CJIS – Requirements

Section	AIE Rules & Alarms	Investigations	Reports
4.2.2	CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Admin Password Modified CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Information CCF: Blacklist Location Auth CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Misuse CCF: Multiple Acct Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Windows RunAs Privilege Escalation CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Denial of Service Alearm CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: FIM Delete Activity Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Non-Encrypted Protocol Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failure Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CF: Vulnerability Detected Summary
5.3.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.3.2	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.3.2.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.3.2.2	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.3.4	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.4.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.4.1.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.4.1.1.1	LR Functionality	LR Functionality	LR Functionality
5.4.2	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Critical/PRD Envir Patch Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Time Sync Error Summary
5.4.3	LR Functionality	LR Functionality	LR Functionality
5.4.4	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Time Sync Error Summary
5.4.5	CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Software Install CCF: Software Install Alarm CCF: Software Uninstall CCF: Software Uninstall Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Time Sync Error Inv CCF: User Object Access Inv	CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Time Sync Error Summary CCF: User Object Access Summary
5.4.6	CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.5.1	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.2	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Social Media Event CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Social Media Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.2.1	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.2.2	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.2.3	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.2.4	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.6	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.5.6.1	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.7.1	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Patch Failure Alarm CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Signature Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.7.1.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.7.2	CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklisted Account Alarm CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Disabled Account Auth Success CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Multiple Account Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Excessive Authentication Failures Inv CCF: Host Access Granted And Revoked Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Host Access Granted And Revoked Detail CCF: Object Access Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.8.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary
5.8.2.1	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Rogue Access Point Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Host Access Granted And Revoked Detail CCF: Physical Access Summary CCF: Time Sync Error Summary CCF: Unknown User Account Detail
5.8.3	CCF: Abnormal Amount of Data Transferred CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Time Sync Error Summary
5.9.1	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.1	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.2	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.3	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.4	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.5	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.6	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.7	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.1.8	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.9.2	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary
5.10.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.10.1.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.10.1.2	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Time Sync Error Inv CCF: Use Of Non-Encrypted Protocols Inv	CCF: Audit Log Summary CCF: Time Sync Error Summary CCF: Use Of Non-Encrypted Protocols Summary
5.10.1.2.1	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Physical Access Inv CCF: Time Sync Error Inv CCF: Use Of Non-Encrypted Protocols Inv	CCF: Audit Log Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Physical Access Summary CCF: Time Sync Error Summary CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary
5.10.1.2.2	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Data Access Anomalies CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Early TLS/SSL Alarm CCF: Failed Audit Log Write Alarm CCF: Large Outbound Transfer CCF: LogRhythm Silent Log Source Error Alarm CCF: Non-Encrypted Protocol Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Object Access Inv CCF: Physical Access Inv CCF: Time Sync Error Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Object Access Inv	CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: Physical Access Summary CCF: Time Sync Error Summary CCF: Use Of Non-Encrypted Protocols Summary CCF: User Object Access Summary
5.10.1.3	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.10.3.1	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.10.3.2	CCF: Abnormal Amount of Data Transferred CCF: Abnormal Origin Location CCF: Account Deleted CCF: Account Disabled CCF: Account Enabled CCF: Account Modification CCF: Admin Password Modified CCF: Attack then External Connection CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Failure Alarm CCF: Backup Information CCF: Blacklist Location Auth CCF: Blacklisted Account Alarm CCF: Compromise Detected Alarm CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Single User CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Critical/PRD Envir Patch Failure Alarm CCF: Data Destruction CCF: Data Exfiltration Observed CCF: Data Loss Prevention CCF: Denial of Service Alarm CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: Early TLS/SSL Alarm CCF: Excessive Authentication Failures Rule CCF: External Brute Force Auths CCF: Failed Audit Log Write Alarm CCF: FIM Abnormal Activity CCF: FIM Add Activity CCF: FIM Delete Activity Alarm CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Large Outbound Transfer CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: LogRhythm Silent Log Source Error Alarm CCF: Malware Alarm CCF: Misuse CCF: Multiple Account Passwords Modified by Admin CCF: Non-Encrypted Protocol Alarm CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Social Media Event CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Suspected Wireless Attack Alarm CCF: Time Sync Error Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm CCF: Windows RunAs Privilege Escalation	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failures Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Social Media Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: Host Access Granted And Revoked Detail CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Social Media Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Unknown User Account Detail CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CCF: Vulnerability Detected Summary
5.10.4.1	CCF: Audit Log Cleared Alarm CCF: Audit Logging Stopped Alarm CCF: Backup Failure Alarm CCF: Backup Information CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Critical/PRD Envir Patch Failure Alarm CCF: Failed Audit Log Write Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: PRD Envir Signature Failure Alarm CCF: Software Install CCF: Software Install Fail Alarm CCF: Software Uninstall CCF: Software Uninstall Fail Alarm CCF: Time Sync Error Alarm	CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Patch Activity Inv CCF: Signature Activity Inv CCF: Time Sync Error Inv	CCF: Audit Log Summary CCF: Backup Activity Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Patch Activity Summary CCF: Signature Activity Summary CCF: Time Sync Error Summary
5.15(SI-2)	CCF: Config Change After Attack CCF: Critical Event After Attack CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: PRD Envir Config/Policy Change Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm	CCF: Applications Accessed By User Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Rogue Access Point Inv CCF: Config/Policy Change Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Critical Environment Error Inv CCF: Audit Log Inv CCF: Compromises Detected Inv	CCF: Applications Accessed By User Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Compromises Detected Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Audit Log Summary
5.15(SI-3)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Abnormal Origin Location CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Backup Activity Summary CCF: Account Modification Summary CCF: Term Account Activity Summary
5.15(SI-4)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Abnormal Origin Location CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-4-2)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Abnormal Origin Location CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-4-4)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Abnormal Origin Location CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-4-5)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Software Install CCF: Software Uninstall CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Abnormal Origin Location CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-5)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Abnormal Origin Location CCF: Auth After Security Event CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-7)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Abnormal Origin Location CCF: Auth After Security Event CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-7-1)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Abnormal Origin Location CCF: Auth After Security Event CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-7-7)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Backup Information CCF: Config Change After Attack CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Social Media Event CCF: Misuse CCF: Config Deleted/Disabled CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Abnormal Origin Location CCF: Auth After Security Event CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Backup Failure Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Priv Group Access Granted Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Privilege Escalation After Attack Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Backup Activity Inv CCF: Time Sync Error Inv CCF: Social Media Inv CCF: Host Access Granted And Revoked Inv CCF: Applications Accessed By User Inv CCF: Suspicious Users Inv CCF: Object Access Inv CCF: User Misuse Inv CCF: Unknown User Account Inv CCF: GeoIP Inv CCF: Privileged Account Modification Inv CCF: Privileged Account Escalation Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Password Modification Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Config/Policy Change Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Social Media Summary CCF: Applications Accessed By User Summary CCF: Top Suspicious Users CCF: Object Access Summary CCF: User Misuse Summary CCF: GeoIP Summary CCF: User Priv Escalation (Windows) Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: Priv Authentication Activity Summary CCF: Priv Account Management Activity Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Social Media Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-8)	CCF: GeoIP General Activity CCF: GeoIP Blacklisted Region Activity CCF: Abnormal Origin Location CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Misuse CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Social Media Event CCF: Disabled Account Auth Success CCF: Corroborated Account Anomalies CCF: Windows RunAs Privilege Escalation CCF: Linux sudo Privilege Escalation CCF: Local Account Created and Used CCF: Blacklist Location Auth CCF: Backup Information CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: Excessive Authentication Failure Rule CCF: Account Modification CCF: Account Enabled Rule CCF: Account Disabled Rule CCF: Account Deleted Rule CCF: Concurrent VPN from Multiple Locations CCF: Concurrent VPN from Same User CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Multiple Account Passwords Modified by Admin CCF: Admin Password Modified CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Malware Alarm CCF: Vulnerability Detected Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: Compromise Detected Alarm CCF: Denial Of Service Alarm CCF: Privilege Escalation After Attack Alarm CCF: Unknown User Account Alarm CCF: Blacklisted Account Alarm CCF: Backup Failure Alarm	CCF: Suspicious Users Inv CCF: GeoIP Inv CCF: Rogue Access Point Inv CCF: Suspected Wireless Attack Inv CCF: Malware Detected Inv CCF: Vulnerability Detected Inv CCF: Compromises Detected Inv CCF: Denial Of Service Inv CCF: Audit Log Inv CCF: Excessive Authentication Failure Inv CCF: Account Modification Inv CCF: Enabled Account Inv CCF: Disabled Account Inv CCF: Deleted Account Inv CCF: Host Access Granted And Revoked Inv CCF: Unknown User Account Inv CCF: Backup Activity Inv CCF: User Misuse Inv CCF: Password Modification Inv	CCF: Top Suspicious Users CCF: User Misuse Summary CCF: GeoIP Summary CCF: Compromises Detected Summary CCF: Rogue Access Point Summary CCF: Suspected Wireless Attack Summary CCF: Malware Detected Summary CCF: Vulnerability Detected Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Access Failure Summary CCF: Auth Success Summary CCF: Access Success Summary CCF: Account Enabled Summary CCF: Account Disabled Summary CCF: Account Deleted Summary CCF: Account Modification Summary CCF: Term Account Activity Summary CCF: Backup Activity Summary
5.15(SI-10)	CCF: Account Deleted Rule CCF: Account Disabled Rule CCF: Concurrent VPN from Same User CCF: Excessive Authentication Failures Rule CCF: Account Enabled Rule CCF: Account Modification CCF: Abnormal Origin Location CCF: Admin Password Modified CCF: Attack then External Connection CCF: Auth After Numerous Failed Auths CCF: Auth After Security Event CCF: Backup Information CCF: Blacklist Location Auth CCF: Concurrent VPN from Multiple Locations CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Config Modified CCF: Corroborated Account Anomalies CCF: Corroborated Data Access Anomalies CCF: Critical Event After Attack CCF: Data Loss Prevention CCF: Disabled Account Auth Success CCF: Distributed Brute Force CCF: External Brute Force Auths CCF: FIM Abnormal Activity CCF: FIM General Activity CCF: FIM Information CCF: GeoIP Blacklisted Region Activity CCF: GeoIP General Activity CCF: Local Account Created and Used CCF: Misuse CCF: Multiple Acct Passwords Modified by Admin CCF: Password Modified by Admin CCF: Password Modified by Another User CCF: Windows RunAs Privilege Escalation CCF: Backup Failure Alarm CCF: Blacklisted Account Alarm CCF: Non-Encrypted Protocol Alarm CCF: Priv Group Access Granted Alarm CCF: Privilege Escalation After Attack Alarm CCF: Rogue Access Point Alarm CCF: Suspected Wireless Attack Alarm CCF: Unknown User Account Alarm CCF: Vulnerability Detected Alarm	CCF: Account Deleted Inv CCF: Account Disabled Inv CCF: Account Enabled Inv CCF: Account Modification Inv CCF: Applications Accessed By User Inv CCF: Audit Log Inv CCF: Backup Activity Inv CCF: Compromises Detected Inv CCF: Config/Policy Change Inv CCF: Critical Environment Error Inv CCF: Denial of Service Inv CCF: Excessive Authentication Failure Inv CCF: GeoIP Inv CCF: Host Access Granted And Revoked Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Malware Detected Inv CCF: Object Access Inv CCF: Password Modification Inv CCF: Patch Activity Inv CCF: Physical Access Inv CCF: Privileged Account Escalation Inv CCF: Privileged Account Modification Inv CCF: Rogue Access Point Inv CCF: Signature Activity Inv CCF: Suspected Wireless Attack Inv CCF: Suspicious Users Inv CCF: Time Sync Error Inv CCF: Unknown User Account Inv CCF: Use Of Non-Encrypted Protocols Inv CCF: User Misuse Inv CCF: User Object Access Inv CCF: Vulnerability Detected Inv	CCF: Access Failure Summary CCF: Access Success Summary CCF: Account Deleted Summary CCF: Account Disabled Summary CCF: Account Enabled Summary CCF: Account Modification Summary CCF: Applications Accessed By User Summary CCF: Audit Log Summary CCF: Auth Failure Summary CCF: Auth Success Summary CCF: Backup Activity Summary CCF: Compromises Detected Summary CCF: Config/Policy Change Summary CCF: Critical Environment Error Summary CCF: GeoIP Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Malware Detected Summary CCF: Object Access Summary CCF: Patch Activity Summary CCF: Physical Access Summary CCF: Priv Account Management Activity Summary CCF: Priv Authentication Activity Summary CCF: Rogue Access Point Summary CCF: Signature Activity Summary CCF: Suspected Wireless Attack Summary CCF: Term Account Activity Summary CCF: Time Sync Error Summary CCF: Top Suspicious Users CCF: Use Of Non-Encrypted Protocols Summary CCF: User Misuse Summary CCF: User Object Access Summary CCF: User Priv Escalation (SU & SUDO) Summary CCF: User Priv Escalation (Windows) Summary CF: Vulnerability Detected Summary
5.15(SI-11)	CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Config Deleted/Disabled CCF: Attack then External Connection CCF: Software Install CCF: Software Uninstall CCF: Backup Failure Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Time Sync Error Alarm CCF: Critical/PRD Envir Patch Failure Alarm CCF: PRD Envir Signature Failure Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm	CCF: Critical Environment Error Inv CCF: Signature Activity Inv CCF: Patch Activity Inv CCF: Time Sync Error Inv CCF: Backup Activity Inv CCF: Audit Log Inv	CCF: Critical Environment Error Summary CCF: Signature Activity Summary CCF: Patch Activity Summary CCF: Time Sync Error Summary CCF: Backup Activity Summary CCF: Audit Log Summary
5.15(SI-12)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Social Media Event CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Critical Event After Attack CCF: Config Deleted/Disabled CCF: Attack then External Connection CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Social Media Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Social Media Summary
5.15(SI-16)	CCF: FIM General Activity CCF: FIM Add Activity CCF: FIM Abnormal Activity CCF: FIM Information CCF: Data Destruction CCF: Data Loss Prevention CCF: Data Exfiltration Observed CCF: Corroborated Data Access Anomalies CCF: Config Change After Attack CCF: Config Change then Critical Error CCF: Config Deleted/Disabled CCF: Critical Event After Attack CCF: Social Media Event CCF: Abnormal Amount of Data Transferred CCF: Large Outbound Transfer CCF: Attack then External Connection CCF: Software Install CCF: Software Uninstall CCF: FIM Delete Activity Alarm CCF: Non-Encrypted Protocol Alarm CCF: Early TLS/SSL Alarm CCF: LogRhythm Silent Log Source Error Alarm CCF: Audit Logging Stopped Alarm CCF: Audit Log Cleared Alarm CCF: Failed Audit Log Write Alarm CCF: PRD Envir Config/Policy Change Alarm CCF: Software Install Fail Alarm CCF: Software Uninstall Fail Alarm	CCF: Use Of Non-Encrypted Protocols Inv CCF: Object Access Inv CCF: User Object Access Inv CCF: Audit Log Inv CCF: LogRhythm Data Loss Defender Log Inv CCF: Config/Policy Change Inv CCF: Social Media Inv	CCF: Use Of Non-Encrypted Protocols Summary CCF: LogRhythm Data Loss Defender Log Summary CCF: Object Access Summary CCF: User Object Access Summary CCF: Audit Log Summary CCF: Config/Policy Change Summary CCF: Social Media Summary