Nasreddine Bencherchali f930b525ee Add New Analytics - February Batch (#3886) ...

* add percent encoded curl exec

* Fix #3916

* Add other calc process names entries

* apply formatting

* add more color

* add cisco sd-wan stuff

* update tags

* Update cisco_sd_wan___low_frequency_rogue_peer.yml

* add ds and maps it

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>

2026-03-03 18:31:37 +05:30

..

3cx_supply_chain_attack_network_indicators.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_configuration_archive_logging_analysis.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_ios_suspicious_privileged_account_creation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_network_interface_modifications.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_privileged_account_creation_with_http_command_execution.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_privileged_account_creation_with_suspicious_ssh_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_sd_wan___low_frequency_rogue_peer.yml

Add New Analytics - February Batch (#3886)

2026-03-03 18:31:37 +05:30

cisco_sd_wan___peering_activity.yml

Add New Analytics - February Batch (#3886)

2026-03-03 18:31:37 +05:30

cisco_secure_firewall___binary_file_type_download.yml

Merge branch 'develop' into yml_validation_cleanups

2026-02-25 11:36:18 -08:00

cisco_secure_firewall___bits_network_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___blocked_connection.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml

Merge branch 'develop' into yml_validation_cleanups

2026-02-25 11:36:18 -08:00

cisco_secure_firewall___communication_over_suspicious_ports.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___connection_to_file_sharing_domain.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___file_download_over_uncommon_port.yml

Merge branch 'develop' into yml_validation_cleanups

2026-02-25 11:36:18 -08:00

cisco_secure_firewall___high_eve_threat_confidence.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___high_priority_intrusion_classification.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___intrusion_events_by_threat_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___lumma_stealer_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___lumma_stealer_download_attempt.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___malware_file_downloaded.yml

Merge branch 'develop' into yml_validation_cleanups

2026-02-25 11:36:18 -08:00

cisco_secure_firewall___oracle_e_business_suite_correlation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___oracle_e_business_suite_exploitation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___possibly_compromised_host.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___potential_data_exfiltration.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___privileged_command_execution_via_http.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___rare_snort_rule_triggered.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___react_server_components_rce_attempt.yml

Merge branch 'develop' into yml_validation_cleanups

2026-02-25 11:36:18 -08:00

cisco_secure_firewall___remote_access_software_usage_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___repeated_blocked_connections.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___repeated_malware_downloads.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___ssh_connection_to_non_standard_port.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___ssh_connection_to_sshd_operns.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___static_tundra_smart_install_abuse.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___wget_or_curl_download.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_smart_install_oversized_packet_detection.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_smart_install_port_discovery_and_status.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_snmp_community_string_configuration_changes.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_tftp_server_configuration_for_data_exfiltration.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_arp_poisoning.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_dns_query_to_decommissioned_s3_bucket.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_hosts_connecting_to_dynamic_domain_providers.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_ipv6_network_infrastructure_threats.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_large_icmp_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_outbound_ldap_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_outbound_smb_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_port_security_violation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_remote_access_software_usage_dns.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_remote_access_software_usage_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_rogue_dhcp_server.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_snicat_sni_exfiltration.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_software_download_to_network_device.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_traffic_mirroring.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_unauthorized_assets_by_mac_address.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_windows_dns_sigred_via_splunk_stream.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_windows_dns_sigred_via_zeek.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_zerologon_via_zeek.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

dns_kerberos_coercion.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

dns_query_length_outliers___mltk.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

dns_query_length_with_high_standard_deviation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

excessive_dns_failures.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

http_c2_framework_user_agent.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

http_malware_user_agent.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

http_pua_user_agent.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

http_rmm_user_agent.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

internal_horizontal_port_scan_nmap_top_20.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

internal_horizontal_port_scan.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

internal_vertical_port_scan.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

internal_vulnerability_scan.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

large_volume_of_dns_any_queries.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

ngrok_reverse_proxy_on_network.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

prohibited_network_traffic_allowed.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

protocol_or_port_mismatch.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

protocols_passing_authentication_in_cleartext.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

remote_desktop_network_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

rundll32_dnsquery.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

smb_traffic_spike___mltk.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

smb_traffic_spike.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

ssl_certificates_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

suspicious_process_dns_query_known_abuse_web_services.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

suspicious_process_with_discord_dns_query.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

tor_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

wermgr_process_connecting_to_ip_check_web_services.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_abused_web_services.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_ad_replication_service_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_ad_rogue_domain_controller_network_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_dns_query_request_by_telegram_bot_api.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_gather_victim_network_info_through_ip_check_web_services.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_multi_hop_proxy_tor_website_query.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_remote_desktop_network_bruteforce_attempt.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

zeek_x509_certificate_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30