NCSC - AI Engine Rules
In the table below, there is a “CAF 4.0 Migration Mapping” column. When cloning each Knowledge Base item for CAF 4.0 implementation, add the corresponding mappings represented below to your LogRhythm deployment’s Knowledge Base items.
With this cloning guidance in mind, proceed from here using the table below to identify the appropriate CAF 4.0 mapping recommendations.
For more information on CAF 4.0 and the differences implemented with its August 2025 release, refer to the NCSC CAF front page.
AI Engine Rules | Rule ID | Description | NCSC Control Support* | NCSC CAF 4.0 Migration Mapping | Alarming | Classifications | Log Sources |
|---|---|---|---|---|---|---|---|
CCF: Abnormal Amount of Data Transferred | 1230 | This rule alerts whenever a significant change (400% increase or 75% decrease) in Bytes In or Bytes Out occurs from a specific host. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW – Behavior & TI integration); C2.b (expanded – Threat Hunting). | No | Operations : Warning | 1. Include All Log Sources |
CCF: Abnormal Origin Location | 1208 | First tracks geographic locations for logins. Afterwards, triggers when a new origin location is seen for a user. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW); C2.b (expanded) for structured hunting on geo‑anomalies. | No | Security : Attack | 1. Include All Log Sources |
CCF: Account Deleted Rule | 1367 | This rule provides details of accounts that have been deleted. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) to add behavior‑aware account lifecycle monitoring. | No | Audit: Account Deleted | Include All Log Sources |
CCF: Account Disabled Rule | 1369 | This AIE Rule alerts whenever any accounts have access revoked. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) for user/system behavior baselining. | No | Audit: Access Revoked | Include All Log Sources |
CCF: Account Enabled Rule | 1368 | This AIE Rule alerts whenever any accounts have access granted. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) to reflect behavioral access baselines. | Yes | Audit: Access Granted | Include All Log Sources |
CCF: Account Modification | 1377 | This AIE Rule creates a common event and provides detail around account modification activity. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) behavior‑centric account change monitoring. | No | Audit : Account Modified | Include All Log Sources |
CCF: Admin Password Modified | 1326 | User changes the password of a different privileged user account. | B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) for privileged‑behavior baselining; C2.b (expanded) for structured hunts on privilege changes. | No | Security: Suspicious | Include All Log Sources |
CCF: Attack then External Connection | 1211 | An observed external attack or compromise followed by data leaving the system and going to the attacker. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C2.b (expanded) to reflect formal Threat Hunting around post‑attack exfil sequences; C1.f (NEW) (behavior context). | No | Security : Compromise | 1. Include All Log Sources |
CCF: Audit Logging Cleared | 1328 | This AIE Rule provides details on audit logging being cleared. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Audit : Configuration | Include All Log Sources |
CCF: Audit Logging Stopped Alarm | 1328 | This AIE Rule provides details on audit logging being stopped. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit : Configuration | Include All Log Sources |
CCF: Auth After Numerous Failed Auths | 1199 | Multiple external unique login attempts are seen on the same impacted host within a short period of time, followed by a successful authentication. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) for behavior baselining; C2.b (expanded) to structure hunts around brute‑force → success patterns. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Auth After Security Event | 1200 | An observed attack, compromise, or other security event followed by successful access or authentication from the attacking host. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C2.b (expanded) threat‑hunt alignment; C1.f (NEW) behavior context on attacker follow‑on auth. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Backup Failure Alarm | 1236 | More than 10 backup failure events are detected. | B4.a.04, B5.c.01, B5.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D1.b.04, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Operations : Error | Include All Log Sources |
CCF: Backup Information | 1237 | This AIE Rule creates events for information from backup software. | B4.a.04, B5.c.01, B5.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D1.b.04, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Operations : Information | Include All Log Sources |
CCF: Blacklist Location Auth | 1204 | Authentication success from a blacklisted location. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Blacklisted Account Alarm | 1334 | This AIE creates an alarm when a blacklisted account activity occurs within the environment. This requires the CCF: User Blacklist to be populated and updated regularly. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit : Other Audit Success | Include All Log Sources |
CCF: Compromise Detected Alarm | 1335 | This AIE rule creates an event and alerts on potential compromises across the environment. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Compromise | Include All Log Sources |
CCF: Concurrent VPN from Multiple Locations | 1205 | Multiple VPN authentication successes from the same origin login are observed from different regions within a given time period (defaults to 3 hours). | B2.a.01, B2.a.02, B2.a.03, B2.a.04, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) (behavior/TI integration) and C2.b (expanded) (structured hunts on location‑based anomalies). | No | Security : Compromise | Include All Log Sources |
CCF: Concurrent VPN from Same User | 1373 | This AIE Rule alerts on the occurrence of concurrent VPN access from the same user. | B2.a.01, B2.a.02, B2.a.03, B2.a.04, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW); C2.b (expanded) (structured hunts on session concurrency). | No | Security : Suspicious | Include All Log Sources |
CCF: Config Change After Attack | 1214 | Attack event on a host followed by a configuration change made to that host within 3 minutes. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Config Change then Critical Error | 1216 | Configuration change followed by a critical error on the same host, indicating an erroneous configuration, malicious intent, or otherwise. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Config Deleted/Disabled | 1219 | Configuration deleted or disabled within the organization infrastructure. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | CCF: Production Servers |
CCF: Config Modified | 1221 | Configuration modified within the organization infrastructure. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Corroborated Account Anomalies | 1207 | 3 or more unique behavioral anomalies for a given user within a 3 hour period. This rule requires Rule IDs 285 - 289 be turned on. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Corroborated Data Access Anomalies | 1201 | 2 or more unique behavioral anomalies for data within a 3 hour period. The alarm requires rule IDs 300-302 be turned on to trigger. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Critical Event After Attack | 1206 | An external attack or compromise followed by a critical event on the same host. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Critical/PRD Envir Patch Failure Alarm | 1212 | This AIE rule creates an alert any time a patch fails to apply to the critical or production environments (entity structure). | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.d.03, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | A4.b (NEW – Secure Software Development & Support) to reflect CAF 4.0 SDLC/maintenance expectations. | Yes | Operations : Error | Include All Log Sources |
CCF: Data Destruction | 1202 | Attack event followed by a FIM delete/modify event on the same host. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Data Exfiltration Observed | 1193 | External attack or compromise followed by data leaving the same system. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C2.b (expanded) for structured hunts around exfiltration; C1.f (NEW) for behavior/TI context. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Data Loss Prevention | 1232 | This AIE Rule provides details of data generated by the LogRhythm Data Loss Defender or other data loss prevention solutions. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Operations : Information | Include All Log Sources |
CCF: Denial of Service Alert | 1376 | This AIE Rule alerts on the occurrence of any identified Denial of Service events. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security: Denial Of Service | Include All Log Sources |
CCF: Disabled Account Auth Success | 1194 | A recently disabled or deleted account authenticates or accesses resources on the network. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Distributed Brute Force | 1203 | A successful brute force authentication - multiple failed authentication attempts from different external hosts to the same host using the same origin login, followed by an authentication success. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Early TLS/SSL Alarm | 1238 | This AIE Rule alerts on the occurrence of any identified TLS LogRhythm Network Monitor event. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Activity | Include All Log Sources |
CCF: Excessive Authentication Failures Rule | 1370 | This AIE Rule supports alerting on >10 authentication failures in 30 minutes (login failures). Match this threshold to your organization's specific authentication failure policies. | B2.a.01, B2.a.02, B2.a.03, B2.a.04, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit : Authentication Failure | Include All Log Sources |
CCF: External Brute Force Auths | 1197 | Successful authentication after multiple failed attempts from different external origin hosts to the same impacted host. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: Failed Audit Log Write Alarm | 1332 | This AIE Rule provides details on audit log write failures. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit : Configuration | Include All Log Sources |
CCF: FIM Abnormal Activity | 1233 | This AIE Rule creates events for all abnormal file integrity monitoring activity. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Suspicious | 1. Include All Log Sources |
CCF: FIM Add Activity | 1234 | This AIE Rule creates events for all file integrity monitoring add activity. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Activity | Include All Log Sources |
CCF: FIM Delete Activity Alarm | 1235 | This AIE Rule alarms on file integrity monitoring delete activity. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Activity | Include All Log Sources |
CCF: FIM General Activity | 1239 | This rule creates an event for file integrity monitoring activity, including adds, deletes, modifies, group changes, owner changes, and permissions. The FIM log source can be established from LogRhythm's FIM or other FIM solutions. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Operations : Information | Include All Log Sources |
CCF: FIM Information | 1229 | This AIE Rule creates events for general file integrity monitoring information. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Operations : Information | Include All Log Sources |
CCF: GeoIP Blacklisted Region Activity | 1241 | This rule tracks activity associated with Blacklisted Regions (list). | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) behavior+TI integration for geo‑based controls. | No | Security : Suspicious | Include All Log Sources |
CCF: GeoIP General Activity | 1240 | This rule is designed to use with the Data Processor's GeoIP functionality to represent general GeoIP activity. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | C1.f (NEW) to incorporate behavior and TI context into GeoIP monitoring. | No | Security : Suspicious New: Operations : Information | Include All Log Sources |
CCF: Large Outbound Transfer | 1195 | Single host is seen sending over 1GB of data within 30 minutes out of the network. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | Include All Log Sources |
CCF: Linux sudo Privilege Escalation | 1330 | User not in the LogRhythm list "CCF: Privileged Accounts" and not in the local 'sudoers' file tries to use sudo on a Linux host. | B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Suspicious | Include All Log Sources |
CCF: Local Account Created and Used | 1196 | An account is created on a host and then used shortly thereafter on the same host. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Compromise | 1. Include All Log Sources |
CCF: LogRhythm Silent Log Source Error Alarm | 1209 | This AIE Rule creates an alert and provides information when a LogRhythm Log Source has not received logs from a critical or production server-system during the defined error period. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Operations : Warning | Include All Log Sources |
CCF: Malware Alarm | 1217 | This AIE Rule provides details on malware activity across the organization's environment where malware detection/prevention is applied. | B4.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Malware | Include All Log Sources |
CCF: Misuse | 1231 | This AIE Rule provides details on misuse activity. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Misuse | Include All Log Sources |
CCF: Multiple Account Passwords Modified by Admin | 1327 | An observed login by a user in the privileged user list followed by the change of two or more other account passwords. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security: Suspicious | Include All Log Sources |
CCF: Non-Encrypted Protocol Alarm | 1222 | This investigation provides details of unencrypted applications being utilized within the critical and production systems or environments (entity structure). | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Operations : Information | Include All Log Sources |
CCF: Password Modified by Admin | 1325 | Privileged user changes the password of another account. | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security: Suspicious | Include All Log Sources |
CCF: Password Modified by Another User | 1333 | User changes the password of another account (not their own). | B2.a.01, B2.a.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Audit: Account Modified | Include All Log Sources |
CCF: PRD Envir Config/Policy Change Alarm | 1210 | This AIE rule creates an alert any time a configuration or policy modification logs are received from a critical or production environment (entity structure). | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.d.03, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit : Policy | CCF: Production Servers |
CCF: PRD Envir Signature Failure Alarm | 1213 | This AIE Rule creates an alert on signature update failures on critical or production environments (entity structure). | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, B4.d.02, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.d.03, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Operations : Error | Include All Log Sources |
CCF: Priv Group Access Granted Alarm | 1324 | This AIE Rule provides details on access granted to privileged groups (administrators, dnsadmins, domain admins, enterprise admins, schema admins) within the organization infrastructure. | B2.a.01, B2.a.02, B2.c.01, B2.c.02, B2.c.04, B2.c.05, B2.c.08, B2.d.02, B2.d.03, B2.d.05, C1.a.01, C1.a.04, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit: Access Granted | Include All Log Sources |
CCF: Privilege Escalation After Attack Alarm | 1329 | Compromised host event followed by a new account created or account modified on the same host. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Compromise | 1. Include All Log Sources |
CCF: Rogue Access Point Alarm | 1220 | This AIE Rule alerts on the occurrence of any rogue access point detection events against the organization's environment. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security: Suspicious | Include All Log Sources |
CCF: Social Media Event | 1242 | This rule tracks social media activity to help identify if private or personal data that should not be in transmission is present within the environment's traffic. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Suspicious | Include All Log Sources |
CCF: Software Install Failure Alarm | 1375 | This alerts on failed and incomplete attempts to update or install software in the organization. | B4.b.05, B4.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit: Configuration | Include All Log Sources |
CCF: Software Install Rule | 1371 | This AIE rule creates an event and alerts on any software installation activity across the environment. | B4.b.05, B4.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Audit : Configuration | Include All Log Sources |
CCF: Software Uninstall Failure Alarm | 1374 | This alerts on failed or interrupted software uninstallations. | B4.b.05, B4.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Audit: Configuration | Include All Log Sources |
CCF: Software Uninstall Rule | 1372 | This AIE rule creates an event and alerts on any software uninstallation activity across the environment. | B4.b.05, B4.c.03, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Audit : Configuration | Include All Log Sources |
CCF: Suspected Wireless Attack Alarm | 1223 | This AIE Rule creates an event and alerts on suspected wireless attacks (success/failure) against the boundary monitoring devices. | B3.b.02, B3.c.02, B3.c.03, B3.c.04, B3.c.05, B3.d.01, B4.b.02, B4.b.03, B4.b.04, C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security: Attack | CCF: Wireless IDS |
CCF: Time Sync Error Alarm | 1215 | This AIE Rule creates an event and alerts for any time sync errors occurring on any Log Source. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Operations: Warning | Include All Log Sources |
CCF: Unknown User Account Alarm | 1243 | This rule identifies activity originating from unknown user accounts, based off of the CCF user lists. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security : Suspicious | Include All Log Sources |
CCF: Vulnerability Detected Alarm | 1218 | This AIE Rule alerts on the occurrence of vulnerabilities or suspicious events across the organization's environment. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | Yes | Security: Vulnerability | Include All Log Sources |
CCF: Windows RunAs Privilege Escalation | 1321 | User not in the LogRhythm List "Privileged Users" chooses to Run a Windows program as an administrator using the "Run as administrator" option. | C1.a.01, C1.a.05, C1.a.06, C1.c.01, C1.c.02, C1.c.03, C1.c.04, C1.c.05, C1.c.06, C1.d.01, C1.d.02, C1.e.01, C1.e.03, C2.a.01, C2.a.02, C2.a.03, C2.a.04, C2.b.01, D2.a.01, D2.a.02, D2.a.03 | No changes. | No | Security : Suspicious | 1. Include All Log Sources |
*NCSC Control Key | |
|---|---|
Control Format | Definition |
xx.x.xx | Objective & Principal, Sub-Objective, Indicators of Good Practice (IGP) |