Skip to main content
Skip table of contents

CMMC – AI Engine Rules

AI Engine RulesRule IDDescriptionControl SupportAlarmingClassificationsLog Sources
CCF: Abnormal Amount of Data Transferred1230This rule alerts whenever a significant change (400% increase or 75% decrease) in Bytes In or Bytes Out from a specific host.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoOperations: Warning1. Include All Log Sources
2. Include All Log Sources
CCF: Abnormal Origin Location1208First tracks geographic locations for logins. Afterwards, triggers when a new origin location is seen for a user.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Attack1. Include All Log Sources
2. Include All Log Sources
CCF: Account Deleted Rule1367This rule provides details of accounts that have been deleted.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoAudit: Account DeletedInclude All Log Sources
CCF: Account Disabled Rule1369This AIE Rule alerts on the occurrence of any access revoking to accounts.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoAudit: Access RevokedInclude All Log Sources
CCF: Account Enabled Rule1368This AIE Rule alerts on the occurrence of any access granting to accounts.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Access GrantedInclude All Log Sources
CCF: Account Modification1377This AIE Rule creates a common event and provides detail around account modification activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoAudit: Account ModifiedInclude All Log Sources
CCF: Admin Password Modified1326User changes the password of a different privileged user account.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Attack then External Connection1211An observed external attack or compromise followed by data leaving the system and going to the attacker.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.13, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Audit Log Cleared Alarm1331This AIE Rule provides details on audit log clearing.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.7, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MA.L2-3.7.6, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.5, PS.L2-3.9.2, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, PE.L2-3.10.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Access SuccessIncludes All Log Sources
CCF: Audit Logging Stopped Alarm1328This AIE Rule provides details on audit logging being stopped.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.7, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MA.L2-3.7.6, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.5, PS.L2-3.9.2, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, PE.L2-3.10.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: ConfigurationInclude All Log Sources
CCF: Auth After Numerous Failed Auths1199Multiple external unique login attempts are seen on the same impacted host within a short period of time, followed by a successful authentication.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise

1. Include All Log Sources
2. Include All Log Sources

CCF: Auth After Security Event1200An observed attack, compromise, or other security event followed by successful access or authentication from the attacking host.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.1, IA.L1-3.5.2, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Backup Failure Alarm1236More than 10 backup failure events are detected.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: ErrorInclude All Log Sources
CCF: Backup Information1237This AIE Rule creates events for information from backup software.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoOperations: InformationInclude All Log Sources
CCF: Blacklist Location Auth1204Authentication success from a blacklisted location.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Blacklisted Account Alarm1334This AIE creates an alarm when a blacklisted account activity occurs within the environment.  This requires the CCF: User Blacklist to be populated and updated regularly.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Other Audit SuccessInclude All Log Sources
CCF: Compromise Detected Alarm1335This AIE rule creates an event and alerts on potential compromises across the environment.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: CompromiseInclude All Log Sources
CCF: Concurrent VPN from Multiple Locations1205Multiple VPN authentication successes from the same origin login are observed from different regions within a given time period (default 3 hours).AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Concurrent VPN from Same User1373This AIE Rule alerts on the occurrence of concurrent VPN from the same user.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Config Change After Attack1214Attack event on a host followed by a configuration change made to that host within 3 minutes. AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.2, IR.L2-3.6.3, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.1, SC.L1-3.13.5, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.6, SI.L2-3.14.7, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Config Change then Critical Error1216Configuration change followed by a critical error on the same host indicating an erroneous configuration, malicious intent or otherwise.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.13, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Config Deleted/Disabled1219Configuration deleted or disabled within the organization infrastructure.   AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.13, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseCCF: Production Servers
CCF: Config Modified1221Configuration modified within the organization infrastructure.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.7, AU.L2-3.3.8, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, SI.L1-3.14.4NoSecurity: CompromiseInclude All Log Sources
CCF: Corroborated Account Anomalies12073 or more unique behavioral anomalies for a given user within a 3 hour period. This rule requires Rule IDs 285 - 289 be turned on.

Use Case: An account has been compromised.		AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.2, IR.L2-3.6.3, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Corroborated Data Access Anomalies12012 or more unique behavioral anomalies for data within a 3 hour period. The alarm requires rule IDs 300-302 be turned on for this alarm to trigger.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Critical Event After Attack1206An external attack or compromise followed by a critical event on the same host.

Action: This alarm can identify when an error message is generated as the result of a successful attack. This can be unexpected process termination or a hardware fail.		AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.13, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Critical/PRD Envir Patch Failure Alarm1212This AIE rule creates an alert any time a patch fails to apply to the critical or production environments (entity structure).AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: ErrorInclude All Log Sources
CCF: Data Destruction1202Attack event followed by a FIM delete/modify event on the same host.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Data Exfiltration Observed1193External attack or compromise followed by data leaving the same system.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Data Loss Prevention1232This AIE Rule provides details of data generated by the LogRhythm Data Loss Defender or other data loss prevention solutions, when configured.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.5, IA.L2-3.5.6, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoOperations: InformationInclude All Log Sources
CCF: Denial of Service Alert1376This AIE Rule alerts on the occurrence of any identified Denial of Service event.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: Denial Of ServiceInclude All Log Sources
CCF: Disabled Account Auth Success1194Recently disabled or deleted account authenticates or accesses resources on the network.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.3, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, PS.L2-3.9.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Distributed Brute Force1203A successful brute force authentication -- multiple failed authentication attempts from different external hosts to the same host using the same origin login, followed by an authentication success.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Early TLS/SSL Alarm1238This AIE Rule alerts on the occurrence of any identified TLS LogRhythm Network Monitor event.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: ActivityInclude All Log Sources
CCF: Excessive Authentication Failures Rule1370This AIE Rule supports alerting on >10 authentication failures in 30 minutes (login failures). Match this threshold to your organization's specific authentication failure policies.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MA.L2-3.7.6, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.5, PS.L2-3.9.2, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, PE.L2-3.10.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Authentication FailureInclude All Log Sources
CCF: External Brute Force Auths1197Successful authentication after multiple failed attempts from different external origin hosts to the same impacted host.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Failed Audit Log Write Alarm1332This AIE Rule provides details on audit log write failures.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.7, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MA.L2-3.7.6, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.5, PS.L2-3.9.2, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, PE.L2-3.10.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Other Audit Failure
  1. Include All Log Source
CCF: FIM Abnormal Activity1233This AIE Rule creates events for all abnormal file integrity monitoring activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.5, IA.L2-3.5.6, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Suspicious1. Include All Log Sources
2. Include All Log Sources
CCF: FIM Add Activity1234This AIE Rule creates events for all file integrity monitoring add activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.5, IA.L2-3.5.6, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: ActivityInclude All Log Sources
CCF: FIM Delete Activity Alarm1235This AIE Rule alarms on file integrity monitoring delete activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: ActivityInclude All Log Sources
CCF: FIM General Activity1239This rule creates an event for file integrity monitoring activity including adds, deletes, modifies, group changes, owner changes, and permissions. The FIM log source can be established from LogRhythm's FIM or other FIM solutions.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.5, IA.L2-3.5.6, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoOperations: InformationInclude All Log Sources
CCF: FIM Information1229This AIE Rule creates events for general file integrity monitoring information.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoOperations: InformationInclude All Log Sources
CCF: GeoIP Blacklisted Region Activity1241This rule tracks activity associated with Blacklisted Regions (list).AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: GeoIP General Activity1240This rule is designed to use with the Data Processor's GeoIP functionality, to represent general GeoIP activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Suspicious

New: Operations: Information		Include All Log Sources
CCF: Large Outbound Transfer1195Single host is seen sending over 1GB of data within 30 minutes out of the network.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, PS.L2-3.9.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: CompromiseInclude All Log Sources
CCF: Linux sudo Privilege Escalation1330User not in the LogRhythm list "CCF: Privileged Accounts" and not in the local 'sudoers' file tries to use sudo on a Linux host. AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Local Account Created and Used1196An account is created on a host and then used shortly thereafter on the same host.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: LogRhythm Silent Log Source Error Alarm1209This AIE Rule creates an alert and provides information when a LogRhythm Log Source has not received logs from a critical or production server-system during the defined error period.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.21, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.7, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MA.L2-3.7.6, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, MP.L2-3.8.5, PS.L2-3.9.2, PE.L1-3.10.1, PE.L1-3.10.3, PE.L1-3.10.4, PE.L1-3.10.5, PE.L2-3.10.2, MP.L2-3.8.9, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: WarningInclude All Log Sources
CCF: Malware Alarm1217This AIE Rule provides details on malware activity across the organization's environment where malware detection/prevention is applied.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: MalwareInclude All Log Sources
CCF: Misuse1231This AIE Rule provides details on misuse activity.AC.L1-3.1.1, AC.L1-3.1.2, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: MisuseInclude All Log Sources
CCF: Multiple Account Passwords Modified by Admin1327An observed login by a user in the privileged user list followed by the change of two or more other account passwords.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Non-Encrypted Protocol Alarm1222This investigation provides details of unencrypted applications being utilized within the critical and production systems or environments (entity structure).AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.13, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.10, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: InformationInclude All Log Sources
CCF: Password Modified by Admin1325Privileged user changes the password of another account.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Password Modified by Another User1333User changes the password of another account (not their own).AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoAudit: Account ModifiedInclude All Log Sources
CCF: Physical Access Rule1498This AIE rule creates an event for any access attempts (success or failure) to the defined physical security boundary.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.8NoAudit: Access FailureInclude All Log Sources
CCF: PRD Envir Config/Policy Change Alarm1210This AIE rule creates an alert any time a configuration or policy modification logs are received from a critical or production environment (entity structure).AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.13, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.11, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: PolicyCCF: Production Servers
CCF: PRD Envir Signature Failure Alarm1213This AIE Rule creates an alert on signature update failures on critical or production environments (entity structure).AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.12, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.8, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: ErrorInclude All Log Sources
CCF: Priv Group Access Granted Alarm1324This AIE Rule provides details on access granted to privileged groups (administrators, dnsadmins, domain admins, enterprise admins, and schema admins) within the organization infrastructure.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesAudit: Access GrantedInclude All Log Sources
CCF: Privilege Escalation After Attack Alarm1329Compromised host event followed by a new account created or account modified on the same host.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: Compromise1. Include All Log Sources
2. Include All Log Sources
CCF: Rogue Access Point Alarm1220This AIE Rule alerts on the occurrence of any rogue access point detection events against the organization's environment.AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: SuspiciousInclude All Log Sources
CCF: Social Media Event1242This rule tracks social media activity, to help identify if private or personal data that should not be in transmission is present within the environment's traffic.AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.8, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: SuspiciousInclude All Log Sources
CCF: Software Install Failure Alarm1375This alerts on failed and incomplete updates attempts to update or install in the organization.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.3, AC.L2-3.1.7, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.4, SI.L1-3.14.5YesAudit: ConfigurationInclude All Log Sources
CCF: Software Install Rule1371This AIE rule creates an event and alerts on any software installation activity across the environment.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.8, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.4, SI.L1-3.14.5NoAudit: ConfigurationInclude All Log Sources
CCF: Software Uninstall Failure Alarm1374This alerts on failed or interrupted software uninstallations.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.3, AC.L2-3.1.7, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.4, SI.L1-3.14.5YesAudit: ConfigurationInclude All Log Sources
CCF: Software Uninstall Rule1372This AIE rule creates an event and alerts on any software uninstallation activity across the environment.AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.3, AC.L2-3.1.7, AU.L2-3.3.8, CM.L2-3.4.6, CM.L2-3.4.9, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.7, MP.L2-3.8.8, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.4, SI.L1-3.14.5NoAudit: ConfigurationInclude All Log Sources
CCF: Suspected Wireless Attack Alarm1223This AIE Rule creates an event and alerts on suspected wireless attacks (success/failure) against the boundary monitoring devices.AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MP.L2-3.8.1, MP.L2-3.8.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: AttackCCF: Wireless IDS
CCF: Time Sync Error Alarm1215This AIE Rule creates an event and alerts for any time sync errors occurring on any Log Source.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.7, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesOperations: WarningInclude All Log Sources
CCF: Unknown User Account Alarm1243This rule identifies activity originating from unknown user accounts, based off of the CCF user lists.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: SuspiciousInclude All Log Sources
CCF: Vulnerability Detected Alarm1218This AIE Rule alerts on the occurrence of vulnerabilities or suspicious events across the organization's environment.AC.L2-3.1.12, AC.L2-3.1.3, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.8, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.13, SC.L2-3.13.15, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7YesSecurity: VulnerabilityInclude All Log Sources
CCF: Windows RunAs Privilege Escalation1321User not in the LogRhythm List "Privileged Users" chooses to Run a Windows program as an administrator using the "Run as administrator" option.AC.L1-3.1.1, AC.L1-3.1.2, AC.L1-3.1.20, AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.8, AC.L2-3.1.10, AC.L2-3.1.16, AC.L2-3.1.12, AC.L2-3.1.14, AC.L2-3.1.3, AC.L2-3.1.7, AC.L2-3.1.17, AC.L2-3.1.18, AC.L2-3.1.15, AC.L2-3.1.19, AC.L2-3.1.19, AU.L2-3.3.2, AU.L2-3.3.1, AU.L2-3.3.3, AU.L2-3.3.4, AU.L2-3.3.9, AU.L2-3.3.5, AU.L2-3.3.6, CM.L2-3.4.6, CM.L2-3.4.2, CM.L2-3.4.3, CM.L2-3.4.8, IA.L1-3.5.1, IA.L1-3.5.2, IA.L2-3.5.7, IA.L2-3.5.8, IA.L2-3.5.9, IA.L2-3.5.3, IA.L2-3.5.4, IA.L2-3.5.5, IA.L2-3.5.6, IR.L2-3.6.1, IR.L2-3.6.2, IR.L2-3.6.3, MA.L2-3.7.1, MA.L2-3.7.2, MP.L2-3.8.1, MP.L2-3.8.2, PS.L2-3.9.2, RM.L2-3.11.1, RM.L2-3.11.3, CA.L2-3.12.1, CA.L2-3.12.3, SC.L1-3.13.1, SC.L1-3.13.5, SC.L2-3.13.12, SC.L2-3.13.2, SC.L2-3.13.3, SC.L2-3.13.4, SC.L2-3.13.6, SC.L2-3.13.7, SC.L2-3.13.8, SC.L2-3.13.13, SC.L2-3.13.15, SC.L2-3.13.16, SI.L1-3.14.1, SI.L1-3.14.2, SI.L1-3.14.4, SI.L1-3.14.5, SI.L2-3.14.3, SI.L2-3.14.6, SI.L2-3.14.7NoSecurity: Suspicious1. Include All Log Sources
2. Include All Log Sources
JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.

Contact Support Close