Release 17 - Out-of-the-box alerts

Detection name

Detection description

Devo table / Data source / Category

Update 

SecOpsCDPossibleIocIpFoundInAuthData

This search looks for Collective Defense matches in authentication data.

auth.all

New Alert

SecOpsCDHuntFWSrcIpIsPossibleIoc

This search looks for Collective Defense matches in firewall data.

firewall.all.traffic

New Alert

SecOpsCDFWSrcIpIsPossibleIoc

This search looks for Collective Defense matches in firewall data.

firewall.all.traffic

New Alert

SecOpsCDProxySrcIp

This search looks for Collective Defense matches in proxy data.

proxy.all.access

New Alert

SecOpsCDProxyDstIp

This search looks for Collective Defense matches in proxy data.

proxy.all.access

New Alert

SecOpsCollectiveDefenseHuntWebSrcIp

This search looks for Collective Defense matches in web data.

web.all.access

New Alert

SecOpsCDIocUrlSuspiciousProxyData

This search looks for Collective Defense matches in proxy data.

proxy.all.access

New Alert

SecOpsCDIocIpSuspiciousO365Data

This search looks for Collective Defense matches in o365 data.

cloud.office365.management

New Alert

SecOpsCDIocIpSuspiciousAWSData

This search looks for Collective Defense matches in AWS data.

cloud.AWS.cloudtrail

New Alert

SecOpsCDIocIpSuspiciousGSuiteData

This search looks for Collective Defense matches in Gsuite data.

cloud.gsuite.reports

New Alert

SecOpsPanAuthFailMultipleUserSingleIP

Detects brute force attacks via the Palo Alto firewalls. A source IP address attempted and failed to authenticate multiple times while providing multiple usernames.

firewall.paloalto.system

Alert field naming update