Platform alert pack: Collective Defense
Purpose
This alert pack is made of alerts for Collective Defense matches. It identifies possible threats based simply on sightings, not any specific action or condition.
Included alerts
SecOpsCDProxyDstIp | SecOpsCDIocIpSuspiciousWebData | SecOpsCDIocIpSuspiciousGSuiteData |
SecOpsCDProxySrcIp | SecOpsCDWebSrcIp | SecOpsCDIocIpSuspiciousO365Data |
SecOpsCDIocUrlSuspiciousProxyData | SecOpsCDHuntFWSrcIpIsPossibleIoc | SecOpsCDIocIpSuspiciousAWSData |
SecOpsCDPossibleIocIpFoundInAuthData | Â | Â |
Prerequisites
To use this alert pack, you must have the following data sources available in your domain and the following Exchange lookups installed:
Data srouces
cloud.gsuite.reports
learn moreweb.all.access
learn moreproxy.all.access
learn morecloud.office365.management
learn moreauth.all
learn morecloud.aws.cloudtrail
learn morefirewall.all.traffic
learn more
Open alert pack
Once you have installed the desired alerts individually, you can use the Open button at the top right of the card in Exchange to access the Alert configuration, where you can apply filters to find them and later manage them as required. You can also access this area via the Navigation pane (Administration → Alert Configuration → Available alerts).
Use alert pack
The alerts installed are deactivated by default. Access the Alert configuration area to activate those you need and assign sending policies to receive them through the desired channels.
Â