| Types
|
Categories
|
| Devices with High Event Rates
|
Anomaly
|
| Excessive Firewall Denies from Single Source
|
Anomaly
|
| Single IP with Multiple MAC addresses
|
Anomaly
|
| First−Time User Access to Critical Asset
|
Anomaly
|
| Remote Access from Foreign CountryƒRegion
|
Anomaly
|
| Anomaly: Excessive Firewall Accepts From Multiple Source to a Single Destination
|
Anomaly
|
| Excessive Database Connections
|
Anomaly
|
| First−Time User Access to Critical Asset
|
Authentication
|
| Login Failure to Disabled Account
|
Authentication
|
| Login Failure to Expired Account
|
Authentication
|
| Multiple Login Failures from the Same Source (Windows)
|
Authentication
|
| Possible Shared Accounts
|
Authentication
|
| Repeat Non−Windows Login Failures
|
Authentication
|
| Login Failures Followed By Success from the same Source IP
|
Authentication
|
| Login Failures Followed By Success to the same Source IP
|
Authentication
|
| Login Failures Followed By Success to the same Username
|
Authentication
|
| Multiple Login Failures for Single Username
|
Authentication
|
| Multiple Login Failures from the Same Source
|
Authentication
|
| Multiple Login Failures to the Same Destination
|
Authentication
|
| Repeat Windows Login Failures
|
Authentication
|
| Potential Botnet Events Become Offenses
|
Botnet
|
| DDoS Attack Detected
|
D\DoS
|
| DDoS Events with High Magnitude Become Offenses
|
D\DoS
|
| DoS Events with High Magnitude Become Offenses
|
D\DoS
|
| Network DoS Attack Detected
|
D\DoS
|
| Service DoS Attack Detected
|
D\DoS
|
| Login Failure to Disabled Account
|
Horizontal Movement
|
| Login Failure to Expired Account
|
Horizontal Movement
|
| Chained Exploit Followed by Suspicious Events
|
Intrusion Detection
|
| Chained Exploit Followed by Suspicious Events on the Third Host
|
Intrusion Detection
|
| Destination Vulnerable to Detected Exploit
|
Intrusion Detection
|
| Exploit: Destination Vulnerable to Detected Exploited on a Different Port
|
Intrusion Detection
|
| Exploits Events with High Magnitude Become Offenses
|
Intrusion Detection
|
| Login Failures Followed By Success from the same Source IP
|
Intrusion Detection
|
| Login Failures Followed By Success from the same Destination IP
|
Intrusion Detection
|
| Login Failures Followed By Success to the same Username
|
Intrusion Detection
|
| Source Vulnerable to any Exploit
|
Intrusion Detection
|
| Source Vulnerable to this Exploit
|
Intrusion Detection
|
| 100% Accurate Events
|
Intrusion Detection
|
| All Exploits Become Offenses
|
Intrusion Detection
|
| Attack followed by Attack Response
|
Intrusion Detection
|
| Database Failures Followed by User Changes
|
Intrusion Detection
|
| Database Multiple Database Failures Followed by Success
|
Intrusion Detection
|
| Destination Vulnerable to Different Exploit than Attempted on Targeted Port
|
Intrusion Detection
|
| Exploit Followed by Suspicious Host Activity
|
Intrusion Detection
|
| ExploitƒMalware Events Across Multiple Destinations
|
Intrusion Detection
|
| Exploits: Exploits Followed by Firewall Accepts
|
Intrusion Detection
|
| Multiple Exploit Types Againts Single Destination
|
Intrusion Detection
|
| Multiple Vector Attack Source
|
Intrusion Detection
|
| BadRabbit Detected in Real Time
|
Malware
|
| Local Host Sending Malware
|
Malware
|
| Malware or Virus Clean Failed
|
Malware
|
| TIME−Forticlient
|
Malware
|
| Treat Backdoor Trojan and Virus Events as Offenses
|
Malware
|
| Treat Key Loggers as Offenses
|
Malware
|
| Treat Non−Spyware Malware as Offenses
|
Malware
|
| Treat Spyware and Virus as Offenses
|
Malware
|
| Ransomware Behaviour from Endpoint Security Logs
|
Ransomware
|
| Ransomware Behaviour from Microsoft Windows Security Event Logs
|
Ransomware
|
| UBA: Ransomware Behavior from Endpoint Security Logs
|
Ransomware
|
| UBA: Ransomware Behavior from Microsoft Windows Security Logs
|
Ransomware
|
| Database Remote Login Failure
|
Recon
|
| Excessive Database Connections
|
Recon
|
| Excessive Failed Logins to Compliance IS
|
Recon
|
| Excessive Firewall Accepts Across Multiple Hosts
|
Recon
|
| Excessive Firewall Denies from Local Host
|
Recon
|
| Excessive Firewall Denies from Remote Host
|
Recon
|
| Multiple Login Failures from the Same Source
|
Recon
|
| Multiple Login Failures from the Same Source (Windows)
|
Recon
|
| Multiple Login Failures to the Same Destination
|
Recon
|
| Repeat Non−Windows Login Failures
|
Recon
|
| Repeat Windows Login Failures.
|
Recon
|
| Anomaly: Excessive Firewall Accepts From Multiple Sources to a Single Destination
|
Post Intrusion Activity
|
| Database Attempted Configuration Modification by a remote host
|
Post Intrusion Activity
|
| Database Concurrent Logins from Multiple Locations
|
Post Intrusion Activity
|
| Database Groups Changed from Remote Hsot
|
Post Intrusion Activity
|
| Database User Rights Changed from Remote Host
|
Post Intrusion Activity
|
| Local Mass Mailing Host Detected
|
Post Intrusion Activity
|
| Possible Local Worm Detected
|
Post Intrusion Activity
|
| Worm Detected (Events)
|
Post Intrusion Activity
|
| Device Stopped Sending Events
|
System
|
| Load Basic Building Blocks
|
System
|
| System Notification
|
System
|
| Failed Communication to a Malicious Website
|
Threats
|
| Multiple Threats Detected on Same Host
|
Threats
|
| Possible Shared Accpunts
|
Threats
|
| Potential Botnet Events Become Offenses
|
Threats
|
| Potential Honeypot Access
|
Threats
|
| Same Threat Detected on Multiple Hosts
|
Threats
|
| Same Threat Detected on Multiple Servers
|
Threats
|
| Same Threat Detected on Same Host
|
Threats
|
| Same Threat Detected on Same Network Different Hosts
|
Threats
|
| Successful Communication to a Malicious Website
|
Threats
|
| X−Force Premium: Internal Host Communicating with Botnet Command and Control URL
|
Threats
|
| X−Force Premium: Internal Host Communicating with Malware URL
|
Threats
|
| UBA: Account or Group or Privileges Added
|
User Behavioral Analytics
|
| UBA: Account or Group or Privileges Modified
|
User Behavioral Analytics
|
| UBA: Anomalous Account Created From New Location
|
User Behavioral Analytics
|
| UBA: Anomalous Cloud Account Created From New Location
|
User Behavioral Analytics
|
| UBA: Browsed to BusinessƒService Website
|
User Behavioral Analytics
|
| UBA: Browsed to Communication Website
|
User Behavioral Analytics
|
| UBA: Browsed to Entertainment Website
|
User Behavioral Analytics
|
| UBA: Browsed to Gambling Website
|
User Behavioral Analytics
|
| UBA: Browsed to Information Technology Website
|
User Behavioral Analytics
|
| UBA: Browsed to Job Search Website
|
User Behavioral Analytics
|
| UBA: Browsed to LifeStyle Website
|
User Behavioral Analytics
|
| UBA: Browsed to Malicious Website
|
User Behavioral Analytics
|
| UBA: Browsed to Mixed ContentƒPotentially Adult Website
|
User Behavioral Analytics
|
| UBA: Browsed to Phishing Website
|
User Behavioral Analytics
|
| UBA: Browsed to Pornography Website
|
User Behavioral Analytics
|
| UBA: Browsed to ScamƒQuestionableƒIllegal Website
|
User Behavioral Analytics
|
| UBA: Browsed to Uncategorized Website
|
User Behavioral Analytics
|
| UBA: Bruteforce Authentication Attempts
|
User Behavioral Analytics
|
| UBA: Common Exploit Tool Detected
|
User Behavioral Analytics
|
| UBA: Common Exploit Tool Detected (Asset)
|
User Behavioral Analytics
|
| UBA: Create Offense
|
User Behavioral Analytics
|
| UBA: Critical Systems Users Seen Update
|
User Behavioral Analytics
|
| UBA: DƒDoS Attack Detected
|
User Behavioral Analytics
|
| UBA: Detect Insecure or Non−Standard Protocol
|
User Behavioral Analytics
|
| UBA: Detect IOC's For Locky
|
User Behavioral Analytics
|
| UBA: Detect IOC's for WannaCry
|
User Behavioral Analytics
|
| UBA: Detect Persistent SSH Session
|
User Behavioral Analytics
|
| UBA: Dormant Account Found (privileged)
|
User Behavioral Analytics
|
| UBA: Dormant Account Used
|
User Behavioral Analytics
|
| UBA: Executive Only Asset Accessed by Non−Executive User
|
User Behavioral Analytics
|
| UBA: Expired Account Used
|
User Behavioral Analytics
|
| UBA: First Privileged Excalation
|
User Behavioral Analytics
|
| UBA: High Risk User Access to Critical Asset
|
User Behavioral Analytics
|
| UBA: Hioneytoken Activity
|
User Behavioral Analytics
|
| UBA: Internet Settings Modified
|
User Behavioral Analytics
|
| UBA: Kerberos Accpount Mapping
|
User Behavioral Analytics
|
| UBA: Large Outbound Transfer by Hugh Risk User
|
User Behavioral Analytics
|
| UBA: Malicious Process Detected
|
User Behavioral Analytics
|
| UBA: Malware Activity − Registry Modified in Bulk
|
User Behavioral Analytics
|
| UBA: Multiple Kerberos Authentication Failures from Same User
|
User Behavioral Analytics
|
| UBA: Multiple VPN Accounts Failed Login from Single IP.
|
User Behavioral Analytics
|
| UBA: Mutliple VPN Accpounts ogged in From Single IP
|
User Behavioral Analytics
|
| UBA: Netcast Process Detection (Linux)
|
User Behavioral Analytics
|
| UBA: Netcase Process Detection (Windows)
|
User Behavioral Analytics
|
| UBA: Network Share Accessed
|
User Behavioral Analytics
|
| UBA: Network Traffic: Capture, Monitoring and Analysis Program Usage
|
User Behavioral Analytics
|
| UBA: New Account Use Detected
|
User Behavioral Analytics
|
| UBA: Non−Admin Access to Domain Controller
|
User Behavioral Analytics
|
| UBA: Pash the Hash
|
User Behavioral Analytics
|
| UBA: Populate Authorized Applications
|
User Behavioral Analytics
|
| UBA: Populate Multiple VPN Accounts Failed Login from Single IP
|
User Behavioral Analytics
|
| UBA: Populate Multiple VPN Accounts Logged in From Single IP
|
User Behavioral Analytics
|
| UBA: Populate Process Filenames
|
User Behavioral Analytics
|
| UBA: Possible TGT Forgery
|
User Behavioral Analytics
|
| UBA: Potential Access to Blacklist Domain
|
User Behavioral Analytics
|
| UBA: Potential Access to DGA Domain
|
User Behavioral Analytics
|
| UBA: Potential Access to Squatting Domain
|
User Behavioral Analytics
|
| UBA: Potential Access to Tunnelling Domain
|
User Behavioral Analytics
|
| UBA: Process Creating Suspicious Remote Threads Detected (Asset)
|
User Behavioral Analytics
|
| UBA: Process Executed Outside Gold Disk Whitelist (Linux)
|
User Behavioral Analytics
|
| UBA: Process Executed Outside Gold Disk Whitelist (Windows)
|
User Behavioral Analytics
|
| UBA: Ransomware Behaviour Detected
|
User Behavioral Analytics
|
| UBA: Recent User Activity Update(privileged)
|
User Behavioral Analytics
|
| UBA: Repeat Unauthorized Access
|
User Behavioral Analytics
|
| UBA: Restricted Program Usage
|
User Behavioral Analytics
|
| UBA: Shellbags Modified by Ransomware
|
User Behavioral Analytics
|
| UBA: Subject_CN and Username Map Update
|
User Behavioral Analytics
|
| UBA: Subject_CN and Username Mapping
|
User Behavioral Analytics
|
| UBA: Suspicious Activities on Compromised Hosts
|
User Behavioral Analytics
|
| UBA: Suspicious Activities on Compromised Hosts (Asset)
|
User Behavioral Analytics
|
| UBA: Suspicious Administrative Activities Detected
|
User Behavioral Analytics
|
| UBA: Suspicious Command Prompt Activity
|
User Behavioral Analytics
|
| UBA: Suspicious Entries in System Registry (Asset)
|
User Behavioral Analytics
|
| UBA: Suspicious Image Load Detected (Asset)
|
User Behavioral Analytics
|
| UBA: Suspicious Pipe Activities (Asset)
|
User Behavioral Analytics
|
| UBA: Suspicious PowerShell Activity
|
User Behavioral Analytics
|
| UBA: Suspicipus Privileged Activity (First Observed Privilege Use)
|
User Behavioral Analytics
|
| UBA: Suspicious Privileged Activity (Rarely Used Privileged)
|
User Behavioral Analytics
|
| UBA: Suspicipus Scheduled Task Activities
|
User Behavioral Analytics
|
| UBA: Suspicious Service Activities
|
User Behavioral Analytics
|
| UBA: Suspicious Service Activities (Asset)
|
User Behavioral Analytics
|
| UBA: TGT Ticket Used by Multiple Hosts
|
User Behavioral Analytics
|
| UBA: Unauthorized Access
|
User Behavioral Analytics
|
| UBA: UNIXƒLINUX System Accessed With Service or Machine Account
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Database Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of DHCP Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of DNS Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of FTP Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Game Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Generic ICMP Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Generic TCP Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Generic UDP Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of IRC Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of LDAP Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Mail Servers Detected
|
User Behavioral Analytics
|
| UBA: Unusual Scanning of Messaging Servers Detected
|
User Behavioral Analytics
|