Healthcare (OT) - AIE Rule Configuration

AI Engine Rule Name	Description	Rule Block Summary
HC: Account Added to Privileged Group	Observes for an account added to an admin/privileged user group	Primary Criteria	Common Event Is : Account Added To Group and Group Is : Privileged Groups
		Log Sources	All Log Sources
		Group By	User (Origin) Group User (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Admin Password Modified	Observes for an admin/privileged user password modification	Primary Criteria	Common Event Is : Password Modified and User (Impacted) Is : HC: Privileged Users
		Log Sources	All Log Sources
		Group By	User (Origin) User (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit Application Config Change	Observes for changes to critical application configurations	Primary Criteria	Common Event Is : Configuration Modified : Application Configuration Deleted : Application Configuration Enabled : Application Configuration Loaded : Application
		Log Sources	All Log Sources
		Group By	Process Name Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit Backup Failure	Observes for failed critical backup events	Primary Criteria	Common Event Is : Backup Failed Backup Falure
		Log Sources	All Log Sources
		Group By	Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit Database Config Change	Observes for changes to critical database configurations	Primary Criteria	Common Event Is : Configuration Deleted : Database Configuration Disabled : Database Configuration Modified : Database Configuration Enabled : Database Configuration Loaded : Database
		Log Sources	All Log Sources
		Group By	Host (Impacted) Object
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit Net Access Config Change	Observes for changes to critical network access configurations	Primary Criteria	Common Event Is : Configuration Deleted : Network Access Configuration Disabled : Network Access Configuration Modified : Network Access Configuration Enabled : Network Access Configuration Loaded : Network Access
		Log Sources	All Log Sources
		Group By	Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit Service Stopped	Observes for critical service stop events that are not followed by service start events	Primary Criteria	Common Event Is : Process/Service Stopped Process/Service Stopping Service Shutdown
		Log Sources	All Log Sources
		Group By	Host (Impacted) Process Name
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit System Config Change	Observes for changes to critical system configurations	Primary Criteria	Common Event Is : Configuration Deleted: System Configuration Disabled : System Configuration Modified : System Configuration Enabled : System Configuration Loaded : System
		Log Sources	All Log Sources
		Group By	Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Crit System Shutdown	Observes for critical system shutdowns that are not followed by startup activity	Primary Criteria	Common Event Is : System Restarting System Shutdown System Shutting Down
		Log Sources	All Log Sources
		Group By	Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Data Copy To Removable Device	Observes for data transfer to a removable device (e.g., USB drive)	Primary Criteria	Rule Block 1: Log Source Type Is : LogRhythm Data Loss Defender and MPE Rule Name Is : CONNECTED - CDRom CONNECTED - Removable Rule Block 2: Log Source Type Is : LogRhythm Data Loss Defender and MPE Rule Name Is : DATACOPY - Removable/CDRom
		Log Sources	Rule Block 1: All Log Sources Rule Block 2: All Log Sources
		Group By	Rule Block 1: User (Origin) Common Event Rule Block 2: User (Origin) Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Default Or Weak Password	Observes for a default or weak password	Primary Criteria	Common Event Is : Vuln Low Severity : Default Password Vuln Medium Severity : Default Password Vuln High Severity : Default Password Password Too Short
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Device Modified	Observes for device modifications	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE and Common Event Is : Object Modified
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Device Sent Plaintext Credentials	Observes for device transmission of a plaintext password	Primary Criteria	Log Source Type Is : Syslog - Medigate CEF and Common Event Is : Vuln High Severity : General
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Device Software Vulnerability	Observes for device software vulnerabilities	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE and Common Event Is : Vuln Low Severity : General
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Door Access Granted	Observes for successful door authentications	Primary Criteria	Log Source Type Is : Flat File - S2 Badge Reader Flat File - KERISYS Doors Event Export Format and Common Event Is : Object Accessed Door Access Granted
		Log Sources	All Log Sources
		Group By	Classification User (Origin) Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Expired Certificate	Observes for an expired TLS certificate	Primary Criteria	Log Source Type Is : Syslog - Medigate Syslog - Ordr SCE
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: File Deletion Activity	Observes for file deletions	Primary Criteria	Common Event Is : File Deleted File Monitoring Event - Delete
		Log Sources	All Log Sources
		Group By	User (Origin) Host (Impacted) Object
AI Engine Rule Name	Description	Rule Block Summary
HC: Firmware Change	Observes for device firmware changes	Primary Criteria	Log Source Type Is : Syslog - Medigate and Common Event Is : Upgrade Information
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Malicious IP	Observes for device communication with a destination IP flagged as potentially malicious	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE Syslog - Medigate CEF and Common Event Is : Bad IP Reputation
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Multiple Account Lockouts	Observes for an account locked out multiple times (>=3) per hour	Primary Criteria	Common Event Is : Account Locked User Logon Failure : Account Locked Out
		Log Sources	All Log Sources
		Group By	User (Impacted) Log Source Common Event
		Thresholds	Log Count >=3
AI Engine Rule Name	Description	Rule Block Summary
HC: Multiple Door Access Failures	Observes for multiple failed door authentications	Primary Criteria	Log Source Type Is : Flat File - S2 Badge Reader Flat File - KERISYS Doors Event Export Format UDLA - Symmetry Access Control and Common Event Is : Access Object Failure
		Log Sources	All Log Sources
		Group By	Classification Common Event
		Thresholds	Log Count >=3
AI Engine Rule Name	Description	Rule Block Summary
HC: New Hardware Detected	Observes for connection of a new external device (e.g., USB drive, keyboard, mouse) to a system	Primary Criteria	Common Event Is : New Device Found Hardware Installed Object Initialized General Device Manager Message
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: New Medical Device	Observes for a newly discovered medical device (e.g., infusion pump)	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE Syslog - Medigate and Common Event Is : New Device Found Object Created
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Sensor Connected/Disconnected	Observes for sensor connections/disconnections	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE and Common Event Is : Interface Connected Interface Disconnected
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: SMBv1 Communication	Observes for device communication over SMBv1	Primary Criteria	Log Source Type Is : Syslog - Medigate and Common Event Is : SMB Session Created
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Software Install/Update Failure	Observes for failed software installations/updates	Primary Criteria	Common Event Is : Install Failed Software Installation Failed Software Update Failed Update Failed
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: Software Installed/Updated	Observes for successful software installations/updates	Primary Criteria	Common Event Is : Software Installed Software Updated Update Successful
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: System Time Changed	Observes for system time changes	Primary Criteria	Common Event : Session Setting Changed Time Adjusted System Time Updated
		Log Sources	All Log Sources
		Group By	Classification Common Event
AI Engine Rule Name	Description	Rule Block Summary
HC: User Account Created	Observes for creation of a new user account	Primary Criteria	Classification Is : Account Created
		Log Sources	All Log Sources
		Group By	User (Origin) Host (Impacted)
AI Engine Rule Name	Description	Rule Block Summary
HC: Vulnerability Scan Event	Observes for vulnerability scans	Primary Criteria	Log Source Type Is : Syslog - Ordr SCE Common Event Is : Scan Started Scan Stopped
		Log Sources	All Log Sources
		Group By	Classification Common Event