Ironclad Alert Investigation: Search Reference Guide
Ironclad Alert Investigation: Search Reference Guide
Use this guide to find Ironclad alerts in the Customer Portal's Threat Hunting page by behavior type, log source, or rule ID range. The Quick Reference maps a goal ("I want to see...") to the Source and Behavior selections to make in the Hunt Builder, and each source section lists its Behaviors and the rule IDs each one returns.
How Hunts Work in the Portal
The Threat Hunting page's Hunt Builder has a few controls that combine into a single search:
- Source — the log source the alert came from (e.g. M365 Audit, Windows Defender, FortiGate). Leave it on "Any source" to search across every source you're authorized to see.
- Behavior — a searchable, multi-select picker grouped by Source, describing what happened in plain language (e.g. Failed sign-ins & lockouts, Malware detected). Ticking a Behavior also selects its Source. You can select more than one.
- Rule level — an optional severity filter (0-15) that works on every Source.
- Agent / host and MITRE technique — optional filters to narrow to a specific device or ATT&CK technique ID.
- Time window — how far back to search, or a restored archive job if you're hunting against retrieved historical logs.
Picking a Source and one or more Behaviors narrows the search to that Source's alerts matching any of the selected Behaviors. Each Behavior covers several related detections. To search one theme across every log source at once (for example, all malware), use a hunt template or AI Search; the "Quick Reference" section below shows which Behavior to pick in each Source.
A live preview at the bottom of the Hunt Builder shows exactly what will be matched before you click Run hunt. If you're not sure where to start, the "Start from template..." dropdown has one-click templates for the most common hunts, and the AI Search panel below the builder lets you describe what you're looking for in plain English (e.g. "Show me suspicious Microsoft 365 token theft indicators over the last 7 days") and it will pick the matching Source/Behavior selections for you.
Quick Reference: Common Hunts
Use these when you want to find a theme across log sources. Run one hunt per Source, or use the matching hunt template or AI Search to cover them all at once. Each row lists the Behavior to pick under each Source.
| I want to see | Where to look (Source → Behavior) |
|---|---|
| All malware detections | Appriver → Malware & virus; Barracuda → Malware & phishing blocked; Cisco Firepower → Malware detected; File Integrity Monitoring → Malware staging (repeated YARA hits); FortiGate → Malware, antivirus & sandbox; Meraki Event Log → Malicious sites blocked; Mimecast → Malicious attachments & malware; Proofpoint → Malware; SentinelOne → Malware detected; SonicWall → Gateway AV malware; Windows Defender → Malware detections & outbreaks; YARA → Malware match. Tip: the "Cross-Source Malware" hunt template runs this exact search. |
| All brute-force attacks | CentOS Auth → Failed SSH logins & brute force; Debian Auth → Failed SSH logins & brute force; FortiGate → Admin logins, lockouts & brute force; Google Workspace Audit → Suspicious, failed & brute-force sign-ins; macOS Auth → Failed SSH logins & brute force; Meraki Event Log → Failed VPN logins & brute force; SonicWall → VPN login failures & brute force; Windows Security → Failed logons & brute force. |
| All phishing activity | Appriver → Phishing, impersonation & spoofing; Barracuda → Malware & phishing blocked; Google Workspace Audit → Phishing alerts; Proofpoint → Phishing & BEC. |
| All persistence indicators | CentOS Auditd → Persistence (cron, systemd, launchd); CentOS Journald → Systemd service persistence; CentOS Messages → Systemd service persistence; Debian Syslog → Systemd service persistence; File Integrity Monitoring → Registry & startup persistence; macOS Launchd → launchctl load, unload & submit; macOS OpenBSM → Persistence (cron, systemd, launchd); macOS Plist → LaunchAgent / Daemon plist changes; macOS Syslog (Source alone); macOS Unified Log → New services & daemons; Windows Defender → Attack Surface Reduction blocks; Windows Security → Services & scheduled tasks, Account creation & group changes; Windows System → Service installs & changes. Tip: the "Persistence Across Hosts" hunt template runs this exact search. |
| All defense-evasion activity | CentOS Auditd → Defense evasion (audit tamper, SELinux); CentOS Firewalld → Firewall disabled & rule changes; CentOS Package Management → Security tool removed; Debian Firewall Management → Firewall disabled & rule changes; Debian Package Management → Security tool removed; Debian UFW → Firewall disabled & rule changes; FortiGate → Configuration, VDOM & integrity changes, Malware, antivirus & sandbox; M365 Audit → Protection policy tampering; macOS App Firewall → Firewall disabled & rule changes; macOS Installer → Gatekeeper rejections & bypass, Security tool removed; macOS Launchd → launchctl load, unload & submit; macOS OpenBSM → Defense evasion (audit tamper, SELinux); macOS Syslog → Sandbox & TCC denials; Sysmon → Process injection; Windows Defender → Protection disabled, Attack Surface Reduction blocks; Windows Firewall (Source alone); Windows Security → Audit log cleared; Windows System → Service installs & changes. |
| All privilege-escalation activity | CentOS Auditd → Privilege escalation; CentOS Auth → sudo & privilege escalation; Debian Auth → sudo & privilege escalation; FortiGate → Configuration, VDOM & integrity changes; Google Workspace Audit → Privilege changes & password resets; M365 Audit → Privilege escalation; macOS Auth → sudo & authorization; macOS OpenBSM → Privilege escalation; Windows Security → Explicit-credential logons & special privileges, Account creation & group changes. |
| All lateral-movement activity | PowerShell → Remoting / WinRM; Windows Defender → Attack Surface Reduction blocks; Windows Security → Explicit-credential logons & special privileges; WMI → Subscriptions & method execution. |
| All C2 or botnet detections | Cisco Firepower → Security Intelligence blocks; FortiGate → Botnet / C2 & DNS blocks. |
| All VPN activity | Cisco Firepower → VPN sessions; FortiGate → SSL VPN activity; Meraki Event Log → VPN activity; Palo Alto → GlobalProtect VPN; SonicWall → VPN activity. |
| All account creation activity | CentOS Auditd → Account changes; CentOS Auth → Account changes; Debian Auth → Account changes; macOS Auth → Account changes; macOS OpenBSM → Account changes; Windows Security → Account creation & group changes. |
| All authentication successes | Barracuda → Admin sign-ins & sign-outs; CentOS Auth → Successful SSH logins; Cisco Firepower → VPN sessions; Debian Auth → Successful SSH logins; FortiGate → SSL VPN activity, Admin logins, lockouts & brute force; macOS Auth → Successful SSH logins, sudo & authorization; macOS Unified Log → User logins; Meraki Event Log → VPN activity; SonicWall → VPN activity; Windows Security → Successful logons & logoffs. |
| All authentication failures | Barracuda → Admin sign-ins & sign-outs; CentOS Auth → Failed SSH logins & brute force, PAM failures & lockouts, sudo & privilege escalation; Debian Auth → Failed SSH logins & brute force, PAM failures & lockouts, sudo & privilege escalation; FortiGate → Admin logins, lockouts & brute force, SSL VPN activity; M365 Audit → Failed sign-ins & lockouts; macOS Auth → Failed SSH logins & brute force, sudo & authorization; Meraki Event Log → Failed VPN logins & brute force; SonicWall → VPN login failures & brute force; Windows Security → Failed logons & brute force. |
| All firewall-disabled events | CentOS Firewalld → Firewall disabled & rule changes; Debian Firewall Management → Firewall disabled & rule changes; macOS App Firewall → Firewall disabled & rule changes; Windows Firewall → Firewall disabled. |
| All intrusion-detection hits | Cisco Firepower → IPS / intrusion events; Meraki Security Events → IDS / intrusion alerts; Palo Alto → Threat / intrusion events; SonicWall → IPS / intrusion events. |
| All DLP events | Appriver → Outbound spam & content policy; M365 Audit → DLP policy rule match; Palo Alto → Data filtering (DLP). |
| All BEC activity | Appriver → Phishing, impersonation & spoofing; Barracuda → Malware & phishing blocked; Proofpoint → Phishing & BEC. |
| All credential-access activity | CentOS Auditd → Credential & key access; macOS OpenBSM → Credential & key access. |
| All Duo MFA events | Duo (Source alone). |
| All token-theft indicators | M365 Audit → Token theft & AiTM. Tip: the "M365 Token Theft" hunt template runs this exact search. |
| All email-spoofing events | Mimecast → Email authentication failures & spoofing. Tip: the "Email Spoofing" hunt template runs this exact search. |
| All scheduled-task activity | CentOS Auditd → Persistence (cron, systemd, launchd); macOS OpenBSM → Persistence (cron, systemd, launchd); Windows Security → Services & scheduled tasks. |
| All recon or attack-tool installs | CentOS Package Management → Recon & attack tooling; Debian Package Management → Recon & attack tooling; macOS Installer → Recon & attack tooling. |
| All data-exfiltration signals | FortiGate → Data exfiltration; M365 Audit → Contact list exported. |
| All YARA hits | YARA → Malware match |
| All file-integrity events | File Integrity Monitoring (Source alone) |
Source Directory
These are the exact names shown in the Hunt Builder's Source dropdown. Pick one, then optionally add a Behavior to narrow the results.
| Source (as shown in the portal) | What it covers | Example narrowed hunt |
|---|---|---|
| Appriver | AppRiver ETP email gateway | + Behavior: Malware & virus |
| Barracuda | Barracuda Email Gateway Defense (mail and admin events) | + Behavior: Malware & phishing blocked |
| CentOS Auditd | CentOS / RHEL Auditd | + Behavior: Reverse shell |
| CentOS Auth | CentOS / RHEL authentication log | + Behavior: Failed SSH logins & brute force |
| CentOS Firewalld | CentOS / RHEL firewalld | + Behavior: Firewall disabled & rule changes |
| CentOS IPTables | CentOS / RHEL iptables / nftables | + Behavior: Dropped packets & port scans |
| CentOS Journald | CentOS / RHEL journald (systemd units) | + Behavior: Systemd service persistence |
| CentOS Messages | CentOS / RHEL messages log (systemd services) | + Behavior: Systemd service persistence |
| CentOS Package Management | CentOS / RHEL package installs and removals | + Behavior: Package installs |
| Cisco Firepower | Cisco Firepower / FTD | + Behavior: IPS / intrusion events |
| Debian Auditd | Debian / Ubuntu Auditd (no rules deployed yet) | (no behaviors return alerts yet) |
| Debian Auth | Debian / Ubuntu authentication log | + Behavior: Failed SSH logins & brute force |
| Debian Firewall Management | Debian / Ubuntu firewall management commands | + Behavior: Firewall disabled & rule changes |
| Debian IPTables | Debian / Ubuntu iptables / nftables | + Behavior: Dropped packets & port scans |
| Debian Package Management | Debian / Ubuntu package installs and removals | + Behavior: Package installs |
| Debian Syslog | Debian / Ubuntu syslog (systemd services) | + Behavior: Systemd service persistence |
| Debian UFW | Debian / Ubuntu UFW firewall | + Behavior: Firewall disabled & rule changes |
| Duo | Duo MFA | + Behavior: Fraud, push fatigue & MFA bombing |
| File Integrity Monitoring | Windows file/registry integrity monitoring (Syscheck) | + Behavior: Registry & startup persistence |
| FortiGate | FortiGate firewall | + Behavior: Admin logins, lockouts & brute force |
| Google Workspace Audit | Google Workspace admin, login, Drive, Chrome, and Calendar activity | + Behavior: Account compromise warnings |
| M365 Audit | Microsoft 365 / Azure AD sign-in and audit activity | + Service: Azure AD → Behavior: Token theft & AiTM |
| macOS App Firewall | macOS Application Firewall | + Behavior: Firewall disabled & rule changes |
| macOS Auth | macOS authentication log | + Behavior: Failed SSH logins & brute force |
| macOS Installer | macOS installer log | + Behavior: Package installs |
| macOS Launchd | macOS launchctl activity | + Behavior: launchctl load, unload & submit |
| macOS OpenBSM | macOS security audit trail | + Behavior: Reverse shell |
| macOS Plist | macOS LaunchAgent / LaunchDaemon plists | + Behavior: LaunchAgent / Daemon plist changes |
| macOS Syslog | macOS system log | + Behavior: launchd jobs loaded |
| macOS Unified Log | macOS Unified Log | + Behavior: New services & daemons |
| Meraki Event Log | Cisco Meraki event log / VPN | + Behavior: Failed VPN logins & brute force |
| Meraki Security Events | Cisco Meraki IDS / security events | + Behavior: IDS / intrusion alerts |
| Mimecast | Mimecast email security | + Behavior: Malicious URLs & clicks |
| Palo Alto | Palo Alto Networks firewall | + Behavior: Threat / intrusion events |
| PowerShell | Windows PowerShell logs | + Behavior: Script blocks & module logging |
| Proofpoint | Proofpoint email security | + Behavior: Delivered threats |
| SentinelOne | SentinelOne EDR | + Behavior: Malware detected |
| SonicWall | SonicWall firewall | + Behavior: VPN login failures & brute force |
| Sysmon | Windows Sysmon | + Behavior: Process injection |
| Windows Defender | Microsoft Defender for Endpoint | + Behavior: Malware detections & outbreaks |
| Windows Firewall | Windows Firewall | + Behavior: Firewall disabled |
| Windows Security | Windows Security event log | + Behavior: Failed logons & brute force |
| Windows System | Windows System event log | + Behavior: Service installs & changes |
| WMI | Windows WMI activity | + Behavior: Subscriptions & method execution |
| YARA | YARA scan results | + Behavior: Malware match |
| macOS Packet Filter | macOS pf firewall | (its only rule is silent; nothing to search) |
Investigation Scenarios by Source
M365 Audit
Select Source: M365 Audit, then open the Behavior picker. Under M365 Audit, use the service buttons (All, Azure AD, Exchange, SharePoint / OneDrive, DLP, Teams) to narrow the list, then add one or more of these Behaviors. Each Behavior covers several related detections, and selecting more than one returns alerts that match any of them.
| I want to see | Service | Behavior to add |
|---|---|---|
| All M365 Audit alerts | (any) | (none - Source alone) |
| Every sign-in, successful or failed | Azure AD | All sign-in activity |
| Failed sign-ins and account lockouts | Azure AD | Failed sign-ins & lockouts |
| Successful sign-ins outside business hours | Azure AD | After-hours sign-in |
| Password-spray attacks or scripted sign-in tools | Azure AD | Password spray & scripted tooling |
| Token theft, session hijack, or AiTM phishing-proxy signals | Azure AD | Token theft & AiTM (Tip: "M365 Token Theft" template) |
| Confirmed AiTM or multi-signal token theft (isolate the account) | Azure AD | Critical / confirmed token theft |
| User, password, or group changes | Azure AD | User, password & group changes |
| Users added to admin roles or apps granted roles | Azure AD | Privilege escalation |
| App registrations, OAuth grants, and consent | Azure AD | Application & OAuth activity |
| Refresh-token revocations or conditional-access changes | Azure AD | Session & conditional-access changes |
| New inbox, forwarding, or mail flow rules | Exchange | Inbox & mail flow rules |
| Mailbox permission, SendAs, or mailbox setting changes | Exchange | Mailbox permissions & settings |
| Contact list exported from a mailbox | Exchange | Contact list exported |
| Anti-phish, Safe Links, or malware policy changes | Exchange | Protection policy tampering |
| Sharing invitations and anonymous links | SharePoint / OneDrive | Sharing & anonymous links |
| Site permission, group, or site-admin changes | SharePoint / OneDrive | Site permissions & admin changes |
| Risky file uploads or sensitive-keyword searches | SharePoint / OneDrive | Suspicious upload or search |
| DLP policy matches | DLP | DLP policy rule match |
| Teams created or members added | Teams | Member activity |
| Teams connectors or third-party bots added | Teams | Connector activity |
Google Workspace Audit
Select Source: Google Workspace Audit, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| All sign-in activity | 100750-100753, 100778 |
| Suspicious, failed & brute-force sign-ins | 100751-100753, 100778 |
| Account compromise warnings | 100754-100756 |
| Admin activity | 100757-100761, 100771 |
| Privilege changes & password resets | 100758-100760 |
| OAuth & third-party app access | 100761, 100763 |
| Context-aware access blocks | 100764 |
| Drive sharing & file access | 100762, 100768 |
| Chrome unsafe sites & extensions | 100765-100766 |
| Calendar activity | 100769-100770 |
| Phishing alerts | 100767 |
Mimecast
Select Source: Mimecast, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Email authentication failures & spoofing | 108000-108004, 108015-108016 |
| Malicious URLs & clicks | 108005-108007 |
| Malicious attachments & malware | 108008-108010, 108019 |
| Data loss prevention | 108011-108013 |
| Impersonation | 108014-108018 |
Proofpoint
Select Source: Proofpoint, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Quarantined messages | 108501-108504 |
| Delivered threats | 108507-108512 |
| URL clicks (blocked & permitted) | 108513-108517 |
| Malware | 108501, 108504, 108507, 108510, 108515, 108518 |
| Phishing & BEC | 108502-108503, 108508-108509, 108511, 108513-108514, 108516 |
Appriver
Select Source: Appriver, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Malware & virus | 109000-109001, 109009 |
| Phishing, impersonation & spoofing | 109003-109004, 109010-109011 |
| Delivered threats | 109009-109011 |
| Malicious attachments | 109005-109006 |
| Outbound spam & content policy | 109002, 109007 |
| Link clicks | 109012-109013 |
| Geo-blocked mail | 109008 |
Barracuda
Select Source: Barracuda, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Malware & phishing blocked | 101500, 101505 |
| Attachment & policy blocks | 101501, 101504 |
| Reputation & sender-authentication blocks | 101502-101503 |
| Delivered messages | 101507 |
| Scanning service unavailable | 101506 |
| Admin sign-ins & sign-outs | 101508-101510 |
| Admin configuration changes | 101511 |
Duo
Select Source: Duo, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Fraud, push fatigue & MFA bombing | 107500-107501, 107521 |
| Anonymous IP | 107509 |
| Weak factors (bypass code, remembered device) | 107517-107518 |
| Failed authentication & lockouts | 107502-107506 |
| Policy blocks (group, network, geo) | 107507-107508, 107510-107512 |
| Device trust blocks | 107512-107516 |
| Successful logins & enrollments | 107519-107520 |
SentinelOne
Select Source: SentinelOne, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Malware detected | 106003-106006, 106015 |
| Remediation (killed, quarantined, failed) | 106004-106006, 106008 |
| Behavioral detections | 106010-106014 |
| Campaigns & sustained activity | 106007, 106009 |
Windows Security
Select Source: Windows Security, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Successful logons & logoffs | 102501, 102503 |
| Failed logons & brute force | 102502, 102510, 102515 |
| Explicit-credential logons & special privileges | 102504-102505 |
| Kerberos requests | 102508-102510 |
| Account creation & group changes | 102506-102507, 102516-102520 |
| Privileged group changes | 102516-102517, 102519-102520 |
| Services & scheduled tasks | 102511-102513 |
| Audit log cleared | 102514 |
Sysmon
Select Source: Sysmon, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Process creation | 102701 |
| Process injection | 102704 |
| Network, DNS & beaconing | 102702-102703, 102705 |
Windows Defender
Select Source: Windows Defender, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Malware detections & outbreaks | 102601-102605, 102610 |
| Remediation failures | 102601, 102604-102605 |
| Protection disabled | 102607-102609 |
| Controlled folder access blocks | 102606 |
| Attack Surface Reduction blocks | 102612-102617 |
PowerShell and WMI
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| PowerShell | Remoting / WinRM | 102901 |
| PowerShell | Script blocks & module logging | 102902-102904 |
| WMI | Subscriptions & method execution | 103101-103102 |
Windows System and Firewall
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| Windows System | Service installs & changes | 103001-103003 |
| Windows Firewall | Firewall disabled | 102802 |
| Windows Firewall | Policy & rule changes | 102801, 102803-102804 |
File Integrity Monitoring and YARA
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| File Integrity Monitoring | Registry & startup persistence | 105750-105754 |
| File Integrity Monitoring | Malware staging (repeated YARA hits) | 105758 |
| YARA | Malware match | 105756 |
| YARA | All scan results | 105756-105757 |
Debian / Ubuntu
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| Debian Auth | Successful SSH logins | 103501-103502 |
| Debian Auth | Failed SSH logins & brute force | 103503-103509 |
| Debian Auth | SSH root logins | 103502, 103519 |
| Debian Auth | sudo & privilege escalation | 103510-103513 |
| Debian Auth | PAM failures & lockouts | 103514-103515 |
| Debian Auth | Account changes | 103516-103518 |
| Debian Auditd | (any) | No Debian auditd rules are deployed yet, so nothing is returned |
| Debian UFW | Firewall disabled & rule changes | 103883 |
| Debian IPTables | Dropped packets & port scans | 103877-103878 |
| Debian Firewall Management | Firewall disabled & rule changes | 103880-103882 |
| Debian Package Management | Package installs | 104001, 104004-104005 |
| Debian Package Management | Recon & attack tooling | 104005-104006 |
| Debian Package Management | Security tool removed | 104003 |
| Debian Syslog | Systemd service persistence | 103627-103628 |
CentOS / RHEL
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| CentOS Auth | Successful SSH logins | 104251-104252 |
| CentOS Auth | Failed SSH logins & brute force | 104253-104259 |
| CentOS Auth | SSH root logins | 104252, 104268 |
| CentOS Auth | sudo & privilege escalation | 104260-104262, 104267 |
| CentOS Auth | PAM failures & lockouts | 104263-104264 |
| CentOS Auth | Account changes | 104265-104266 |
| CentOS Auditd | Process execution | 104876-104878, 104892 |
| CentOS Auditd | Reverse shell | 104877-104878 |
| CentOS Auditd | Credential & key access | 104879-104881, 104893 |
| CentOS Auditd | Account changes | 104882-104884 |
| CentOS Auditd | Persistence (cron, systemd, launchd) | 104885-104886 |
| CentOS Auditd | Defense evasion (audit tamper, SELinux) | 104887-104890 |
| CentOS Auditd | Privilege escalation | 104891 |
| CentOS Firewalld | Firewall disabled & rule changes | 104626-104627, 104631 |
| CentOS IPTables | Dropped packets & port scans | 104629-104630 |
| CentOS Package Management | Package installs | 104751, 104754-104755 |
| CentOS Package Management | Recon & attack tooling | 104755-104756 |
| CentOS Package Management | Security tool removed | 104753 |
| CentOS Journald | Systemd service persistence | 104501-104503 |
| CentOS Messages | Systemd service persistence | 104376-104377 |
macOS
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| macOS Auth | Successful SSH logins | 105001-105002 |
| macOS Auth | Failed SSH logins & brute force | 105003-105009, 105059 |
| macOS Auth | SSH root logins | 105002 |
| macOS Auth | sudo & authorization | 105010-105014 |
| macOS Auth | Account changes | 105015, 105017 |
| macOS Unified Log | User logins | 105019 |
| macOS Unified Log | New services & daemons | 105020 |
| macOS Syslog | launchd jobs loaded | 105151 |
| macOS Syslog | Sandbox & TCC denials | 105152-105154 |
| macOS Launchd | launchctl load, unload & submit | 105156-105158, 105162 |
| macOS Plist | LaunchAgent / Daemon plist changes | 105160-105161 |
| macOS App Firewall | Firewall disabled & rule changes | 105302-105304, 105306 |
| macOS App Firewall | Port scans | 105301 |
| macOS Installer | Package installs | 105451, 105454, 105456 |
| macOS Installer | Recon & attack tooling | 105454 |
| macOS Installer | Gatekeeper rejections & bypass | 105452-105453 |
| macOS Installer | Security tool removed | 105455 |
| macOS OpenBSM | Process execution | 105601-105603, 105612-105613 |
| macOS OpenBSM | Reverse shell | 105602-105603 |
| macOS OpenBSM | Credential & key access | 105604-105606 |
| macOS OpenBSM | Account changes | 105609 |
| macOS OpenBSM | Persistence (cron, systemd, launchd) | 105607-105608 |
| macOS OpenBSM | Defense evasion (audit tamper, SELinux) | 105611-105613 |
| macOS OpenBSM | Privilege escalation | 105610 |
FortiGate
Select Source: FortiGate, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Admin logins, lockouts & brute force | 113011-113012, 113014, 113045 |
| Configuration, VDOM & integrity changes | 113004, 113006-113010, 113015 |
| SSL VPN activity | 113017-113019 |
| Malware, antivirus & sandbox | 113027-113030, 113043 |
| Botnet / C2 & DNS blocks | 113032-113034 |
| Web filter blocks & warnings | 113024, 113026 |
| Traffic blocks & DoS | 113001, 113036, 113044 |
| Data exfiltration | 113003 |
Cisco Firepower
Select Source: Cisco Firepower, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Security Intelligence blocks | 114003-114004 |
| IPS / intrusion events | 114005-114008, 114051 |
| File downloads | 114009-114010 |
| Malware detected | 114012-114013 |
| VPN sessions | 114014, 114016 |
| Suspicious applications | 114002 |
SonicWall
Select Source: SonicWall, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| VPN activity | 113501-113502, 113504, 113513 |
| VPN login failures & brute force | 113504, 113513 |
| Dropped & reset connections | 113506-113507 |
| IPS / intrusion events | 113508-113509 |
| Gateway AV malware | 113510 |
| Blocked DNS / content filter | 113512 |
Cisco Meraki
Select the Source shown in the first column, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Source | Behavior to add | Rules returned |
|---|---|---|
| Meraki Event Log | VPN activity | 112506-112512, 112514 |
| Meraki Event Log | Failed VPN logins & brute force | 112507-112508, 112510-112511 |
| Meraki Event Log | Malicious sites blocked | 112513 |
| Meraki Security Events | IDS / intrusion alerts | 112501-112505 |
Palo Alto
Select Source: Palo Alto, then add one of these Behaviors. A Behavior returns alerts matching any of its rules, and selecting more than one returns alerts matching any of them.
| Behavior to add | Rules returned |
|---|---|
| Threat / intrusion events | 114501-114504, 114519 |
| URL filtering | 114505-114508 |
| WildFire sandbox submissions | 114509-114512 |
| Data filtering (DLP) | 114513-114516 |
| GlobalProtect VPN | 114517 |
| Authentication events | 114518 |
Rule ID Reference
If a hunt's raw event table shows a Rule number you don't recognize, use this table to identify which log source it came from.
| Rule ID range | Log source |
|---|---|
| 100000-100062, 100081 | M365 Audit |
| 100749-100778 | Google Workspace Audit |
| 101500-101591 | Barracuda |
| 102501-102520 | Windows Security |
| 102601-102617 | Windows Defender |
| 102701-102705, 92109 | Sysmon |
| 102801-102804 | Windows Firewall |
| 102901-102904 | PowerShell |
| 103001-103003 | Windows System |
| 103101-103102 | WMI |
| 103501-103519 | Debian Auth |
| 103626-103628 | Debian Syslog |
| 103875-103883 | Debian UFW / Debian IPTables / Debian Firewall Management |
| 104000-104006 | Debian Package Management |
| 104251-104268 | CentOS Auth |
| 104376-104377 | CentOS Messages |
| 104501-104503 | CentOS Journald |
| 104625-104631 | CentOS Firewalld / CentOS IPTables |
| 104750-104756 | CentOS Package Management |
| 104876-104893 | CentOS Auditd |
| 105000-105059 | macOS Auth / macOS Unified Log |
| 105150-105162 | macOS Syslog / macOS Launchd / macOS Plist |
| 105300-105306 | macOS App Firewall / macOS Packet Filter |
| 105450-105456 | macOS Installer |
| 105600-105613 | macOS OpenBSM |
| 105750-105759 | File Integrity Monitoring / YARA |
| 106000-106015 | SentinelOne |
| 107499-107521 | Duo |
| 108000-108099 | Mimecast |
| 108499-108518 | Proofpoint |
| 109000-109099 | Appriver |
| 112499-112514 | Meraki Event Log / Meraki Security Events |
| 113001-113045 | FortiGate |
| 113501-113527 | SonicWall |
| 114001-114051 | Cisco Firepower |
| 114501-114519 | Palo Alto |