Multi-SIEM Detection Rules Explorer

Multi-SIEM Detection Rules Explorer

A unified explorer for detection rules across 9 major security platforms — Elastic, Splunk, Microsoft Sentinel, Google Chronicle, Sigma, Palo Alto Cortex, Wazuh, OpenSearch, and Sumo Logic. Rules are fetched weekly from their official public repositories and normalized for easy browsing.

Filter by Platform:

Tactics

Platforms / Data Sources

Rule Language

Domains

Operating Systems

Techniques

Splunk
AWS Bedrock Claude Cross Region Possible Inference Abuse
Splunk
AWS Bedrock Claude excessive use of tokens
Splunk
AWS Bedrock Claude High Risk Filesystem and Exec Tool Invocation
Splunk
AWS Bedrock Claude Hostile Prompt Sentiment
Splunk
AWS Bedrock Claude Possible Prompt Injection
Splunk
AWS Bedrock Claude Sensitive Data in Prompts
Splunk
AWS Bedrock Claude Unusually Large Prompts
Splunk
Cisco AI Defense Security Alerts by Application Name
Splunk
Cisco ASA - AAA Policy Tampering
Splunk
Cisco ASA - Core Syslog Message Volume Drop
Splunk
Cisco ASA - Device File Copy Activity
Splunk
Cisco ASA - Device File Copy to Remote Location
Splunk
Cisco ASA - Logging Disabled via CLI
Splunk
Cisco ASA - Logging Filters Configuration Tampering
Splunk
Cisco ASA - Logging Message Suppression
Splunk
Cisco ASA - New Local User Account Created
Splunk
Cisco ASA - Packet Capture Activity
Splunk
Cisco ASA - Reconnaissance Command Activity
Splunk
Cisco ASA - User Account Deleted From Local Database
Splunk
Cisco ASA - User Account Lockout Threshold Exceeded
Splunk
Cisco ASA - User Privilege Level Change
Splunk
Cisco Duo Admin Login Unusual Browser
Splunk
Cisco Duo Admin Login Unusual Country
Splunk
Cisco Duo Admin Login Unusual Os
Splunk
Cisco Duo Bulk Policy Deletion
Splunk
Cisco Duo Bypass Code Generation
Splunk
Cisco Duo Policy Allow Devices Without Screen Lock
Splunk
Cisco Duo Policy Allow Network Bypass 2FA
Splunk
Cisco Duo Policy Allow Old Flash
Splunk
Cisco Duo Policy Allow Old Java
Splunk
Cisco Duo Policy Allow Tampered Devices
Splunk
Cisco Duo Policy Bypass 2FA
Splunk
Cisco Duo Policy Deny Access
Splunk
Cisco Duo Policy Skip 2FA for Other Countries
Splunk
Cisco Duo Set User Status to Bypass 2FA
Splunk
Cisco IOS XE Guestshell Activation and Destroy
Splunk
Cisco IOS XE Log Clearing Sequence With Optional Loopback Removal
Splunk
Cisco IOS XE Reconnaissance Command Activity
Splunk
Cisco IOS XE Remote Access Probe Burst
Splunk
Cisco IOS XE Request Platform Package Describe Shell Pattern
Splunk
Cisco IOS XE Tunnel Interface Configuration
Splunk
Cisco IOS XE VTY Access Class Tampering
Splunk
Cisco IOS XE WebUI Login From IOSd Local Port
Splunk
Cisco IOS XE WebUI Programmatic Configuration
Splunk
Cisco SD-WAN Multiple Source IP vManage Admin SSH Authentication
Splunk
Cisco SD-WAN Multiple SSH key Authentication from Same Source
Splunk
CrushFTP Server Side Template Injection
Splunk
Detect Distributed Password Spray Attempts
Splunk
Detect HTML Help Spawn Child Process
Splunk
Detect New Login Attempts to Routers
Splunk
Detect Password Spray Attempts
Splunk
Email Attachments With Lots Of Spaces
Splunk
Email files written outside of the Outlook directory
Splunk
Email servers sending high volume traffic to hosts
Splunk
ESXi Account Modified
Splunk
ESXi Audit Tampering
Splunk
ESXi Bulk VM Termination
Splunk
ESXi Download Errors
Splunk
ESXi Encryption Settings Modified
Splunk
ESXi External Root Login Activity
Splunk
ESXi Firewall Disabled
Splunk
ESXi Lockdown Mode Disabled
Splunk
ESXi Loghost Config Tampering
Splunk
ESXi Malicious VIB Forced Install
Splunk
ESXi Reverse Shell Patterns
Splunk
ESXi Sensitive Files Accessed
Splunk
ESXi Shared or Stolen Root Account
Splunk
ESXi Shell Access Enabled
Splunk
ESXi SSH Brute Force
Splunk
ESXi SSH Enabled
Splunk
ESXi Syslog Config Change
Splunk
ESXi System Clock Manipulation
Splunk
ESXi System Information Discovery
Splunk
ESXi User Granted Admin Role
Splunk
ESXi VIB Acceptance Level Tampering
Splunk
ESXi VM Discovery
Splunk
ESXi VM Exported via Remote Tool
Splunk
Ivanti VTM New Account Creation
Splunk
M365 Copilot Agentic Jailbreak Attack
Splunk
M365 Copilot Application Usage Pattern Anomalies
Splunk
M365 Copilot Failed Authentication Patterns
Splunk
M365 Copilot Impersonation Jailbreak Attack
Splunk
M365 Copilot Information Extraction Jailbreak Attack
Splunk
M365 Copilot Jailbreak Attempts
Splunk
M365 Copilot Non Compliant Devices Accessing M365 Copilot
Splunk
M365 Copilot Session Origin Anomalies
Splunk
MCP Filesystem Server Suspicious Extension Write
Splunk
MCP Github Suspicious Operation
Splunk
MCP Postgres Suspicious Query
Splunk
MCP Prompt Injection
Splunk
MCP Sensitive System File Search
Splunk
Monitor Email For Brand Abuse
Splunk
No Windows Updates in a time frame
Splunk
Okta Authentication Failed During MFA Challenge
Splunk
Okta IDP Lifecycle Modifications
Splunk
Okta MFA Exhaustion Hunt
Splunk
Okta Mismatch Between Source and Response for Verify Push Request
Splunk
Okta Multi-Factor Authentication Disabled
Splunk
Okta Multiple Accounts Locked Out
Splunk
Okta Multiple Failed MFA Requests For User
Splunk
Okta Multiple Failed Requests to Access Applications
Splunk
Okta Multiple Users Failing To Authenticate From Ip
Splunk
Okta New API Token Created
Splunk
Okta New Device Enrolled on Account
Splunk
Okta Phishing Detection with FastPass Origin Check
Splunk
Okta Risk Threshold Exceeded
Splunk
Okta Successful Single Factor Authentication
Splunk
Okta Suspicious Activity Reported
Splunk
Okta Suspicious Use of a Session Cookie
Splunk
Okta ThreatInsight Threat Detected
Splunk
Okta Unauthorized Access to Application
Splunk
Okta User Logins from Multiple Cities
Splunk
Ollama Abnormal Network Connectivity
Splunk
Ollama Abnormal Service Crash Availability Attack
Splunk
Ollama Excessive API Requests
Splunk
Ollama Possible API Endpoint Scan Reconnaissance
Splunk
Ollama Possible Memory Exhaustion Resource Abuse
Splunk
Ollama Possible Model Exfiltration Data Leakage
Splunk
Ollama Possible RCE via Model Loading
Splunk
Ollama Suspicious Prompt Injection Jailbreak

Showing up to 120 of 4191 rules matching your filters. Use the filters above to narrow down.