uncommon
[windows_shells]
definition = (Processes.process_name=cmd.exe OR Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=sh.exe OR Processes.process_name=bash.exe OR Processes.process_name=wscript.exe OR Processes.process_name=cscript.exe)
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wineventlog_application]
definition = eventtype=wineventlog_application OR source="XmlWinEventLog:Application"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wineventlog_security]
definition = eventtype=wineventlog_security OR Channel=security OR source=XmlWinEventLog:Security
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wineventlog_system]
definition = eventtype=wineventlog_system
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wineventlog_task_scheduler]
definition = source="XmlWinEventLog:Security"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[wmi]
definition = sourcetype="wineventlog:microsoft-windows-wmi-activity/operational"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zeek_rpc]
definition = index=zeek sourcetype="zeek:rpc:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zeek_ssl]
definition = index=zeek sourcetype="zeek:ssl:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zeek_x509]
definition = sourcetype="zeek:x509:json"
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[zscaler_proxy]
definition = source=zscaler sourcetype=zscalernss-web
description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent.
[crushftp_server_side_template_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_login_attempts_to_routers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_risky_spl_using_pretrained_ml_model_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[email_attachments_with_lots_of_spaces_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[email_files_written_outside_of_the_outlook_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[email_servers_sending_high_volume_traffic_to_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_email_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[no_windows_updates_in_a_time_frame_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_authentication_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_idp_lifecycle_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_mfa_exhaustion_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_mismatch_between_source_and_response_for_verify_push_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_multiple_accounts_locked_out_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_multiple_failed_requests_to_access_applications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_new_api_token_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_new_device_enrolled_on_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_phishing_detection_with_fastpass_origin_check_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_risk_threshold_exceeded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_suspicious_activity_reported_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_suspicious_use_of_a_session_cookie_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_threatinsight_threat_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_unauthorized_access_to_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_user_logins_from_multiple_cities_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[path_traversal_spl_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[persistent_xss_in_rapiddiag_through_user_interface_views_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[pingid_mismatch_auth_source_and_verification_response_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[pingid_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[pingid_new_mfa_method_after_credential_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[pingid_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_absolute_path_traversal_using_runshellscript_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_account_discovery_drilldown_dashboard_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_app_for_lookup_file_editing_rce_via_user_xslt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_authentication_token_exposure_in_debug_log_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_code_injection_via_custom_dashboard_leading_to_rce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_delete_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_risky_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_command_and_scripting_interpreter_risky_spl_mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_csrf_in_the_ssg_kvstore_client_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_data_exfiltration_from_analytics_workspace_using_sid_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_digital_certificates_infrastructure_version_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_digital_certificates_lack_of_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_using_malformed_saml_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_via_dump_spl_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_via_malformed_s2s_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_via_post_request_datamodel_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_dos_via_printf_search_function_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_edit_user_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_endpoint_denial_of_service_dos_zip_bomb_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_enterprise_kv_store_incorrect_authorization_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_enterprise_windows_deserialization_file_partition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_es_dos_investigations_manager_via_investigation_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_es_dos_through_investigation_attachments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_http_response_splitting_via_rest_spl_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_improperly_formatted_parameter_crashes_splunkd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_information_disclosure_in_splunk_add_on_builder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_information_disclosure_on_account_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_list_all_nonstandard_admin_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_low_privilege_user_can_view_hashed_splunk_password_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_path_traversal_in_splunk_app_for_lookup_file_edit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_persistent_xss_via_url_validation_bypass_w_dashboard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_process_injection_forwarder_bundle_downloads_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_configuration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_selfsigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_protocol_impersonation_weak_encryption_simplerequest_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rbac_bypass_on_indexing_preview_rest_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rce_pdfgen_render_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rce_via_external_lookup_copybuckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rce_via_serialized_session_payload_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_rce_via_user_xslt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_reflected_xss_in_the_templates_lists_radio_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_reflected_xss_on_app_search_table_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_risky_command_abuse_disclosed_february_2023_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_stored_xss_conf_web_settings_on_premises_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_stored_xss_via_data_model_objectname_field_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_stored_xss_via_specially_crafted_bulletin_message_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unauthenticated_dos_via_null_pointer_references_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unauthenticated_log_injection_web_service_log_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unauthenticated_path_traversal_modules_messaging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unauthorized_experimental_items_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unauthorized_notification_input_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_user_enumeration_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_in_highlighted_json_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_in_monitoring_console_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_in_save_table_dialog_header_in_search_page_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_privilege_escalation_via_custom_urls_in_dashboard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_via_external_urls_in_dashboards_ssrf_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_xss_via_view_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_email_attachment_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_java_classes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_servers_executing_suspicious_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_infrastructure_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_destroyed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_instances_launched_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_number_of_cloud_security_group_api_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[amazon_eks_kubernetes_cluster_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[amazon_eks_kubernetes_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_defense_evasion_delete_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_defense_evasion_delete_cloudwatch_log_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_defense_evasion_impair_security_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_defense_evasion_stop_logging_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_defense_evasion_update_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_ecr_container_upload_outside_business_hours_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_ecr_container_upload_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_iam_delete_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_iam_failure_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_iam_successful_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ami_attribute_modification_for_exfiltration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_console_login_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_create_policy_version_to_allow_all_resources_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_createaccesskey_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_createloginprofile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_credential_access_failed_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_credential_access_getpassworddata_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_credential_access_rds_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cross_account_activity_from_previously_unseen_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_delete_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_delete_cloudwatch_log_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_impair_security_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_putbucketlifecycle_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_stop_logging_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_defense_evasion_update_cloudtrail_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_attach_to_role_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_permanent_key_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_role_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_sts_assume_role_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_sts_get_session_token_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_users_creating_keys_with_encrypt_policy_without_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_detect_users_with_kms_keys_performing_encryption_s3_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_disable_bucket_versioning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ec2_snapshot_shared_externally_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_scanning_findings_high_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_scanning_findings_low_informational_unknown_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_scanning_findings_medium_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_upload_outside_business_hours_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_ecr_container_upload_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_exfiltration_via_anomalous_getobject_api_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_exfiltration_via_batch_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_exfiltration_via_bucket_replication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_exfiltration_via_datasync_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_exfiltration_via_ec2_snapshot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_high_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_iam_accessdenied_discovery_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_iam_assume_role_policy_brute_force_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_iam_delete_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_iam_failure_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_iam_successful_group_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_lambda_updatefunctioncode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_network_access_control_list_created_with_all_open_ports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_network_access_control_list_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_password_policy_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_s3_exfiltration_behavior_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_saml_access_by_provider_user_and_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_saml_update_identity_provider_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_setdefaultpolicyversion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_successful_console_authentication_from_multiple_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_updateloginprofile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_active_directory_high_risk_sign_in_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_admin_consent_bypassed_by_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_application_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_authentication_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_block_user_consent_for_risky_apps_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_device_code_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_external_guest_user_invited_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_fullaccessasapp_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_global_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_high_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multi_source_failed_authentications_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_appids_and_useragents_authentication_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_denied_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_service_principals_created_by_sp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_service_principals_created_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_custom_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_federated_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_mfa_method_registered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_new_mfa_method_registered_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_oauth_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_pim_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_pim_role_assignment_activated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_privileged_authentication_administrator_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_privileged_graph_api_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_privileged_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_privileged_role_assigned_to_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_service_principal_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_service_principal_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_service_principal_new_client_credentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_service_principal_owner_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_successful_authentication_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_successful_powershell_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_tenant_wide_admin_consent_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_consent_blocked_for_risky_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_consent_denied_for_oauth_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_enabled_and_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_ad_user_immutableid_attribute_updated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_automation_account_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_automation_runbook_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[azure_runbook_webhook_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[circle_ci_disable_security_job_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[circle_ci_disable_security_step_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_api_calls_from_previously_unseen_user_roles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_compute_instance_created_by_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_compute_instance_created_in_previously_unused_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_compute_instance_created_with_previously_unseen_image_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_compute_instance_created_with_previously_unseen_instance_type_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_instance_modified_by_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_provisioning_activity_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_provisioning_activity_from_previously_unseen_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_provisioning_activity_from_previously_unseen_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_provisioning_activity_from_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_security_groups_modifications_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_new_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_user_from_new_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_user_from_new_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_console_login_by_user_from_new_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_gcp_storage_access_from_a_new_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_open_gcp_storage_buckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_open_s3_buckets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_open_s3_buckets_over_aws_cli_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_s3_access_from_a_new_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_security_hub_alerts_for_ec2_instance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_security_hub_alerts_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_blocked_outbound_traffic_from_your_aws_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_s3_bucket_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_authentication_failed_during_mfa_challenge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_gcploit_framework_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_kubernetes_cluster_pod_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_multi_factor_authentication_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_successful_single_factor_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_unusual_number_of_failed_authentications_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gdrive_suspicious_file_sharing_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_actions_disable_security_workflow_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_commit_changes_in_master_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_commit_in_develop_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_dependabot_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[github_pull_request_from_unknown_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_drive_share_in_external_email_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_suspicious_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_suspicious_subject_with_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_email_with_known_abuse_web_service_link_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_outbound_email_with_attachment_to_external_domain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_suspicious_calendar_invite_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gsuite_suspicious_shared_file_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[high_number_of_login_failures_from_a_single_source_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_abuse_of_secret_by_unusual_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_abuse_of_secret_by_unusual_user_agent_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_abuse_of_secret_by_unusual_user_group_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_abuse_of_secret_by_unusual_user_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_access_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_anomalous_inbound_network_activity_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_anomalous_inbound_outbound_network_io_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_anomalous_inbound_to_outbound_network_io_ratio_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_anomalous_outbound_network_activity_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_anomalous_traffic_on_network_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_aws_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_create_or_update_privileged_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_cron_job_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_daemonset_deployed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_falco_shell_spawned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_newly_seen_tcp_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_newly_seen_udp_edge_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_nginx_ingress_lfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_nginx_ingress_rfi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_node_port_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_pod_created_in_default_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_pod_with_host_network_attachment_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_previously_unseen_container_image_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_previously_unseen_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_process_running_from_new_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_process_with_anomalous_resource_utilisation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_process_with_resource_ratio_anomalies_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_scanner_image_pulling_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_scanning_by_unauthenticated_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_shell_running_on_worker_node_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_shell_running_on_worker_node_with_cpu_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_suspicious_image_pulling_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_unauthorized_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_add_app_role_assignment_grant_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_added_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_admin_consent_bypassed_by_service_principal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_advanced_audit_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_application_registration_owner_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_applicationimpersonation_role_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_block_user_consent_for_risky_apps_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_bypass_mfa_via_trusted_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_compliance_content_search_exported_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_compliance_content_search_started_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_concurrent_sessions_from_different_ips_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_disable_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_elevated_mailbox_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_excessive_authentication_failures_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_excessive_sso_logon_errors_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_file_permissioned_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_fullaccessasapp_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_high_number_of_failed_authentications_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_high_privilege_role_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mail_permissioned_application_consent_granted_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mailbox_email_forwarding_enabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mailbox_folder_read_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mailbox_folder_read_permission_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mailbox_inbox_folder_shared_with_all_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_mailbox_read_access_granted_to_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multi_source_failed_authentications_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_appids_and_useragents_authentication_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_failed_mfa_requests_for_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_mailboxes_accessed_via_api_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_service_principals_created_by_sp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_service_principals_created_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_multiple_users_failing_to_authenticate_from_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_new_email_forwarding_rule_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_new_email_forwarding_rule_enabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_new_federated_domain_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_new_forwarding_mailflow_rule_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_new_mfa_method_registered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_oauth_app_mailbox_access_via_ews_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_oauth_app_mailbox_access_via_graph_api_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_privileged_graph_api_permission_assigned_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_pst_export_alert_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_security_and_compliance_alert_triggered_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_service_principal_new_client_credentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_tenant_wide_admin_consent_granted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_user_consent_blocked_for_risky_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_user_consent_denied_for_oauth_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[risk_rule_for_dev_sec_ops_by_repository_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_launched_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_launched_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_terminated_by_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[abnormally_high_aws_instances_terminated_by_user___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_createaccesskey_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_excessive_security_scanning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[asl_aws_password_policy_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_city_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_country_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_ip_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_cloud_provisioning_from_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[aws_eks_kubernetes_cluster_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clients_connecting_to_multiple_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cloud_network_access_control_list_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_repository_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[correlation_by_user_and_risk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_activity_related_to_pass_the_hash_attacks_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_api_activity_from_users_without_mfa_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_aws_api_activities_from_unapproved_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_long_dns_txt_record_response_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mimikatz_using_loaded_images_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mimikatz_via_powershell_and_eventcode_4703_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_api_calls_from_user_roles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_user_aws_console_login_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_aws_api_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_network_acl_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_spike_in_security_group_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_usb_device_insertion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_web_traffic_to_dynamic_domain_providers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detection_of_dns_tunnels_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_query_requests_resolved_by_unauthorized_dns_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_record_changed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dump_lsass_via_procdump_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_modified_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_in_previously_unseen_region_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_ami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_instance_type_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ec2_instance_started_with_previously_unseen_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[execution_of_file_with_spaces_before_extension_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[extended_period_without_successful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[first_time_seen_command_line_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_accounts_with_high_risk_roles_by_project_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_high_risk_permissions_by_resource_and_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_detect_oauth_token_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gcp_kubernetes_cluster_scan_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[identify_new_user_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_aws_detect_most_active_service_accounts_by_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_aws_detect_rbac_authorization_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_aws_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_active_service_accounts_by_pod_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_rbac_authorization_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_pod_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_azure_scan_fingerprint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_most_active_service_accounts_by_pod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_rbac_authorizations_by_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_sensitive_object_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_sensitive_role_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_service_accounts_forbidden_failure_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kubernetes_gcp_detect_suspicious_kubectl_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_dns_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[multiple_okta_users_with_invalid_credentials_from_the_same_ip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_suspicious_admin_email_forwarding_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_suspicious_rights_delegation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[o365_suspicious_user_email_forwarding_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_account_locked_out_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_account_lockout_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_failed_sso_attempts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_threatinsight_login_failure_with_high_unknown_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_threatinsight_suspected_passwordspray_attack_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[okta_two_or_more_rejected_okta_pushes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[open_redirect_in_splunk_web_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[osquery_pack___coldroot_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_created_by_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[prohibited_software_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[reg_exe_used_to_hide_files_directories_via_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_registry_key_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[scheduled_tasks_used_in_badrabbit_ransomware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spectre_and_meltdown_vulnerable_systems_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_enterprise_information_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_changes_to_file_associations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_email___uba_anomaly_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_powershell_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_rundll32_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_writes_to_system_volume_information_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[uncommon_processes_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unsigned_image_loaded_by_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unsuccessful_netbackup_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_fraud___account_harvesting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_fraud___anomalous_user_clickspeed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_fraud___password_sharing_across_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_connhost_exe_started_forcefully_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dll_search_order_hijacking_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hosts_file_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[3cx_supply_chain_attack_network_indicators_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[7zip_commandline_to_smb_share_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[access_lsass_memory_for_dump_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[account_discovery_with_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[active_directory_lateral_movement_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[active_directory_privilege_escalation_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[active_setup_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[add_defaultuser_and_password_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[add_or_set_windows_defender_exclusion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[adsisearcher_account_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_file_and_printing_sharing_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_inbound_traffic_by_firewall_rule_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_inbound_traffic_in_firewall_rule_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_network_discovery_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[allow_operation_with_consent_admin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[anomalous_usage_of_7zip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[any_powershell_downloadfile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[any_powershell_downloadstring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[attacker_tools_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[attempt_to_add_certificate_to_untrusted_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[attempt_to_stop_security_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[attempted_credential_dump_from_registry_via_reg_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[auto_admin_logon_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[batch_file_write_to_system32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[bcdedit_command_back_to_normal_mode_boot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[bcdedit_failure_recovery_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[bits_job_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[bitsadmin_download_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[certutil_download_with_urlcache_and_split_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[certutil_download_with_verifyctl_and_split_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[certutil_exe_certificate_extraction_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[certutil_with_decode_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[change_default_file_association_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[change_to_safe_mode_with_network_config_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[chcp_command_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[check_elevated_cmd_using_whoami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[child_processes_of_spoolsv_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clear_unallocated_sector_using_cipher_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clop_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[clop_ransomware_known_service_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cmd_carry_out_string_command_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cmd_echo_pipe___escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cmdline_tool_not_executed_in_cmd_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cmlua_or_cmstplua_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cobalt_strike_named_pipes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[common_ransomware_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[common_ransomware_notes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[connectwise_screenconnect_path_traversal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[connectwise_screenconnect_path_traversal_windows_sacl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[conti_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[control_loading_from_world_writable_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[create_local_admin_accounts_using_net_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[create_or_delete_windows_shares_using_net_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[create_remote_thread_in_shell_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[create_remote_thread_into_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[creation_of_lsass_dump_with_taskmgr_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[creation_of_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[creation_of_shadow_copy_with_wmic_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[credential_dumping_via_copy_command_from_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[credential_dumping_via_symlink_to_shadow_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[csc_net_on_the_fly_compilation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[curl_download_and_bash_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[delete_shadowcopy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[deleting_of_net_users_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[deleting_shadow_copies_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_azurehound_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_azurehound_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_baron_samedit_cve_2021_3156_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_baron_samedit_cve_2021_3156_segfault_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_baron_samedit_cve_2021_3156_via_osquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_certify_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_certify_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_certipy_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_computer_changed_with_anonymous_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_copy_of_shadowcopy_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_credential_dumping_through_lsass_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_empire_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_excessive_account_lockouts_from_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_excessive_user_account_lockouts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_exchange_web_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_html_help_renamed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_html_help_spawn_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_html_help_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_html_help_using_infotech_storage_handlers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mimikatz_with_powershell_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mshta_inline_hta_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mshta_renamed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_mshta_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_new_local_admin_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_outlook_exe_writing_a_zip_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_path_interception_by_creation_of_program_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_processes_used_for_system_network_configuration_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_prohibited_applications_spawning_cmd_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_psexec_with_accepteula_flag_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rare_executables_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rclone_command_line_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regasm_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regasm_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regasm_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regsvcs_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regsvcs_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regsvcs_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_regsvr32_application_control_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_fileinfo_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_renamed_7_zip_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_renamed_psexec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_renamed_rclone_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_renamed_winrar_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rtlo_in_file_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rtlo_in_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rundll32_application_control_bypass___advpack_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rundll32_application_control_bypass___setupapi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rundll32_application_control_bypass___syssetup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rundll32_inline_hta_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_sharphound_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_sharphound_file_modifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_sharphound_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_suspicious_processnames_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_use_of_cmd_exe_to_launch_script_interpreters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_webshell_exploit_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_wmi_event_subscription_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detection_of_tools_built_by_nirsoft_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_amsi_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_antivirus_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_blockatfirstseen_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_enhanced_notification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_mpengine_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_spynet_reporting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_defender_submit_samples_consent_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_etw_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_logs_using_wevtutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_registry_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_schedule_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_security_logs_using_minint_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_show_hidden_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_uac_remote_restriction_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_windows_app_hotkeys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_windows_behavior_monitoring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disable_windows_smartscreen_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabled_kerberos_pre_authentication_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_cmd_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_controlpanel_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_defender_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_firewall_with_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_folderoptions_windows_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_net_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_norun_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_remote_user_account_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_systemrestore_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_task_manager_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[disabling_windows_local_security_authority_defences_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dllhost_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_exfiltration_using_nslookup_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_account_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_account_discovery_with_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_account_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_controller_discovery_with_nltest_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_controller_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_group_discovery_with_adsisearcher_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_group_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_group_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[domain_group_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[download_files_using_telegram_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[drop_icedid_license_dat_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dsquery_domain_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dump_lsass_via_comsvcs_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dump_lsass_via_procdump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[elevated_group_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[elevated_group_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[elevated_group_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[enable_rdp_in_other_port_number_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[enable_wdigest_uselogoncredential_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[enumerate_users_local_group_using_telegram_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[esentutl_sam_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[etw_registry_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[eventvwr_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excel_spawning_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excel_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_attempt_to_disable_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_distinct_processes_from_windows_temp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_file_deletion_in_windefender_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_number_of_service_control_start_as_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_number_of_taskhost_processes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_service_stop_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_usage_of_cacls_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_usage_of_net_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_usage_of_nslookup_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_usage_of_sc_service_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_usage_of_taskkill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[exchange_powershell_abuse_via_ssrf_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[exchange_powershell_module_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[executable_file_written_in_administrative_smb_share_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[executables_or_script_creation_in_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[execute_javascript_with_jscript_com_clsid_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[execution_of_file_with_multiple_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[extraction_of_registry_hives_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[file_with_samsam_extension_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[firewall_allowed_program_enable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[first_time_seen_child_process_of_zoom_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[first_time_seen_running_windows_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[fodhelper_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[fsutil_zeroing_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_addefaultdomainpasswordpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_aduser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_aduser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_aduserresultantpasswordpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_aduserresultantpasswordpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domainpolicy_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domainpolicy_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domaintrust_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domaintrust_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domainuser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_domainuser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_foresttrust_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_foresttrust_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_wmiobject_group_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[get_wmiobject_group_discovery_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getadcomputer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getadcomputer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getadgroup_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getadgroup_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getcurrent_user_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getcurrent_user_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaincomputer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaincomputer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaincontroller_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaincontroller_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaingroup_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getdomaingroup_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getlocaluser_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getlocaluser_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getnettcpconnection_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getnettcpconnection_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_computer_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_computer_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_group_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_group_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_user_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_ds_user_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_user_account_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[getwmiobject_user_account_with_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[gpupdate_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[headless_browser_mockbin_or_mocky_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[headless_browser_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[hide_user_account_from_sign_in_screen_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[hiding_files_and_directories_with_attrib_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[high_frequency_copy_of_files_in_network_share_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[high_process_termination_frequency_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[hunting_3cxdesktopapp_software_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[icacls_deny_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[icacls_grant_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[icedid_exfiltrated_archived_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[impacket_lateral_movement_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[impacket_lateral_movement_smbexec_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[impacket_lateral_movement_wmiexec_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[interactive_session_on_remote_endpoint_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[java_class_file_download_by_java_user_agent_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[java_writing_jsp_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jscript_execution_using_cscript_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberoasting_spn_request_with_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberos_pre_authentication_flag_disabled_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberos_service_ticket_request_using_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberos_tgt_request_using_rc4_encryption_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[kerberos_user_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[known_services_killed_by_ransomware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_account_manipulation_of_ssh_config_and_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_add_files_in_known_crontab_directories_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_add_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_adding_crontab_using_list_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_apt_get_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_apt_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_at_allow_config_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_at_application_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_awk_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_busybox_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_c89_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_c99_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_change_file_owner_to_root_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_clipboard_data_copy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_common_process_for_elevation_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_composer_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_cpulimit_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_csvtool_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_curl_upload_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_data_destruction_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_dd_file_overwrite_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_decode_base64_to_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_deleting_critical_directory_using_rm_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_deletion_of_cron_jobs_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_deletion_of_init_daemon_script_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_deletion_of_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_deletion_of_ssl_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_disable_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_doas_conf_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_doas_tool_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_docker_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_edit_cron_table_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_emacs_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_file_created_in_kernel_driver_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_file_creation_in_init_boot_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_file_creation_in_profile_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_find_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_gdb_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_gem_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_gnu_awk_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_hardware_addition_swapoff_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_high_frequency_of_file_deletion_in_boot_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_high_frequency_of_file_deletion_in_etc_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_impair_defenses_process_kill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_indicator_removal_clear_cache_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_indicator_removal_service_file_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ingress_tool_transfer_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ingress_tool_transfer_with_curl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_insert_kernel_module_using_insmod_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_install_kernel_module_using_modprobe_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_iptables_firewall_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_java_spawning_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_kernel_module_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_kworker_process_in_writable_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_make_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_mysql_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ngrok_reverse_proxy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_node_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_nopasswd_entry_in_sudoers_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_obfuscated_files_or_information_base64_decode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_octave_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_openvpn_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_persistence_and_privilege_escalation_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_php_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_pkexec_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_access_or_modification_of_sshd_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_access_to_credential_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_access_to_sudoers_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_append_command_to_at_allow_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_append_command_to_profile_config_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_cronjob_modification_with_editor_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_possible_ssh_key_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_preload_hijack_library_calls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_proxy_socks_curl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_puppet_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_rpm_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ruby_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_service_file_created_in_systemd_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_service_restarted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_service_started_or_enabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_setuid_using_chmod_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_setuid_using_setcap_utility_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_shred_overwrite_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_sqlite3_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ssh_authorized_keys_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_ssh_remote_services_script_execute_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_stdout_redirection_to_dev_null_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_stop_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_sudo_or_su_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_sudoers_tmp_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_system_network_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_system_reboot_via_system_request_key_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_unix_shell_enable_all_sysrq_functions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[linux_visudo_utility_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[living_off_the_land_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[loading_of_dynwrapx_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[local_account_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[local_account_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[log4shell_cve_2021_44228_exploitation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[logon_script_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[lolbas_with_network_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[macos___re_opened_applications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[macos_lolbin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[macos_plutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mailsniper_invoke_functions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_executed_as_a_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process___encoded_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process___execution_policy_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[malicious_powershell_process_with_obfuscation_techniques_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mimikatz_passtheticket_commandline_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mmc_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[modification_of_wallpaper_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[modify_acl_permission_to_files_or_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_registry_keys_for_print_monitors_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ms_scripting_process_loading_ldap_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ms_scripting_process_loading_wmi_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[msbuild_suspicious_spawned_by_script_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mshta_spawning_rundll32_or_regsvr32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[mshtml_module_load_in_office_product_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[msi_module_loaded_by_non_system_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[msmpeng_application_dll_side_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[net_localgroup_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[net_profiler_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_connection_discovery_with_arp_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_connection_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_connection_discovery_with_netstat_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_discovery_using_route_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_share_discovery_via_dir_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[network_traffic_to_active_directory_web_services_protocol_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[nishang_powershelltcponeline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[nltest_domain_trust_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[non_chrome_process_accessing_chrome_default_dir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[non_firefox_process_access_firefox_profile_dir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[notepad_with_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ntdsutil_export_ntds_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_application_drop_executable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_application_spawn_regsvr32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_application_spawn_rundll32_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_document_creating_schedule_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_document_executing_macro_code_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_document_spawned_child_process_to_download_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawn_cmd_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_bitsadmin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_certutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_mshta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_rundll32_with_no_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_spawning_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_product_writing_cab_or_inf_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[office_spawning_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[outbound_network_connection_from_java_using_default_ports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[overwriting_accessibility_binaries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[papercut_ng_suspicious_behavior_debug_log_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[password_policy_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[permission_modification_using_takeown_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[petitpotam_network_share_access_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[petitpotam_suspicious_kerberos_tgt_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ping_sleep_batch_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[possible_browser_pass_view_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[possible_lateral_movement_powershell_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[potential_password_in_username_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[potentially_malicious_code_on_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_4104_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell___connect_to_internet_with_hidden_window_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_com_hijacking_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_creating_thread_mutex_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_disable_security_monitoring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_domain_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_enable_powershell_remoting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_enable_smb1protocol_feature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_execute_com_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_fileless_process_injection_via_getprocaddress_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_fileless_script_contains_base64_encoded_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_get_localgroup_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_get_localgroup_discovery_with_script_block_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_invoke_cimmethod_cimsession_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_invoke_wmiexec_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_load_module_in_meterpreter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_loading_dotnet_into_memory_via_reflection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_processing_stream_of_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_remote_services_add_trustedhost_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_remote_thread_to_known_windows_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_remove_windows_defender_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_script_block_with_url_chain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_start_bitstransfer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_start_or_stop_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_using_memory_as_backing_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_webrequest_using_memory_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[powershell_windows_defender_exclusion_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[prevent_automatic_repair_mode_using_bcdedit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[print_processor_registry_autostart_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[print_spooler_adding_a_printer_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[print_spooler_failed_to_load_a_plug_in_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_creating_lnk_file_in_suspicious_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_deleting_its_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_kill_base_on_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[process_writing_dynamicwrapperx_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_launching_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[processes_tapping_keyboard_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[randomly_generated_scheduled_task_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[randomly_generated_windows_service_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ransomware_notes_bulk_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[recon_avproduct_through_pwh_or_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[recon_using_wmi_class_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[recursive_delete_of_directory_in_batch_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[reg_exe_manipulating_windows_services_registry_keys_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[registry_keys_for_creating_shim_databases_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[registry_keys_used_for_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[registry_keys_used_for_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[regsvr32_silent_and_install_param_dll_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[regsvr32_with_known_silent_switch_cmdline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remcos_client_registry_install_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remcos_rat_file_creation_in_remcos_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_desktop_process_running_on_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_dcom_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_dcom_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_winrm_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_winrm_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_winrm_and_winrs_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_wmi_and_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_process_instantiation_via_wmi_and_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_system_discovery_with_adsisearcher_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_system_discovery_with_dsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_system_discovery_with_net_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_system_discovery_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_wmi_command_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[resize_shadowstorage_volume_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[revil_common_exec_parameter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[revil_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rubeus_command_line_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rubeus_kerberos_ticket_exports_through_winlogon_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[runas_execution_in_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_control_rundll_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_control_rundll_world_writable_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_create_remote_thread_to_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_createremotethread_in_browser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_dnsquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_lockworkstation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_process_creating_exe_dll_files_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_shimcache_flush_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll32_with_no_command_line_arguments_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[rundll_loading_dll_by_ordinal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ryuk_test_files_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ryuk_wake_on_lan_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sam_database_file_access_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[samsam_test_file_write_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sc_exe_manipulating_windows_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schcache_change_by_app_connect_and_create_adsi_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schedule_task_with_http_command_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schedule_task_with_rundll32_command_trigger_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[scheduled_task_creation_on_remote_endpoint_using_at_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[scheduled_task_deleted_or_created_via_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[scheduled_task_initiation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schtasks_run_task_on_demand_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schtasks_scheduling_job_on_remote_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[schtasks_used_for_forcing_a_reboot_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[screensaver_event_trigger_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[script_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sdclt_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sdelete_application_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[searchprotocolhost_with_no_command_line_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[secretdumps_offline_ntds_dumping_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[serviceprincipalnames_discovery_with_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[serviceprincipalnames_discovery_with_setspn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[services_escalate_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[services_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[shim_database_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[shim_database_installation_with_suspicious_parameters_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[short_lived_scheduled_task_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[short_lived_windows_accounts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[silentcleanup_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[single_letter_process_on_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[slui_runas_elevated_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[slui_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spike_in_file_writes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spoolsv_spawning_rundll32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spoolsv_suspicious_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spoolsv_suspicious_process_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spoolsv_writing_a_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spoolsv_writing_a_dll___sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sqlite_module_in_temp_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[steal_or_forge_authentication_certificates_behavior_identified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sunburst_correlation_dll_and_network_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_computer_account_name_change_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_copy_on_system32_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_curl_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_dllhost_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_driver_loaded_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_event_log_service_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_gpupdate_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_icedid_rundll32_cmdline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_image_creation_in_appdata_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_kerberos_service_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_linux_discovery_commands_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_microsoft_workflow_compiler_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_microsoft_workflow_compiler_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_msbuild_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_msbuild_rename_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_msbuild_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_mshta_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_mshta_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_plistbuddy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_plistbuddy_usage_via_osquery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_process_dns_query_known_abuse_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_process_executed_from_container_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_process_with_discord_dns_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_reg_exe_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_regsvr32_register_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_rundll32_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_rundll32_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_rundll32_plugininit_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_rundll32_startw_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_scheduled_task_from_public_directory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_searchprotocolhost_no_command_line_arguments_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_sqlite3_lsquarantine_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_ticket_granting_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_wav_file_in_appdata_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_wevtutil_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[suspicious_writes_to_windows_recycle_bin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[svchost_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[system_info_gathering_using_dxdiag_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[system_information_discovery_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[system_processes_run_from_unexpected_locations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[system_user_discovery_with_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[system_user_discovery_with_whoami_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[time_provider_persistence_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[trickbot_named_pipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[uac_bypass_mmc_load_unsigned_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[uac_bypass_with_colorui_com_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[uninstall_app_using_msiexec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unknown_process_using_the_kerberos_protocol_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unload_sysmon_filter_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unloading_amsi_via_reflection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusual_number_of_computer_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusual_number_of_kerberos_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusual_number_of_remote_endpoint_authentication_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusually_long_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusually_long_command_line___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[user_discovery_with_env_vars_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[user_discovery_with_env_vars_powershell_script_block_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[usn_journal_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[vbscript_execution_using_wscript_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[verclsid_clsid_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[w3wp_spawning_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wbadmin_delete_system_backups_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wbemprox_com_object_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wermgr_process_connecting_to_ip_check_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wermgr_process_create_executable_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wermgr_process_spawned_cmd_or_powershell_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wget_download_and_bash_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_abused_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_access_token_manipulation_sedebugprivilege_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_access_token_manipulation_winlogon_duplicate_token_handle_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_access_token_winlogon_duplicate_handle_in_uncommon_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_account_discovery_for_none_disable_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_account_discovery_for_sam_account_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_account_discovery_with_netuser_preauthnotrequire_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_abnormal_object_access_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_adminsdholder_acl_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_cross_domain_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_domain_controller_audit_policy_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_domain_controller_promotion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_domain_replication_acl_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_dsrm_account_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_dsrm_password_reset_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_privileged_account_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_privileged_object_access_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_replication_request_initiated_by_user_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_replication_request_initiated_from_unsanctioned_location_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_same_domain_sid_history_addition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_serviceprincipalname_added_to_domain_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_short_lived_domain_account_serviceprincipalname_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_short_lived_domain_controller_spn_attribute_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_short_lived_server_object_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_sid_history_attribute_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_adfind_exe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_admin_permission_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_administrative_shares_accessed_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_admon_default_group_policy_object_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_admon_group_policy_object_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_alternate_datastream___base64_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_alternate_datastream___executable_content_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_alternate_datastream___process_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_apache_benchmark_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_app_layer_protocol_qakbot_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_application_layer_protocol_rms_radmin_tool_namedpipe_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_applocker_block_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_applocker_execution_from_uncommon_locations_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_applocker_privilege_escalation_via_unauthorized_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_applocker_rare_application_launch_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_archive_collected_data_via_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_archive_collected_data_via_rar_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_autoit3_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_autostart_execution_lsass_driver_registry_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_binary_proxy_execution_mavinject_dll_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_boot_or_logon_autostart_execution_in_startup_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_bootloader_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_bypass_uac_via_pkgmgr_tool_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_cab_file_on_disk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_cached_domain_credentials_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_change_default_file_association_for_no_file_ext_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_clipboard_data_via_get_clipboard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_com_hijacking_inprocserver32_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_command_and_scripting_interpreter_hunting_path_traversal_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_command_and_scripting_interpreter_path_traversal_exec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_command_shell_dcrat_forkbomb_payload_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_command_shell_fetch_env_variables_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_common_abused_cmd_shell_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_computer_account_created_by_computer_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_computer_account_requesting_kerberos_ticket_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_computer_account_with_spn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_conhost_with_headless_argument_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_create_local_account_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credential_access_from_browser_password_store_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credential_dumping_lsass_memory_createdump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_chrome_extension_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_chrome_localstate_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_chrome_login_data_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_from_password_stores_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_credentials_in_registry_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_curl_download_to_suspicious_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_curl_upload_to_remote_destination_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_data_destruction_recursive_exec_files_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_debugger_tool_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defacement_modify_transcodedwallpaper_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_default_group_policy_object_modified_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_default_group_policy_object_modified_with_gpme_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_asr_audit_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_asr_block_events_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_asr_registry_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_asr_rule_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_asr_rules_stacking_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_defender_exclusion_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_delete_or_modify_system_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_deleted_registry_by_a_non_critical_process_file_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_change_password_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_lock_workstation_feature_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_logoff_button_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_memory_crash_dump_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_notification_center_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_or_modify_tools_via_taskkill_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_shutdown_button_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_windows_event_logging_disable_http_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disable_windows_group_policy_features_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_disableantispyware_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_diskcryptor_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_diskshadow_proxy_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dism_remove_defender_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dll_search_order_hijacking_hunt_with_sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dll_search_order_hijacking_with_iscsicpl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dll_side_loading_in_calc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dll_side_loading_process_child_of_calc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dns_gather_network_info_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dnsadmins_new_member_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_domain_account_discovery_via_get_netcomputer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_domain_admin_impersonation_indicator_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_dotnet_binary_in_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_driver_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_driver_load_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_drivers_loaded_by_signature_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_enable_win32_scheduledjob_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_event_for_service_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_event_log_cleared_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_event_triggered_image_file_execution_options_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_excessive_disabled_services_event_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_executable_in_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_execute_arbitrary_commands_with_msdt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_exfiltration_over_c2_via_invoke_restmethod_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_exfiltration_over_c2_via_powershell_uploadstring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_file_share_discovery_with_powerview_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_file_transfer_protocol_in_non_common_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_file_without_extension_in_critical_folder_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_files_and_dirs_access_rights_modification_via_icacls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_find_domain_organizational_units_with_getdomainou_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_find_interesting_acl_with_findinterestingdomainacl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_findstr_gpp_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_forest_discovery_with_getforestdomain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_gather_victim_host_information_camera_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_gather_victim_identity_sam_info_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_gather_victim_network_info_through_ip_check_web_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_get_adcomputer_unconstrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_get_local_admin_with_findlocaladminaccess_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_group_policy_object_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hidden_schedule_task_settings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hide_notification_features_through_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_high_file_deletion_frequency_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hijack_execution_flow_version_dll_side_load_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_hunting_system_account_targeting_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_identify_protocol_handlers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_iis_components_add_new_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_iis_components_get_webglobalmodule_module_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_iis_components_module_failed_to_load_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_iis_components_new_module_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_add_xml_applocker_rules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_change_win_defender_health_check_intervals_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_change_win_defender_quick_scan_interval_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_change_win_defender_throttle_rate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_change_win_defender_tracing_level_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_configure_app_install_control_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_define_win_defender_threat_action_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_delete_win_defender_context_menu_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_delete_win_defender_profile_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_deny_security_software_with_applocker_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_controlled_folder_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_defender_firewall_and_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_defender_protocol_recognition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_pua_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_realtime_signature_delivery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_web_evaluation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_app_guard_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_compute_file_hashes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_gen_reports_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_network_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_report_infection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_scan_on_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_disable_win_defender_signature_retirement_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_overide_win_defender_phishing_filter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_override_smartscreen_prompt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defense_set_win_defender_smart_screen_level_to_warn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defenses_disable_hvci_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_impair_defenses_disable_win_defender_auto_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_indicator_removal_via_rmdir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_indirect_command_execution_via_forfiles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_indirect_command_execution_via_pcalua_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_indirect_command_execution_via_series_of_forfiles_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_information_discovery_fsutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ingress_tool_transfer_using_explorer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_inprocserver32_new_outlook_form_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_input_capture_using_credential_ui_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_credential_theft_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_in_non_standard_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_remote_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_uninstall_option_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_uninstall_option_with_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_installutil_url_in_command_line_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_iso_lnk_file_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_java_spawning_shells_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_kerberos_local_successful_logon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_known_abused_dll_created_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_known_graphicalproton_loaded_modules_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_krbrelayup_service_creation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_large_number_of_computer_service_tickets_requested_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_lateral_tool_transfer_remcom_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ldifde_directory_object_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_linked_policies_in_adsi_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_local_administrator_credential_stuffing_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_lsa_secrets_nolmhash_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mail_protocol_in_non_common_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mark_of_the_web_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_masquerading_explorer_as_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_masquerading_msdtc_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mimikatz_binary_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mimikatz_crypto_export_file_extensions_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_authenticationleveloverride_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_auto_minor_updates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_auto_update_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_default_icon_setting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disable_restricted_admin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disable_toast_notifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disable_win_defender_raw_write_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disable_windefender_notifications_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disable_windows_security_center_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disableremotedesktopantialias_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disablesecuritysettings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disabling_wer_settings_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_disallow_windows_app_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_do_not_connect_to_win_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_dontshowui_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_enablelinkedconnections_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_longpathsenabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_maxconnectionperserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_no_auto_reboot_with_logon_user_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_no_auto_update_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_nochangingwallpaper_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_proxyenable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_proxyserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_qakbot_binary_data_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_reg_restore_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_regedit_silent_reg_import_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_suppress_win_defender_notif_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_tamper_protection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_updateserviceurlalternate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_usewuserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_with_md5_reg_key_name_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_wuserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_registry_wustatusserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_show_compress_color_and_info_tip_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_modify_system_firewall_with_notable_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mof_event_triggered_execution_via_wmi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_moveit_transfer_writing_aspx_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msexchange_management_mailbox_cmdlet_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mshta_execution_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_mshta_writing_to_world_writable_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_hidewindow_rundll32_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_remote_download_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_spawn_discovery_command_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_spawn_windbg_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_unregister_dllregisterserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_msiexec_with_network_connections_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multi_hop_proxy_tor_website_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_account_passwords_changed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_accounts_deleted_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_accounts_disabled_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_users_failed_to_authenticate_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_users_failed_to_authenticate_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_multiple_users_remotely_failed_to_authenticate_from_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_new_inprocserver32_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ngrok_reverse_proxy_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_nirsoft_advancedrun_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_nirsoft_utilities_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_njrat_fileless_storage_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_non_discord_app_access_discord_leveldb_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_non_system_account_targeting_lsass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_odbcconf_hunting_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_odbcconf_load_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_odbcconf_load_response_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_office_product_spawning_msdt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_papercut_ng_spawn_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_parent_pid_spoofing_with_explorer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_password_managers_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_phishing_outlook_drop_dll_in_form_dir_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_phishing_pdf_file_executes_url_link_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_phishing_recent_iso_exec_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_possible_credential_dumping_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_post_exploitation_risk_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_add_module_to_global_assembly_cache_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_cryptography_namespace_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_disable_http_logging_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_export_pfxcertificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_get_ciminstance_remote_computer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_iis_components_webglobalmodule_usage_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_import_applocker_policy_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_remotesigned_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_scheduletask_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powershell_wmi_win32_scheduledjob_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powersploit_gpp_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powerview_ad_access_control_list_enumeration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powerview_constrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powerview_kerberos_service_ticket_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powerview_spn_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_powerview_unconstrained_delegation_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_private_keys_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_privilege_escalation_suspicious_process_elevation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_privilege_escalation_system_process_without_system_parent_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_privilege_escalation_user_process_spawn_system_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_commandline_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_in_non_service_searchindexer_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_into_notepad_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_of_wermgr_to_known_browser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_remote_thread_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_wermgr_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_injection_with_public_source_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_with_namedpipe_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_process_writing_file_to_world_writable_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_processes_killed_by_industroyer2_malware_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_protocol_tunneling_with_plink_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_proxy_via_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_proxy_via_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_query_registry_browser_list_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_query_registry_reg_save_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_query_registry_uninstall_program_list_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_raccine_scheduled_task_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rapid_authentication_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rasautou_dll_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_raw_access_to_disk_volume_partition_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_raw_access_to_master_boot_record_drive_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rdp_connection_successful_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_bootexecute_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_certificate_added_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_delete_task_sd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_modification_for_safe_mode_persistence_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_payload_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_registry_sip_provider_modification_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_regsvr32_renamed_binary_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_access_software_brc4_loaded_dll_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_access_software_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_access_software_rms_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_assistance_spawning_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_create_service_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_service_rdpwinst_tool_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_services_allow_rdp_in_firewall_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_services_allow_remote_assistance_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_remote_services_rdp_enable_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_replication_through_removable_media_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_root_domain_linked_policies_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rundll32_apply_user_settings_changes_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rundll32_webdav_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_rundll32_webdav_with_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_scheduled_task_created_via_xml_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_scheduled_task_service_spawned_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_scheduled_task_with_highest_privileges_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_schtasks_create_run_as_system_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_screen_capture_via_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_security_account_manager_stopped_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_security_support_provider_reg_query_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_server_software_component_gacutil_install_to_gac_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_create_kernel_mode_driver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_create_remcomsvc_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_create_sliverc2_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_create_with_tscon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_created_with_suspicious_service_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_created_within_public_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_creation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_creation_using_registry_entry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_deletion_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_initiation_on_remote_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_stop_by_deletion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_stop_via_net__and_sc_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_service_stop_win_updates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_sip_provider_inventory_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_sip_winverifytrust_failed_trust_validation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_snake_malware_file_modification_crmlog_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_snake_malware_kernel_driver_comadmin_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_snake_malware_registry_modification_wav_openwithprogids_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_snake_malware_service_create_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_soaphound_binary_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_spearphishing_attachment_onenote_spawn_mshta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_special_privileged_logon_on_multiple_hosts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_sql_spawning_certutil_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_sqlwriter_sqldumper_dll_sideload_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates___esc1_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates___esc1_authentication_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_certificate_issued_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_certificate_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_certutil_backup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_cryptoapi_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_cs_backup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_export_certificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_authentication_certificates_export_pfxcertificate_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_steal_or_forge_kerberos_tickets_klist_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_suspect_process_with_authentication_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_binary_proxy_execution_compiled_html_file_decompile_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_discovery_using_ldap_nslookup_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_discovery_using_qwinsta_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_file_on_disk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_logoff_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_network_config_discovery_display_dns_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_network_connections_discovery_netsh_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_reboot_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_script_proxy_execution_syncappvpublishingserver_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_shutdown_commandline_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_time_discovery_w32tm_delay_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_user_discovery_via_quser_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_system_user_privilege_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_terminating_lsass_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_time_based_evasion_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_time_based_evasion_via_choice_exec_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_uac_bypass_suspicious_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_uac_bypass_suspicious_escalation_behavior_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unsecured_outlook_credentials_access_in_registry_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unsigned_dll_side_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unsigned_dll_side_loading_in_same_process_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unsigned_ms_dll_side_loading_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_disabled_users_failed_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_users_failed_to_authenticate_from_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_user_execution_malicious_url_shortcut_file_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_valid_account_with_never_expires_password_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_vulnerable_3cx_software_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_vulnerable_driver_loaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_windbg_spawning_autoit3_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_winlogon_with_public_network_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_wmi_impersonate_token_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_wmi_process_and_service_list_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_wmi_process_call_create_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winevent_scheduled_task_created_to_spawn_shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winevent_scheduled_task_created_within_public_path_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winevent_windows_task_scheduler_event_action_started_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winhlp32_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winrar_spawning_shell_application_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winrm_spawning_a_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winword_spawning_cmd_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winword_spawning_powershell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[winword_spawning_windows_script_host_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_permanent_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_permanent_event_subscription___sysmon_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_recon_running_process_or_services_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmi_temporary_event_subscription_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmic_group_discovery_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmic_noninteractive_app_uninstallation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmic_xsl_execution_via_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wmiprsve_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wscript_or_cscript_suspicious_child_process_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wsmprovhost_lolbas_execution_process_spawn_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wsreset_uac_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[xmrig_driver_loaded_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[xsl_script_execution_with_wmic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_arp_poisoning_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_dga_domains_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_dns_data_exfiltration_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_hosts_connecting_to_dynamic_domain_providers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_ipv6_network_infrastructure_threats_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_large_outbound_icmp_packets_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_outbound_ldap_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_outbound_smb_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_port_security_violation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_dns_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_rogue_dhcp_server_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_snicat_sni_exfiltration_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_software_download_to_network_device_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_traffic_mirroring_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_unauthorized_assets_by_mac_address_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_windows_dns_sigred_via_splunk_stream_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_windows_dns_sigred_via_zeek_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_zerologon_via_zeek_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_query_length_outliers___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[dns_query_length_with_high_standard_deviation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[excessive_dns_failures_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[high_volume_of_bytes_out_to_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[hosts_receiving_high_volume_of_network_traffic_from_email_server_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[large_volume_of_dns_any_queries_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[multiple_archive_files_http_post_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ngrok_reverse_proxy_on_network_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[plain_http_post_exfiltrated_data_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[prohibited_network_traffic_allowed_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[protocol_or_port_mismatch_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[protocols_passing_authentication_in_cleartext_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_desktop_network_bruteforce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[remote_desktop_network_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[smb_traffic_spike_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[smb_traffic_spike___mltk_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[splunk_identified_ssl_tls_certificates_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ssl_certificates_with_punycode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[tor_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[unusually_long_content_type_length_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_replication_service_traffic_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_ad_rogue_domain_controller_network_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zeek_x509_certificate_with_punycode_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[adobe_coldfusion_access_control_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[adobe_coldfusion_unauthenticated_arbitrary_file_read_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[cisco_ios_xe_implant_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[citrix_adc_and_gateway_unauthorized_data_disclosure_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[citrix_adc_exploitation_cve_2023_3519_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[citrix_sharefile_exploitation_cve_2023_24489_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[confluence_cve_2023_22515_trigger_vulnerability_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[confluence_data_center_and_server_privilege_escalation_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[confluence_pre_auth_rce_via_ognl_injection_cve_2023_22527_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[confluence_unauthenticated_remote_code_execution_cve_2022_26134_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[connectwise_screenconnect_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_attackers_scanning_for_vulnerable_jboss_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_f5_tmui_rce_cve_2020_5902_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_malicious_requests_to_exploit_jboss_servers_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[detect_remote_access_software_usage_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[exploit_public_facing_application_via_apache_commons_text_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[exploit_public_facing_fortinet_fortinac_cve_2022_39952_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[f5_tmui_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[fortinet_appliance_auth_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[hunting_for_log4shell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_connect_secure_command_injection_attempts_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_connect_secure_ssrf_in_saml_component_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_connect_secure_system_information_access_via_auth_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35078_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_epmm_remote_unauthenticated_api_access_cve_2023_35082_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ivanti_sentry_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jenkins_arbitrary_file_read_cve_2024_23897_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jetbrains_teamcity_authentication_bypass_cve_2024_27198_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jetbrains_teamcity_authentication_bypass_suricata_cve_2024_27198_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jetbrains_teamcity_limited_auth_bypass_suricata_cve_2024_27199_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[jetbrains_teamcity_rce_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[juniper_networks_remote_code_execution_exploit_detection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[log4shell_jndi_payload_injection_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[log4shell_jndi_payload_injection_with_outbound_connection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[microsoft_sharepoint_server_elevation_of_privilege_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[monitor_web_traffic_for_brand_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[nginx_connectwise_screenconnect_authentication_bypass_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[papercut_ng_remote_web_access_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[proxyshell_proxynotshell_behavior_detected_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[spring4shell_payload_url_request_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[sql_injection_with_long_urls_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[supernova_webshell_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[vmware_aria_operations_exploit_attempt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[vmware_server_side_template_injection_hunt_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[vmware_workspace_one_freemarker_server_side_template_injection_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_jsp_request_via_url_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_remote_shellservlet_access_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_spring4shell_http_request_class_module_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[web_spring_cloud_function_functionrouter_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[windows_exchange_autodiscover_ssrf_abuse_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[wordpress_bricks_builder_plugin_rce_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[ws_ftp_remote_code_execution_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_adware_activities_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_behavior_analysis_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_cryptominer_downloaded_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_employment_search_web_activity_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_exploit_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_legal_liability_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_malware_activity_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_phishing_activity_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_potentially_abused_file_download_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_privacy_risk_destinations_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_scam_destinations_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
[zscaler_virus_download_threat_blocked_filter]
definition = search *
description = Update this macro to limit the output results to filter out false positives.
Reference in New Issue View Git Blame Copy Permalink