Log Type	Details
Azure Directory Audit	NEW - Azure: Service Principal Creation or Modification Followed by Directory Role Assignment Detects when a service principal is created or modified with a client secret and assigned a directory role within a short timeframe. While this can be legitimate activity when adding new app registrations, threat actors have been observed using this technique to gain persistence and elevate privileges in Azure environments. Default state: Enabled
Azure Signin	NEW - Microsoft 365: Suspicious Successful Login - Axios User Agent Detects successful Microsoft 365 sign-ins using the Axios HTTP client library. Axios is a legitimate JavaScript HTTP client that threat actors increasingly abuse in Adversary-in-the-Middle (AitM) phishing campaigns to intercept credentials, MFA tokens, and session tokens in real-time. This user agent pattern is unusual for typical user authentication flows. Default state: Disabled
Fortigate Anomaly	NEW - Fortigate: Allowed High/Critical Anomaly Event Detects when a Fortigate device identifies a high or critical severity anomaly event. These events may indicate denial of service attempts, network scanning, or other suspicious network activity that warrants investigation. Default state: Disabled
Fortigate IPS	NEW - Fortigate: Allowed High/Critical IPS Event Detects high or critical severity IPS events on Fortigate devices that were not blocked. This may indicate a misconfigured IPS policy or an attack that bypassed protection and requires immediate investigation. Default state: Enabled
Fortigate IPS	NEW - Fortigate: Allowed Medium IPS Event Detects medium severity IPS events on Fortigate devices that were not blocked. This may indicate a misconfigured IPS policy or an attack that bypassed protection. Default state: Disabled
Fortigate Virus	NEW - Fortigate: Allowed Virus Event Detects when a Fortigate device identifies a virus that was allowed through rather than blocked, indicating a potential antivirus policy misconfiguration. Default state: Disabled
Microsoft 365	NEW - Microsoft 365: Impossible Travel Detects when Microsoft 365 users exhibit impossible travel behavior within a 3-hour window at 500 MPH or faster. Impossible travel refers to logins or access attempts from different geographic locations within an unrealistically short timeframe, indicating potential credential compromise or malicious activity. This new detection rule differs from our existing “Impossible Travel” rules by calculating travel speed rather than flat distance. Default state: Disabled
Windows	NEW - File Download Using Protocolhandler.EXE Detects the execution of Protocolhandler.EXE spawned by cmd.exe. Attackers abuse this signed Microsoft Office binary to download files from external sources, typically to download tools or malware. This technique allows attackers to bypass certain application allowlisting controls or network restrictions by proxying the download request through a signed Microsoft binary. Default state: Enabled
Windows	NEW - Remote Access Tool: Tactical RMM Detects Tactical RMM activity on endpoints. While commonly used for legitimate remote management by system administrators, attackers have been observed using it as a command-and-control channel. Default state: Enabled
Windows	NEW - Windows Guest Account Enabled Detects when someone enables the built-in Windows Guest account. The Guest account is disabled by default in modern Windows systems and provides a low-privilege access point that does not require a password. Threat actors might enable the account during post-compromise activity to establish persistence, create a backdoor for later access, or facilitate lateral movement within a network. Default state: Enabled
Azure Signin	UPDATE - Azure Entra ID Anomalous Agent Sign-In Activity Added logic to ensure only successful sign-ins are detected.
Google Workspaces	UPDATE - Google Workspace External Document Share We updated the detection logic to be more accurate and include additional check to ensure the user is sharing externally.
M365 SharePoint	UPDATE - MS365 SharePoint 100+ File Deletions in 15 Minutes We added logic to handle null file_path and file_name fields to reduce failures and false positives.
Traffic	UPDATE - TCP 445 Connection from Public IP We updated the detection logic to filter out connections that are quickly torn down, reducing false positives.
Windows	UPDATE - Finger.EXE Execution We broadened the detection logic to surface any finger.EXE execution. Renamed from “Suspicious Invocation of Finger.exe.”
Windows	UPDATE - User Created in PowerShell To fix false positives that were being caused by module metadata, we now require command parameters for detection.

Log Type	Details
Check Point Audit	NEW - Check Point: User Object Change Monitors for the creation, deletion, or modification of user objects in Check Point firewalls Default state: Enabled
Fortigate Event	NEW - Fortigate: Local Admin Created Detects the creation of new local administrator accounts on Fortigate devices Default state: Enabled
Fortigate Event	NEW - Fortigate: Local Admin Edited Monitors for local administrator accounts being renamed or modified on Fortigate devices Default state: Disabled
Fortigate Event	NEW - Fortigate: Local Admin Deleted Monitors for the deletion of local administrator accounts on Fortigate devices Default state: Disabled
Fortigate Event	NEW - Fortigate: Local User Created Detects the creation of new local user accounts on Fortigate devices Default state: Enabled
Fortigate Event	NEW - Fortigate: Local User Edited Monitors for local user accounts being renamed or modified on Fortigate devices Default state: Disabled
Fortigate Event	NEW - Fortigate: Local User Deleted Monitors for the deletion of local user accounts Fortigate devices Default state: Disabled
Fortigate Virus	NEW - Fortigate: Unblocked Infected File Triggers when Fortigate’s antivirus engine identifies a malicious file, but the associated traffic is not blocked Default state: Enabled
JumpCloud Directory	NEW - JumpCloud: Admin Login Without MFA Monitors for successful JumpCloud administrator login without multi-factor authentication Default state: Enabled
JumpCloud Password Manager	NEW - JumpCloud: Potential Password Manager Export Triggers when JumpCloud detects export activity from a password manager, which is a tactic often used by attackers to exfiltrate credentials during an account compromise Default state: Enabled
Microsoft 365 and Azure	NEW - Microsoft 365: User Authentication from New Country Identifies login events originating from a country the user has not logged in from within the prior 15 days Default state: Enabled
SentinelOne Activities	NEW - SentinelOne: Agent Uninstall Request Monitors for requests to uninstall the SentinelOne agent, which may indicate early-stage attempts by an attacker to remove the agent from a protected endpoint Default state: Enabled
Windows	NEW - Suspicious Explorer Process with Whitespace Padding Identifies processes in Windows Explorer containing 12 or more consecutive Unicode whitespace characters in the command line arguments, which is commonly seen in ClickFix and FileFix social engineering attacks Default state: Enabled
Fortigate	UPDATE - Fortigate: Successful Admin Login from External IP Address Corrected a typo in the detection’s analysis
Windows	UPDATE - Remote Access Tool: Splashtop Updated to include additional known process names
Windows	UPDATE - Remote Access Tool: NetSupport Manager Updated logic for broader coverage, elevated priority to P2 Suspect, and changed the default deploy state to enabled
Windows	UPDATE - Remote Access Tool: NetSupport Manager From Unusual Location - Increased priority to P1 Suspect and changed the default deploy state to enabled - Findings for this rule now include the hash field for added context

Log Type	Details
JumpCloud	NEW - JumpCloud: Global Administrator Role Granted This detection rule detects when someone assigns a JumpCloud user the Administrator or Administrator with Billing role. Default state: Enabled
JumpCloud	NEW - JumpCloud: Impossible Travel This detection rule detects when a JumpCloud user exhibits behavior consistent with impossible travel, where successful logins occur from geographically distant locations within a timeframe that would require travel speeds exceeding 500 MPH. Impossible travel refers to logins or access attempts that originate from different geographic locations within an unrealistically short timeframe, indicating potential malicious activity. Default state: Enabled
Sonicwall	NEW - Sonicwall: IP Spoof Alert This detection rule detects when a SonicWall firewall has generated numerous, consistent IP spoof alerts within a short period of time. This might be indicative of malicious attempts to access a network, but can also result from bad network or VPN routes. Default state: Disabled
Sonicwall	NEW - Sonicwall: SYN Flood Alert This detection rule detects a buildup of TCP SYN requests that are not followed by responses from the requesting host. This behavior is a common indicator of a SYN Flood attack, a type of denial-of-service (DoS) attack that aims to exhaust server resources and prevent legitimate requests. Default state: Disabled
Ubiquiti	NEW - Ubiquiti: UniFi Threat Detected and Blocked from Internal This detection rule triggers when a Ubiquiti UniFi threat signature identifies and blocks suspicious activity originating from within the internal network. This may indicate a compromised internal endpoint and should be investigated. Default state: Enabled
Windows	NEW - Potential Brute Force - 4625 & 4771 This detection rule detects potential brute-force attacks based on a high volume of login failures in a short timeframe. This rule triggers when 300 or more failed login events (event IDs 4625 and 4771) are observed within a 12-minute window for a single user account from a single source. Default state: Enabled
Windows	NEW - Potential EDR-Freeze Isolation Pattern This detection rule detects log patterns consistent with EDR-Freeze exploitation, a technique that uses WERFaultSecure.exe to isolate and impair endpoint detection and response (EDR) tools such as Microsoft Defender, SentinelOne, and CrowdStrike. This method can disrupt endpoint visibility and weaken defensive capabilities. Default state: Enabled
Windows	NEW - PUA: Wireshark Network Protocol Analyzer This detection rule detects the installation or execution of Wireshark, a widely-used network protocol analyzer used to capture and inspect network traffic in real time. While commonly used by IT and security professionals for legitimate purposes, Wireshark can also be leveraged by threat actors to intercept sensitive data, capture credentials, analyze communications, and perform internal reconnaissance after a compromise. Default state: Disabled
Windows	NEW - Suspicious Shell Execution from WSUS Service This detection rule identifies instances where cmd.exe or PowerShell spawns from the Windows Server Update Services (WSUS) service. This behavior is a known indicator of CVE-2025-59287, a critical unauthenticated remote code execution vulnerability in WSUS that allows attackers to execute arbitrary commands with system privileges. Default state: Enabled
1Password	UPDATE - 1Password: Impossible Travel Activity Detection logic now watches for specific and impossible speed between login events rather than relying on a flat distance threshold. This improves accuracy in detecting suspicious travel across all distances.
JumpCloud	UPDATE - JumpCloud: Delete User Updated to reflect new log parsing logic for more reliable detection.
JumpCloud	UPDATE - JumpCloud: Create User Updated to reflect new log parsing logic for more reliable detection.
Microsoft 365	UPDATE - Microsoft 365: Enabling of Forwarding Setting to External Domain Updated to account for log changes from Microsoft for added accuracy.

Log Type	Details
Microsoft 365	NEW - Microsoft 365: Purview eDiscovery Search or Export This detection identifies when a user initiates an eDiscovery search or export in Microsoft 365. This powerful feature can be used for legal compliance, but also for unauthorized data exfiltration. Default state: Disabled
Palo Alto GlobalProtect	NEW - Palo Alto GlobalProtect: Password Spraying Behavior This detection identifies potential password spraying attacks by identifying failed authentication attempts across multiple user accounts from a single source. Default state: Disabled
Sophos XG	NEW - Sophos: Excessive VPN Login Failures This detection identifies a high rate of failed VPN login attempts from a single IP address reported by your Sophos firewall. Multiple rapid failed login attempts across different usernames may indicate credential stuffing or brute-force activity targeting your VPN. Default state: Enabled
VMware	NEW - VMware: VM Creation This detection rule monitors for new virtual machine creation events within a VMware environment. Default state: Disabled
Windows	NEW - Esentutl File Copy Operation This new detection rule monitors for use of the Windows utility esentutl.exe to copy files. While legitimate, this tool is often abused by threat actors to exfiltrate data or move files undetected. Default state: Enabled
Windows	NEW - Modification to Group Policy Objects This rule monitors for group policy object (GPO) modifications, such as changes to policy links, added values, or deletions. While GPO modifications are common during routine system administration, this behavior can indicate persistence or privilege abuse by attackers. Default state: Disabled
Microsoft 365	UPDATE - Microsoft 365: Impossible Travel AAD Login (All distance versions) All versions of this detection rule now include device name and device ID fields to provide additional context during investigations. When available, this information gives responders useful context during investigation and remediation.
Microsoft 365	UPDATE - Microsoft 365: SsoArtifactRevoked Failed Login This detection logic has been updated to reflect changes in Microsoft log formatting.
OSSEC	UPDATE - MS SQL Server Logon Failure We updated this detection to account for recent changes in OSSEC rule numbers to ensure continued accuracy.
OSSEC	UPDATE - TCP/445 Connection from Public IP We updated the title, analysis, and workflow of this rule for clarity when working with a finding. This detection was previously titled “SMB Connection from Public IP.” Similar improvements are planned for related detections in this series.

Log Type	Details
Microsoft 365	NEW - Microsoft 365: Secure Access Pass Created This detection rule monitors for the administrators creating Temporary Access Passes, which allow users to bypass standard credential checks. Default state: Enabled
VMware	NEW - VMware: SSH Enabled on Host This detection rule monitors for when a user enables SSH service on ESXi or vSphere hosts. Default state: Disabled
Windows	NEW - Internal Reconnaissance - All Connections - Low Threshold This detection rule is similar to existing detections that identify internal reconnaissance, but a lower connection count threshold needs to be met before generating a finding. Default state: Disabled
Windows	NEW - Potential Exfiltration via WinSCP This rule detects WinSCP usage patterns consistent with recent attack behaviors, indicating possible data exfiltration. Default state: Disabled
Windows	NEW - Remote Access Tool: PDQ Remote Desktop Agent This detection rule identifies when PDQ’s Remote Desktop Agent launches or is running on an endpoint, which may indicate remote access activity. Default state: Enabled
Microsoft 365	UPDATE - Microsoft 365: Suspicious Inbox Rule Creation We expanded this rule’s coverage to include inbox rules being created to send emails to the “Deleted” folder.
Windows	UPDATE - Compress Data for Exfiltration: Rar We expanded this rule’s coverage to include new command patterns observed in recent attacks.
Windows	UPDATE - Named Pipe Client Impersonation We updated this rule’s detection logic to reduce false positives triggered by safe and legitimate Chrome extensions.

Log Type	Details
1Password	NEW - 1Password: Activity From Tor Exit Node This detection uses Blumira’s Tor Exit Node threat feed to identify when 1Password activity originates from an IP associated with a Tor exit node. Default state: Enabled
1Password	NEW - 1Password: Vault Export Event This detection monitors for vault export events, indicating that a user is attempting to export their saved vault items. This is risky behavior due to the sensitivity of the exported data. Default state: Enabled
1Password	NEW - 1Password: Impossible Travel Activity This detection monitors successful logins that originate from geographically distant locations within an unrealistically short timeframe, indicating potential suspicious activity. Default state: Enabled
CrowdStrike	NEW - CrowdStrike: Automated Lead CrowdStrike has released a new feature called Automated Leads; which uses their Signal engine to identify and alert on unusual behavior. This has been released as disabled by default due to many users reporting high volumes of low-fidelity alerts and false positives. Default state: Disabled
Microsoft 365	NEW - Microsoft 365: Authentication Outside of Canada This detection monitors for successful Microsoft 365 authentications outside of Canada. Default state: Disabled
Okta	NEW - Okta: User Account Lock This rule detects account lock events in Okta, indicating that it has exceeded the maximum number of failed login or failed MFA attempts. Default state: Disabled
VMware	NEW - VMware: New User Created This detection monitors for the creation of new user accounts in VMware environments. Default state: Enabled
VMware	NEW - VMware: User Password Reset Event This detection monitors for VMware user password reset events. Default state: Enabled
Windows	NEW - PUA: PingCastle Activity This detection monitors for PingCastle execution, a popular Active Directory(AD) security assessment tool used to identify misconfigurations, privilege escalation paths, and domain weaknesses. While often used by defenders and auditors, it is also frequently leveraged by threat actors and red teams during internal reconnaissance after gaining access to a network. Default state: Enabled
Windows	NEW - Unusual Network Activity from Windows System Binary This detection monitors for network activity originating from specific Windows system binaries. Attackers frequently leverage these legitimate, signed binaries to execute malicious payloads to evade security controls. Disabled by default due to high rate of false positives observed during testing. This detection may require some tuning per environment. Default state: Disabled
Azure	UPDATE - Azure: Failed Single Factor PowerShell Authentication Attempts We reclassified this rule to a Priority 3 (P3) Risk to better reflect its threat level.
CrowdStrike	UPDATE - CrowdStrike: Informational Alert, Low Alert, Medium Alert, High Alert, and Critical Alert All CrowdStrike alert detections have been updated to handle CrowdStrike’s new Automated Leads feature. Alerts generated from Automated Leads were incorrectly generating findings for these detections and have been moved to their own dedicated detection rule called “CrowdStrike: Automated Lead” (see above).
Google Workspace	UPDATE - Google Workspace: 100 or More Drive Deletions in 15 Minutes We updated this detection rule to exclude normal Google Drive system activity to more accurately reflect true user behavior and reduce false positives.
Microsoft 365	UPDATE - Microsoft 365 - Application Password Deletion We added a new object field and updated the analysis of this detection rule. We also changed it to be disabled by default. Default state: Disabled
Microsoft 365	UPDATE - Microsoft 365: Login Blocked due to Conditional Access Policy We added app_id_str, is_safe, state, and additional_fields fields for additional context during investigation.
Microsoft 365	UPDATE - Microsoft 365: User Session Token Anomaly This detection now includes the app_id field for greater context during investigations.
Traffic	UPDATE - RDP/FTP/SSH/SMB/Telnet Connection from Public IP A false positive workflow option has been added at the first step to provide a quick workflow option to indicate when a finding is benignWe updated all “<protocol> Connection from Public IP” detection rules with additional fields in the matched evidence tables to help users understand which rule or policy on the firewall is allowing the connection to occur. The new fields include the following: policy_id rule_id rule_uid rule_number policy
Windows	UPDATE - AdFind Domain Enumeration We improved this detection’s logic to reduce false positive matches. Specified AD Find process and added additional AD Find commands. These updates should greatly reduce the amount of false positives reported for this detection.
Windows	UPDATE - Dsquery Network Discovery We updated this detection’s logic to focus on behavior observed in threat actor activity and reduce false positives.
Windows	UPDATE - TOR Browser Usage We updated this detection rule’s logic to trigger findings upon detecting TOR usage on Mac OS agent devices.

Log Type	Details
Windows	NEW - 20+ Failed Windows Login Events for Non-Existent User in 60 Minutes This detection identifies when over 20 failed Windows login attempts occur within an hour associated with non-existent users. This activity may be suspicious or could also surface stale service accounts no longer in use. Threat actors often use long lists of random usernames in an attempt to guess a username/password combo. Default state: Disabled
Windows	NEW - CVE-2025-49704 SharePoint Suspicious Web Shell File Created in LAYOUTS Directory This detection was created in response to the recent vulnerability affecting on-premises SharePoint servers. Legitimate web shells should not be running out of this directory and any related finding should be thoroughly investigated. Default state: Enabled
Azure_signin	UPDATE - Azure: Entra ID Anomalous Agent Sign-In Activity Detection logic updated to add O365 Diagnostic Service to general exclusions.
Azure_signin	UPDATE - Azure Identity Protection Risky Sign-in Users can now review the action_details field in the evidence of the finding to understand why a sign-in was blocked or allowed.
Fortigate_event	UPDATE - Fortigate: Successful Admin Login from External IP Address Detection logic updated to account for instances where src_ip is null. It now uses IP address in message field as a back up. The message field has also been added to evidence.
Osquery	UPDATE - Linux Reverse Shell The parent.cmdline field has been added to several detections which may reveal a script name or some other details that will make investigation and filter building much easier.
Vmware_vcenter	UPDATE - VMware: VM Deletion Detection logic updated to exclude failed VM removal logs. Updated logic will now only match on successful VM deletion.
Windows	UPDATE - Local User Addition or Modification via Net Commands The parent.cmdline field has been added to several detections which may reveal a script name or other details that will make investigation and Filter building much easier.
Windows	UPDATE - Mimikatz Process Creation or Command Run A false positive workflow option has been added at the first step to provide a quick workflow option to indicate when a finding is benign.
Windows	UPDATE - Nltest Domain Enumeration The parent.cmdline field has been added to several detections which may reveal a script name or other details that will make investigation and Filter building much easier.
Windows	UPDATE - Outlook .pst File Export Detection logic updated to exclude false positives generated by .pst exports from internet calendar subscriptions.
Windows	UPDATE - Signed Binary Proxy Execution: Msiexec The event_type field has been added to help investigate and provide appropriate context of the alert.

Log Type	Details
Windows	NEW - Unexpected Taskkill on MSIEXEC by User This detection monitors for when a user unexpectedly runs the taskkill command to terminate the Windows Installer process MSIEXEC, which may be an indicator of attackers interrupting legitimate installers. This tactic has been observed in attempts to interrupt SentinelOne installers during installs or upgrades. Default state: Enabled
Windows	NEW - Remote Access Tool: UltraViewer This new detection rule triggers a finding whenever the remote access tool UltraViewer is seen being used on a device. If your organization does not use UltraViewer as part of its approved remote management toolkit, the activity needs to be investigated as potentially malicious. Default state: Enabled
Microsoft 365	UPDATE - Enabling of Forwarding Setting to External Domain in M365 We updated this detection rule to account for log formatting changes that were causing missed true positives.
Microsoft 365	UPDATE - MS365 Sharepoint 100 or more file deletions in X minutes We renamed the "MS365 Sharepoint 100 or more file deletions in X minutes" detection rule to "Microsoft 365: Sharepoint 100 or more file deletions in X minutes" for clarity and adjusted the logic to reduce false positives and provide responders with more detailed information about the file names.

Log Type	Details
Microsoft 365	NEW - Microsoft 365: User Session Token Anomaly This detection rule monitors for users displaying anomalous behaviors grouped by session IDs. It helps identify potential AiTM (Attacker-in-the-Middle), token theft, pass-the-cookie, or stolen cookie attacks. Default state: Enabled
OneLogin	NEW - OneLogin: User Suspended This detection rule monitors for when users are disabled in OneLogin and identifies who performed the action. Default state: Disabled
SonicWall	NEW - SonicWall: 5+ Login Failures in 15 Minutes Followed by Successful Authentication This detection rule monitors for multiple failed SonicWall admin interface login attempts followed by a successful logon. Default state: Enabled
Traffic	NEW - DFIR Report: Netsupport RAT Command and Control This detection rule monitors for network traffic to IP addresses associated with Netsupport C2 endpoints. Default state: Enabled
Traffic	NEW - DFIR Report: Pyramid Command and Control This detection rule monitors for network traffic to IP addresses associated with Pyramid C2 endpoints. Default state: Enabled
Traffic	NEW - DFIR Report: RemcosRAT Command and Control This detection rule monitors for network traffic to IP addresses associated with RemcosRAT C2 endpoints. Default state: Enabled
Traffic	NEW - DFIR Report: SecTopRat Command and Control This detection rule monitors for network traffic to IP addresses associated with SecTopRat C2 endpoints. Default state: Enabled
Cisco ASA	UPDATE - Cisco ASA: ArcaneDoor IOC IP Addresses This detection rule has been deprecated due to age. The data is no longer accurate or relevant.
Duo	UPDATE - DUO: High Number of MFA Requests We updated the detection logic to account for stacking of similar logs, which was causing false positive findings.
Linux	UPDATE - Linux: User Added to Privileged Group We reviewed and updated the detection logic to reduce false positives and improve overall accuracy.
Microsoft 365	UPDATE - Microsoft 365 Alert Policy: Creation of Forwarding/Redirect Rule We updated the analysis to account for Microsoft Purview UI changes.
Traffic	UPDATE - DFIR Report: Qbot Tier 1 Endpoint Command and Control This detection rule has been deprecated due to age. The list is no longer being maintained by the DFIR Report team.
Traffic	UPDATE - Multiple Public IP Connection Detections We updated the following detections to exclude activity from safe external CGNAT IP addresses: - SSH Connection from Public IP - SMB Connection from Public IP - RDP Connection from Public IP - FTP Connection from Public IP - Telnet Connection from Public IP
VMware vCenter	UPDATE - VMware: VM Deletion We tuned the detection to exclude false positives generated from querying a VMware database.
Windows (Agent and NXLog)	UPDATE - Clearing of Windows Event Log We tuned the detection to account for Microsoft Exchange server logs that were causing false positives.
Windows (Agent and NXLog)	UPDATE - Suspicious Process Parents dllhost.exe/taskhost.exe We updated the detection to reduce false positives from similar log events and to handle instances where the username is not reported.
Windows	UPDATE - Disabling of Windows Firewall We updated the detection logic to account for changes in Microsoft logging. This update addresses true positive misses.

Log Type	Details
Azure Active Directory	NEW - Entra ID: User Access Administrator Role Granted at Root Scope This detection rule monitors for when the User Access Administrator role is granted at the root scope. This is a privileged role that has administrative control over Azure and Entra environments. Default state: Enabled
Google Workspace	NEW - Google Workspace: Login from Outside of Canada This detection rule triggers when a user logs in to Google Workspace from an IP address located outside of Canada. Default state: Disabled
Microsoft 365	NEW - Microsoft 365: Authentication Outside of Australia This detection rule identifies authentication attempts to Microsoft 365 from IP addresses outside of Australia. Default state: Disabled
Windows	NEW - Suspicious Double Extension Shortcut (.LNK) File This detection rule monitors for the creation of files using a suspicious Windows shortcut extension that ends in .LNK. Threat actors often use this technique to disguise malicious payloads as harmless files in download attacks. Default state: Enabled
Windows	NEW - Suspicious Execution of qwinsta.EXE This detection rule triggers when the qwinsta.exe command is executed in a suspicious context. Although it is a legitimate Windows command, it is frequently used by threat actors during the discovery phase of an attack. Default state: Enabled
Windows	NEW - Suspicious Double Extension File Execution This detection rule identifies the process execution of files with names containing multiple extensions (e.g., report.pdf.exe). This tactic is commonly used by attackers to disguise malicious files appearing as legitimate ones. Default state: Enabled
All Traffic Logs	UPDATE - 500GB+ Outbound Connection via Generic Network Protocol We improved the accuracy of data transfer size calculations, reducing false positive matches.
Carbon Black	UPDATE - Carbon Black: Malicious HTA File We improved the logic of this rule to reduce false positive matches.
Fortigate	UPDATE - Fortigate: Failed Admin Login from External IP Address We fixed broken URL links in the detection workflow to ensure responders can access support documentation directly from the finding.
Google Workspace	UPDATE - Google Workspace: Login from Outside of Canada and Google Workspace: Login from Outside the U.S. We updated the detection logic to handle cases where the country value is null, improving detection accuracy.
Microsoft 365	UPDATE - Microsoft 365: Email Sending Limit Exceeded This detection will no longer generate a finding when an update is made to resolved incidents in Microsoft 365.
Microsoft 365	UPDATE - Microsoft 365: New MFA Device Added We updated the workflow to improve clarity and to better guide responders based on the context provided in the finding.
Microsoft 365	UPDATE - Microsoft 365: Suspicious Inbox Rule Creation We updated the workflow to allow responders to jump directly to "Confirmed Compromise" for faster resolution and initiation of incident response for confirmed compromises.
Microsoft 365	UPDATE - Indicator: Microsoft 365 - User requested to release a quarantined message We updated the above original detection rule’s title so that is now “Microsoft 365: User Requested to Release a Quarantined Message,” and we updated the logic to account for Microsoft formatting changes that were causing the user field to be empty.
Microsoft Defender	UPDATE - Microsoft Defender for Endpoint: Suspicious PowerShell Command We updated the detection logic to account for recent changes in Microsoft log formats, which had been causing missed true positive matches.
SonicWall	UPDATE - SonicWall: 5 or More Login Failures in 15 Minutes We fixed a malformed placeholder in the analysis section that was preventing geographic location data from displaying correctly.
Windows	UPDATE - Suspicious Local Scheduled Task Created We added the parent.cmdline field to provide more context during review and investigation.
Windows	UPDATE - PowerShell: Download Invocation We added the parent.cmdline field to provide more context during review and investigation.
Windows	UPDATE - Rclone Execution via Command Line or PowerShell We improved the detection logic to better identify true positive events.
Windows	UPDATE - File Launched via rundll OpenURL Function We updated the detection logic that was previously causing false positive findings for legitimate Lenovo software.
Windows	UPDATE - UACMe Akagi Execution We updated the detection logic to avoid persistent false positive flags where akagi was seen in the file path.

ISO 27002 Controls	Blumira’s Global Reports
5 Organizational Controls: System Changes– Record critical configuration and policy changes	ISO 27002 Windows GPO Updates ISO 27002 Firewall Configuration Change Available for: Windows, Fortigate, Palo Alto, Sophos XG, Cisco ASA, Sonicwall
5 IDS/IPS Alerts – Identify potential intrusion attempts and malware	ISO 27001 IDS/IPS Alerts Available for: Fortigate, Umbrella, Checkpoint, PaloAlto, Sonicwall, Sophos XG
5.15 Access Control: Failed Logins – Identify brute force and other credential attacks	ISO 27002 Controls - Failed Logins Available for: Windows, Linux, MacOS
5.15 Access Control: Password Resets – Track password changes for awareness of compromised accounts	ISO 27002 - Password Change Available for: Windows ISO 27002 - Azure Password Change Available for: Azure
5.16 Identity Management: Logins by Location – Spot access from unfamiliar regions	ISO 27002 Logins from Outside US ISO 27002 Logins from Outside UK ISO 27002 Logins from Outside CA ISO 27002 Logins from Outside AUS Available for: Azure, Microsoft 365, Duo, Okta
5.16 Identity Management: VPN Connections – Monitor remote access methods and users	ISO 27002 VPN Connections Available for: Fortigate, Cisco ASA, WatchGuard, GlobalProtect, SonicWall, Sophos
5.18 Access Rights: USB Device Usage – Detect unauthorized devices plugged into endpoints	ISO 27002 - USB Device Attached Available for: Windows ISO 27002 Controls - Mounted Device ISO 27002 Controls - USB Device Attached Available for: MacOS
5.18 Access Rights: Account Lockouts – Find accounts locked due to excessive failed logins	ISO 27002 Account Lockouts
8.2 Privileged Access – Track access by administrators and power users	ISO 27002 Controls - Administrator Access Available for: Windows ISO 27002 Controls - Admin/root Access Available for: Linux
8.15 Logging: Log Tampering – Detect modifications or deletions of log data	ISO 27002 Controls Log Tampering - Clearing of Windows Event Log ISO 27002 Controls Log Tampering - Clearing of Windows Security Event Log Available for: Windows
8.20 Network Controls: Firewall Traffic – Analyze allowed/blocked connections at perimeter	ISO 27002 - Allowed Firewall Traffic ISO 27002 - Blocked Firewall Traffic

FERPA Requirements	Blumira’s Global Reports
FERPA 99.31(a)(1)(ii) – Failed Logins: Identify brute force and other credential attacks	FERPA Controls - Failed Logins Available for: Windows, Linux, MacOS
FERPA 99.31(a)(1)(ii) – Privileged Access: Track access by administrators and power users	FERPA Controls - Administrator Access Available for: Windows FERPA Controls - Admin/root Access Available for: Linux
FERPA 99.31(a)(1)(ii) – Log Tampering: Detect modifications or deletions of log data	FERPA Controls Log Tampering - Clearing of Windows Event Log FERPA Controls Log Tampering - Clearing of Windows Security Event Log Available for: Windows
FERPA 99.31(a)(1)(ii) – VPN Connections: Monitor remote access methods and users	FERPA Controls - VPN Connections Available for: Fortigate, Cisco ASA, WatchGuard, GlobalProtect, SonicWall, Sophos
FERPA 99.31(a)(1)(iv)(B) – Firewall Traffic: Analyze allowed/blocked connections at perimeter	FERPA - Allowed Firewall Traffic FERPA - Blocked Firewall Traffic
FERPA 99.31(a)(1)(ii) – IDS/IPS Alerts: Identify potential intrusion attempts and malware	FERPA - IDS/IPS Alerts Available for: Fortigate, Sonicwall, PaloAlto, Checkpoint, Sophos XG, Umbrella
FERPA 99.31(a)(1)(ii) – USB Device Usage: Detect unauthorized devices plugged into endpoints	FERPA - USB Device Attached Available for: Windows FERPA Controls - Mounted Device FERPA Controls - USB Device Attached Available for: MacOS
FERPA 99.31(a)(1)(ii) – Account Lockouts: Find accounts locked due to excessive failed logins	FERPA - Account Lockouts Available for: Windows
FERPA 99.31(a)(1)(ii) – Password Resets: Track password changes for awareness of compromised accounts	FERPA - Password Change Available for: Windows FERPA - Azure Password Change Available for: Azure
FERPA 99.31(a)(1)(ii) – Logins by Location: Spot access from unfamiliar regions	FERPA - Logins from Outside the US FERPA - Logins from Outside the UK FERPA - Logins from Outside the AUS FERPA - Logins from Outside the CA Available for: Azure, Microsoft 365, Duo Security, Okta
FERPA 99.31(a)(1)(ii) – System Changes: Record critical configuration and policy changes	FERPA - Windows GPO Updates Available for: Windows FERPA - Azure Policy Changes Available for: Azure FERPA Firewall Configuration Change Available for: Fortigate, Cisco ASA, SonicWall, Sophos XG

FINRA Rules	Blumira’s Global Reports
FINRA 4511 – Log Tampering: Detect modifications or deletions of log data	FINRA Controls Log Tampering - Clearing of Windows Event Log FINRA Controls Log Tampering - Clearing of Windows Security Event Log Available for: Windows
FINRA 4512 – Privileged Access: Track access by administrators and power users	FINRA Controls - Administrator Access Available for: Windows FINRA Controls - Admin/root Access Available for: Linux
FINRA 4512 – VPN Connections: Monitor remote access methods and users	FINRA Controls - VPN Connections Available for: Fortigate, Cisco ASA, WatchGuard, GlobalProtect, SonicWall, Sophos
FINRA 4512 – VPN Connections: Monitor remote access methods and users	FINRA Controls - VPN Connections Available for: Fortigate, Cisco ASA, WatchGuard, GlobalProtect, SonicWall, Sophos
FINRA 4512 – Password Resets: Track password changes for awareness of compromised accounts	FINRA - Password Change Available for: Windows FINRA - Azure Password Change Available for: Azure
FINRA 4512 – System Changes: Record critical configuration and policy changes	FINRA - Windows GPO Updates Available for: Windows FINRA - Azure Policy Changes Available for: Azure FINRA Firewall Configuration Change Available for: Fortigate, CiscoASA, SonicWall, SophosXG
FINRA 4513 – Failed Logins: Identify brute force and other credential attacks	FINRA Controls - Failed Logins Available for: Windows, Linux
FINRA 4513 – Logins by Location: Spot access from unfamiliar regions	FINRA - Logins from Outside the U.S. FINRA - Logins from Outside the U.K. FINRA - Logins from Outside the AUS FINRA - Logins from Outside the CA Available for: Azure, Microsoft 365, Duo Security, Okta
FINRA 4514 – USB Device Usage: Detect unauthorized devices plugged into endpoints	FINRA - USB Device Attached Available for: Windows FINRA Controls - Mounted Device FINRA Controls - USB Device Attached Available for: macOS
FINRA 4514 – Firewall Traffic: Analyze allowed/blocked connections at perimeter	FINRA - Allowed Firewall Traffic FINRA - Blocked Firewall Traffic
FINRA 4517 – IDS/IPS Alerts: Identify potential intrusion attempts and malware	FINRA - IDS/IPS Alerts Available for: SonicWall, PaloAlto, Checkpoint, Sophos XG, Umbrella

CMMC Requirements	Blumira’s Global Reports
CMMC AC.1 – Failed Logins: Identify brute force and other credential attacks	CMMC Controls - Failed Logins Available for: Windows, Linux, MacOS
CMMC AC.1 – VPN Connections: Monitor remote access methods and users	CMMC Controls - VPN Connections Available for: Cisco ASA, WatchGuard, GlobalProtect, SonicWall, Sophos
CMMC AC.1 – Logins by Location: Spot access from unfamiliar regions	CMMC - Logins from Outside the US CMMC - Logins from Outside the UK CMMC - Logins from Outside the AUS CMMC - Logins from Outside the CA Available for: Azure, Microsoft 365, Duo Security, Okta
CMMC AU.2 – Privileged Access: Track access by administrators and power users	CMMC Controls - Administrator Access Available for: Windows, Linux
CMMC AU.6 – Log Tampering: Detect modifications or deletions of log data	CMMC Controls Log Tampering - Clearing of Windows Event Log CMMC Controls Log Tampering - Clearing of Windows Security Event Log Available for: Windows
CMMC AC.7 – Account Lockouts: Find accounts locked due to excessive failed logins	CMMC - Account Lockouts Available for: Windows
CMMC AC.7 – Password Resets: Track password changes for awareness of compromised accounts	CMMC - Password Change Available for: Windows CMMC - Azure Password Change Available for: Azure
CMMC SC.7 – Firewall Traffic: Analyze allowed/blocked connections at perimeter	CMMC - Allowed Firewall Traffic CMMC - Blocked Firewall Traffic
CMMC IR.4 – IDS/IPS Alerts: Identify potential intrusion attempts and malware	CMMC - IDS/IPS Alerts Available for: SonicWall, Palo Alto, Checkpoint, Sophos XG, Umbrella
CMMC MP.7 – USB Device Usage: Detect unauthorized devices plugged into endpoints	CMMC - USB Device Attached Available for: Windows CMMC Controls - Mounted Device CMMC Controls - USB Device Attached Available for: MacOS
CMMC CM.3 – System Changes: Record critical configuration and policy changes	CMMC - Windows GPO Updates Available for: Windows CMMC - Azure Policy Changes Available for: Azure CMMC Firewall Configuration Change Available for: Palo Alto, Fortigate, Cisco ASA, SonicWall, Sophos XG

Log Type	Detection Rule Name	Details
Windows	NEW - Disabled Account Attempted Login	This detection rule monitors for failed Windows logins due to the targeted account being disabled. This may be related to legitimate activity, but is unusual in most environments and could be evidence of unauthorized access attempts. Additionally, multiple failed login attempts for the built-in "Guest" account should be considered suspicious, as this account is disabled by default in modern Windows systems and is commonly targeted by attackers during reconnaissance activities. Vulnerability scanners (such as Qualys or Nessus) may also generate findings. Default state: Disabled
Windows	Injected Explorer Discovery Commands	This rule was being triggered for legitimate administrative activity, so the logic has been improved. After reviewing data across our customer base, we reclassified it from a P2 Threat to a P3 Suspect. Automatic Host Isolation has been removed from this detection.
Windows or Blumira Agent for Windows	NEW - Potential Exploitation of Cleo CVE-2024-55956 - Autorun File Artifacts	This detection rule is triggered when file artifacts are detected matching those seen in active attacks related to Cleo CVE-2024-55956. For more information, see Vulnerabilities in Cleo Software Allow for Unauthenticated Remote Code Execution via CVE-2024-55956. Default state: Enabled
MS365 AD/Entra	NEW - Microsoft 365: New MFA Device Added	This detection rule is triggered when at least one user registers an additional MFA method. This may be part of a natural onboarding or account reset procedure. Malicious actors have been known to add their own MFA devices under their control in order to maintain access to an account and respond to MFA prompts without user interaction. Default state: Enabled
Blumira Agent	Suspicious Process Parent	This new P2 Threat detection triggers when one or more user accounts have failed AAA authentication at an excessive rate (5+ failed logins within an hour), which could indicate a brute force attack where word lists are used to guess username/password combinations.
Azure Entra	Azure: Entra ID Global Admin Role Assignment**	Updated to account for newer MS-PIM strings in the office365_aad log type to reduce false positive rates.
Google Workspace	Google Workspace: Impossible Travel**	This detection was updated to include more fields for detection filters.
Google Workspace	Google Workspace: Potential Clear-Text Password**	Updated to reduce its severity from a Threat to a P3 Risk to more accurately reflect its level of severity.
CrowdStrike	All CrowdStrike Detections and Workflows	Updated to utilize the new fields made available from the parser change in response to adoption of the GoFalcon SDK 9.0 release.

Log Type	Detection Details
Windows or Blumira Agent for Windows	NEW - Midnight Blizzard Suspicious RDP File Created A detection to find those sneaky Midnight Blizzard IoCs! If you hadn't heard, there have been active campaigns from the Russian threat actor group "Midnight Blizzard" who have been sending targeted phishing campaigns with .rdp files that would expose sensitive information by mapping local resources to a remote server. Default state: Enabled
Azure Authentication	NEW - Azure: Potential Token Theft via Entra Device Code Flow This detects when a Microsoft 365 request has been made to retrieve a primary refresh token through a device code flow via the device registration service within Azure. This can be done as a normal part of joining a machine to Entra ID. However, research has shown that this device registration service can be abused, for example, through phishing attempts to gain and maintain access to a user's account. Default state: Enabled
MS365 Sharepoint	NEW - MS365 Sharepoint: 500 or More File Deletions in 15 Minutes This detects when 500+ file deletion events in a timeframe of 15 minutes have been observed in a specific Sharepoint site. It provides information on the total number of file deletions that were observed in Sharepoint by a specific user. We provide a finding on any anomalous user behavior that you may want to investigate further. Default state: Disabled
Windows	NEW - High Number of Windows Group Enumeration Events This detection notifies you when a high number of Windows group enumeration events have been identified in your environment. This could be related to legitimate administrative or automated service activity. However, we recommend that you still review and confirm the behavior is expected by the responsible accounts. Threat actors may conduct similar reconnaissance, or discovery, when initially landing in an environment with a goal of understanding their permissions and to identify other, more highly privileged accounts. The current default threshold is 100 or more events within a 15 minute window. Default state: Enabled
All firewall types	SMB Connection from Public IP We updated this detection’s behavior so that it does not automatically block threats as part of our dynamic blocklist feature. Users will need to manually block IPs detected as threats in these findings. We also updated the logic to exclude Netscaler, which was producing false positive matches.
CrowdStrike	CrowdStrike Detections v2 We made temporary updates to CrowdStrike detections to improve the workflow and analysis. The intermediary SDK released by CrowdStrike didn’t provide the most useful information in the logs. V3 updates will come after additional parsing changes are rolled out with this new SDK.
Duo Auth	Duo: High Number of MFA Requests A low number of MFA requests used to trigger this detection due to a parsing issue. This detection has been updated to be more accurate in counts.
Office/Azure Active Directory Audit	Azure: Entra ID Global Admin Role Assignment & Azure: Entra ID Global Admin Role Assignment by PIM/GDAP Both detections were updated to be more accurate and reduce false positives.
Office/Azure Active Directory Audit	Azure AD: Anomalous Agent Sign-In Activity This detection has been updated to reduce the false positive rate.
Office/Azure Active Directory Audit	Microsoft 365: MFA Device Registered Without Device Details This detection will be replaced with several new MFA detections
All firewall types	Internal Reconnaissance - All Connections Updated to be more accurate and reduce false positives.

Log Type	Detection Details
Audit	When a new Restricted Management Administrative Unit has been created in your environment. While Administrative Units can be created legitimately by administrators, threat actors could leverage Restricted Management Administrative Units to help set up backdoor access to an Entra directory. Default state: Enabled
Fortigate Event	NEW - FortiGate: FortiManager CVE-2024-47575 Missing authentication in fgfmsd This CVE has been assigned a CVSSv3 score of 9.8 (Critical) as it can allow a remote unauthenticated attacker the ability to execute arbitrary code or commands via specially crafted requests. The log entry IOCs being monitored for are `msg="Unregistered device localhost add succeeded"` `changes="Edited device settings (SN FMG-VMTM23017412)` Default state: Enabled
Blumira Agent, Windows	NEW - Driver Integrity Checks Disabled via bcdedit These commands will allow unsigned drivers to run on a host. Administrators may use these commands legitimately to troubleshoot driver compatibility conflicts or for driver development and testing, however this is uncommon. Threat actors have been observed abusing these commands in order to run unsigned and malicious or vulnerable drivers. Default state: Enabled
GCP Cloud Audit	NEW - Google Cloud Platform: Potential Cross Project Image Exfiltration When a compute image has been copied into a destination project from a different source project within your Google Cloud Platform tenant. These events can be cause by legitimate activity. It is possible that this could be the first in a chain of events that can allow a sensitive compute image to be exfiltrated outside of your Google Cloud Platform tenant. This initial step could be an attempt to avoid suspicion by copying the image to a more permissive or less observed project before performing a copy to an external storage solution or cloud-based bucket. Default state: Enabled
Blumira Agent, Windows	NEW - Suspicious Execution of Windows 'cipher' Command This tool may be used legitimately to display or alter the encryption of directories and files on NTFS volumes. Threat actors have been observed abusing this tool as a precursor to ransomware deployment. This detection specifically looks for cipher being run with the `/w` parameter against a specific drive (ex.`cipher /w:\\?\C:`) - a malicious tactic observed in the wild. Default state: Enabled
All Traffic Logs	50GB+ Outbound Connection via Generic Network Protocol This has been reworked to reduce false positives and more accurately judge network transfer sizes.
All Traffic Logs	50GB+ Outbound Connection via Generic Network Protocol This has been reworked to reduce false positives and more accurately judge network transfer sizes.
ASA System	ASA WebVPN Anomalous Access Attempts Existing logic had a bug where obscured usernames failed to generate findings. Updated logic accounts for this. Analysis updated and workflow reworked. Global Reports created for responders.
Blumira Agent, Windows	Suspicious SPN Enumeration Updating title from "Suspicious SPN Enumeration" to "Suspicious SPN Enumeration via Setspn" to specify Suspicious SPN Enumeration by the setspn tool.
Windows	Potential Credential Access via DCSync This detection was broken and will be repaired in this release. While it is default disabled, some customers with it enabled may start receiving Findings in response to the repair.
Windows	Null Session Activity - Large Amount of Total Authentications (windowed) Null Session Authentication by known Attack Tool (windowed) Null Session Activity (windowed) Null Session detections had minor changes to analysis phrasing.
All Traffic Logs	RDP Connection from Public IP This is now a real-time detection.
Azure Signin	Azure Identity Protection Risky Sign-in All and High We have updated the analysis and fields to include the creation_time to give responders more context when investigating.

Log Type	Detection Details
All traffic data types	NEW - DFIR Report: AsyncRAT Command and Control This command and control traffic is likely related to AsyncRAT infrastructure. AsyncRAT is a remote access trojan. For more information about AsyncRAT, see the GitHub repository. Default state: Enabled
All traffic data types	NEW - DFIR Report: DcRAT Command and Control This command and control traffic is likely related to DcRAT infrastructure. DcRAT is a remote access trojan known for initial access operations. For more information about DcRAT, see the GitHub repository or this post from Blackberry. Default state: Enabled
All traffic data types	NEW - DFIR Report: Havoc Command and Control This command and control traffic is likely related to Havoc infrastructure. Havoc is a command and control framework. For more information about Havoc, see the GitHub repository. Default state: Enabled
All traffic data types	NEW - DFIR Report: More_eggs Command and Control This command and control traffic is likely related to More_eggs infrastructure. More_eggs is a JavaScript backdoor trojan. For more information about More_eggs, see this post from MITRE. Default state: Enabled
All traffic data types	NEW - DFIR Report: Pupy Command and Control This command and control traffic is likely related to Pupy infrastructure. Pupy is a free and open-source remote access tool and post-exploitation framework. For more information about Pupy, see the GitHub repository or this post from AHN Labs. Default state: Enabled
All traffic data types	NEW - DFIR Report: Viper Command and Control This command and control traffic is likely related to Viper infrastructure. Viper is a free and open-source modular offensive security multi-tool, similar to Metasploit, that can be used across stages in intrusions including command and control, discovery, lateral movement, and impact. For more information about DcRAT, see the GitHub repository. Default state: Enabled
Azure AD	NEW - Azure: SQL Firewall Rule Created Because it's nice to know when your Azure tenant may be opening SQL up! Default state: Disabled; must be enabled by an administrator
Azure AD	NEW - Azure: SQL Firewall Rule Deleted Probably not as risky of a detection as “Firewall Rule Created,” but it's nice to have parity. 😉 Default state: Disabled; must be enabled by an administrator
GCP Cloud Audit	NEW - Google Cloud Platform: API Key Generated A user has created or requested the creation of an API key within your Google Cloud Platform (GCP) tenant. This can be part of the normal admin or operational lifecycle within GCP. Threat actors have been increasingly observed using API keys to maintain persistence within cloud environments. Default state: Enabled
GCP Cloud Audit	NEW - Google Cloud Platform: Secret Created in Secret Manager A user in your Google Cloud Platform tenant has created or requested to create a new secret. Default state: Disabled; must be enabled by an administrator
MS365 AD	NEW - Microsoft 365: SsoArtifactRevoked Failed Login Detects when a user has failed to log in to Microsoft 365 services and the resultant error indicates the session was denied due to a bad password (either expired or recently changed). These events can also be related to conditional access policies denying a login. We have seen evidence of this activity in Business Email Compromise during our research. Default state: Disabled; must be enabled by an administrator
Windows or Blumira Agent	NEW - ESX Admin Group Creation or Modification A domain group named "ESX Admins" has been created or modified in Active Directory. This detection identifies the following activities: Domain group created and titled "ESX Admins" Renaming an existing domain group to "ESX Admins" Adding users to the "ESX Admins" group While this may be legitimate administrative activity, it should still be accounted for. Threat actors have been observed taking advantage of a vulnerability using these groups via CVE-2024-37085. Default state: Enabled
Windows or Blumira Agent	NEW - Suspicious Windows Defender Registry Key Tampering via Reg.exe Administrators and administrative software may modify Windows Defender registry keys while installing antivirus. Threat actors may tamper with Windows Defender registry keys to attempt to disable protection and detection features during adversarial activity and malware deployment. For more information, see Buzzing on Christmas Eve: Trigona Ransomware in 3 Hours. Default state: Enabled
Windows, Blumira Agent for Windows, Blumira Agent for Linux, Blumira Agent for Mac	NEW - Network Tunneling Tool: Chisel Chisel is a free and open source network tunneling tool that can be used to establish tunnels for various protocols over HTTP for legitimate business uses like enabling remote access. These tools can also be used to bypass network security controls, obscure malicious activities, or exfiltrate sensitive data if used by threat actors who have gained unauthorized access to a system or network. To learn more, see the following resources: Chisel by JPillora #StopRansomware: Blacksuit(Royal) Ransomware Default state: Enabled

Log Type	Detection Details
Azure AD Audit (Entra)	NEW - Azure: Service Principal Creation By Service Principal This new detection rule alerts when a Service Principal in Entra creates another Service Principal. Some Azure services and products can perform this as part of a managed service. Threat actors have been observed using this technique to gain persistence growing their foothold in Azure environments.
Microsoft 365 Azure AD (Entra)	NEW: Microsoft 365: Impossible Travel AAD Login - 500 to 999 miles Microsoft 365: Impossible Travel AAD Login - 1,000 to 2,000 These new detection rules, which are disabled by default, are similar to the “Microsoft 365: Impossible Travel AAD Login - 2,001 miles and higher” rule. When enabled, these trigger an alert when successful logins are detected between 500 to 999 miles apart within a 2-hour window or between 1,000 to 2,000 miles apart within a 4-hour window. 2,001 miles and higher still has a 6-hour window. Note: Windowed detection rules are only available in paid Blumira editions.
Google Workspace	NEW - Google Workspace: 100 or More Drive Deletions in 15 Minutes This new P3 Risk detection rule triggers when a single user’s deletion activity within Google Drive exceeds 100 files within a 15-minute window.
Google Workspace	Google Workspace: Suspicious Login Allowed We renamed the “Google Workspace: Suspicious Login” detection rule to “Google Workspace: Suspicious Login Allowed” to clarify that it alerts on allowed activity that meets the suspicious behavior described here. This rule is now deployed in a default-disabled state, so administrators of newly integrated accounts can choose to enable it.
JumpCloud	NEW - JumpCloud: User Created When enabled, this new P3 Operational detection rule alerts when JumpCloud users are created. It is disabled by default.
JumpCloud	NEW - JumpCloud: User Deleted When enabled, this new P3 Operational detection rule alerts when JumpCloud users are deleted. It is disabled by default.
Multi-source	Reconnaissance via Net Commands Findings for this detection now include the `parent.cmdline` field in matched evidence when it exists in the log data.
Multi-source	Remote Access Tool: LogMeIn This detection rule now includes logic to detect when the LogMeIn Rescue executable `LMI_Rescue.exe` is run.

Log Type	Detection Details
SonicWall Traffic	SonicWall: Login Failure We deprecated this original indicator detection rule and replaced it with the windowed detection rule described below. This original rule was generating findings with excessive numbers (many thousands) of rows of evidence, which led to crashes and prevented finding resolution in the app.
SonicWall Traffic	NEW - SonicWall: 5 or More Login Failures in 15 Minutes This new windowed detection rule replaces the “SonicWall: Login Failure” rule. It triggers a finding when there are five or more login attempts that fail on a device within a 15-minute window.
HTTP Access (Apache/IIS/NginX)	ConnectWise ScreenConnect SetupWizard Authentication Bypass CVE-2024-1709 We lowered the priority of this detection from a P1 to a P3 Threat.

Log Type	Detection Details
Azure Entra Directory Audit	NEW - Azure: Privileged Graph API Role Assignment This new detection alerts on the assignment of specific Graph API roles. These roles can be used for standard administrative activity, but they can also be leveraged by attackers to exfiltrate data, modify users, and make other admin-level alterations to your Entra directory.
Blumira Agent and Windows	NEW - Decimal Character Encoded Command This new detection rule alerts on the use of decimal character encoded commands in CMD prompt or PowerShell, a tactic that is used by threat actors to obfuscate their commands and evade detection. Some administrators may also intentionally use this functionality, but it is extremely uncommon. For more information see How to decode a decimal encoded command.
Blumira Agent and Windows	NEW - Registry Value Tampering: RestrictedAdmin Mode Enabled This detection rule is disabled by default. RestrictedAdmin mode is disabled by default on most systems. Threat actors have been observed enabling RestrictedAdmin mode to bypass RDP MFA controls or steal and reuse credential hashes. However, some administrators may choose to enable RestrictedAdmin mode as a part of their security controls. All changes to RestrictedAdmin mode should be authorized in advance and, therefore, expected. Investigate any unauthorized, unexpected changes. For more information, see our blog post Why are Threat Actors enabling Windows Restricted Admin mode?
Blumira Agent and Windows	NEW - VSSAdmin Shadow Copy Deletion Command This new detection rule triggers when a device logs that a command was run to delete shadow copies. While this command may have been legitimately issued by an administrator, it should be investigated and verified to have been run intentionally by an approved user or application. Monitor shadow copy deletion commands to identify unauthorized or malicious activity by threat actors, who have been observed deleting shadow copies after data exfiltration to inhibit the recovery of encrypted systems and/or data.
Duo Admin	NEW - Duo: Bypass Code Created This default-disabled detection alerts when a user creates a bypass code, which can legitimately be due to not having the MFA device after losing or replacing it. Or it could be a bad actor attempting to bypass MFA requirements or creating an additional authentication option under their control.
Google Workspace	NEW - Google Workspace: Custom Admin Role Created This new detection rule triggers when a custom administrator role is created in Google Workspace. Users may create these roles for legitimate reasons, as organizations may prefer to limit the scope of certain default roles or avoid their use entirely. Threat Actors may leverage custom admin roles to maintain persistence in an environment and attempt to avoid detection.
Meraki System Events	NEW - Cisco Meraki: System Failover Event This default-disabled detection alerts when a device logs a Cisco Meraki failover event. If failovers are happening frequently, it may indicate a persistent issue that needs to be addressed. For more information about Meraki failover events, see Meraki’s Routed HA Failover Behavior.
Microsoft365 Azure AD	NEW - Microsoft 365: MFA Device Registered Without Device Details This new detection alerts when a new device has been registered for at least one of your users in Microsoft 365 and doesn't contain any device details. This could be normal activity like a user adding an alternate authenticator app that isn’t using the Microsoft Authenticator, such as Duo Security, 1Password, etc. It could instead be a Threat Actor attempting to add an MFA option that they control, in order to satisfy MFA requirements in Microsoft 365 environments.
SonicWall Traffic	NEW - SonicWall: Configuration Change This new default-disabled detection rule alerts when a SonicWall device logs a configuration change.
Azure AD	Azure AD: Anomalous Agent Sign-In Activity We updated the logic of this detection rule to remove blocked sign-ins from results, because they are not actionable.
Microsoft 365	Microsoft 365: Suspicious Inbox Rule Creation We adjusted the window of time in which new matches for this rule are stacked together so that events occurring within one hour stack together in the same finding. This change may help to separate unrelated events that occur over time, which was happening in the previously-set four-hour cooldown window.
Microsoft 365	Microsoft 365 Alert Policy: Creation of forwarding/redirect rule We updated the guidance in these findings to match changes in Microsoft so that users can easily navigate to and review the right areas of their Security and Compliance centers.
Microsoft 365	Modification of Microsoft 365 Group We added group information to the evidence for these findings to improve the data available for investigation. Group details can be found in the `info` field.
Microsoft Defender ATP	Microsoft Defender for Endpoint: Suspicious Service Launch We updated the entire analysis and playbook’s guidance to provide a better investigation experience for Responders who work these findings.
Microsoft Windows	Startup Folder LNK File We added `user` and `devname` to the finding’s analysis so users can quickly see in their alerts which user and device the activity relates to.
Multi-Source	Telnet Connection from Public IP We added these additional fields to the evidence in findings triggered by this detection rule: `process_name` `command` `parent.cmdline` `parent_process_name`

Log Type	Detection Rule Name	Details
Blumira Agent macOS Endpoint Logs	NEW - macOS: Suspicious Plutil Activity	This new P3 detection rule alerts when the plutil utility runs on a Mac device. Threat actors have been observed leveraging plutil to modify .plist files in an attempt to modify application behavior, redirect to malicious applications, and evade defensive measures.
Google Workspace	NEW - Google Workspace: Domain Data Export Initiated	This new P2 detection rule alerts when a user initiates a domain data export, which can be a normal business operation to migrate to another Workspace tenant or cloud service, but some threat actors also use this method to exfiltrate data.
Microsoft365 Azure AD	NEW - Microsoft 365: Hidden Privileged Role Assignment	This new P2 detection rule alerts when a user assigns another user to one of the following privileged roles in Entra or Microsoft 365: Directory Synchronization Accounts Partner Tier 1 Support Partner Tier 2 Support These very powerful and purposefully hard-to-find roles are not typically used; even Microsoft suggests not using these roles, which makes this assignment highly suspicious.
Mimecast	NEW - Mimecast: User Released a Phishing Message from Quarantine	This new P3 detection rule alerts when a user successfully releases a message categorized as phishing from Mimecast.
Multi-Source	NEW - JavaScript Executed From Unusual Directory	This new P2 detection rule alerts when a user executes a JavaScript file from an unusual location, such as User or Public User directory folders (Downloads, Desktop, etc.). Some threat actors, such as SocGholish, use this method to establish command and control access.
Multi-Source	NEW - Remote Access Tool: RustDesk	This new P3 detection rule alerts when a RustDesk process is observed on a device. RustDesk is a free and open source remote access tool used to remotely manage and support endpoints, but it has also been used by threat actors to establish remote connections to victim endpoints.
Azure Signin	Azure AD: Anomalous Agent Sign-In Activity	This existing detection’s evidence now includes `action_details` and `access_granted` to help users investigate the activity.
Microsoft365 Azure AD	Microsoft 365: Impossible Travel AAD Login	This existing detection’s evidence now includes agent information to help users investigate the activity.
SonicWall Traffic	SonicWall: Login Failure	This existing detection’s analysis and evidence now include additional details to help users investigate the activity.

CIS Critical Security Controls	Blumira’s Global Reports
CIS Control 3 – System Changes: Record critical configuration and policy changes	CIS - Windows GPO Updates (Blumira) Available for: Windows CIS - Azure Policy Changes (ERW Inc) Available for: Azure CIS - Firewall Configuration Change Available for: Fortigate, CiscoASA, Sonic Wall, Sophos XG
CIS Control 4 – Privileged Access: Track access by administrators and power users	CIS Controls - Administrator Access (Windows) CIS Controls - Admin/root Access (Linux) Available for: Windows, Linux
CIS Control 4 – Logins by Location: Spot access from unfamiliar regions	CIS - Logins from Outside the US CIS - Logins from Outside the UK CIS - Logins from Outside the AUS CIS - Logins from Outside the CA Available for: Azure, Microsoft 365, Duo Security, Okta
CIS Control 5 – Failed Logins: Identify brute force and other credential attacks	CIS Controls - Failed Logins Available for: Windows, Linux, MacOS
CIS Control 5 – Account Lockouts: Find accounts locked due to excessive failed logins	CIS - Account Lockouts Available for: Windows
CIS Control 6 – Log Tampering: Detect modifications or deletions of log data	CIS Controls Log Tampering - Clearing of Windows Event Log CIS Controls Log Tampering - Clearing of Windows Security Event Log Available for: Windows
CIS Control 9 – Firewall Traffic: Analyze allowed/blocked connections at perimeter	CIS - Allowed Firewall Traffic CIS - Blocked Firewall Traffic
CIS Control 12 – VPN Connections: Monitor remote access methods and users	CIS Controls - VPN Connections Available for: Fortigate, Cisco ASA, WatchGuard, GlobalProtect, Sonic Wall, Sophos
CIS Control 16 – Password Resets: Track password changes for awareness of compromised accounts	CIS - Password Change Available for: Windows CIS - Azure Password Change Available for: Azure
CIS Control 18 – USB Device Usage: Detect unauthorized devices plugged into endpoints	CIS - USB Device Attached Available for: Windows CIS Controls - Mounted Device CIS Controls - USB Device Attached Available for: MacOS
CIS Control 19 – IDS/IPS Alerts: Identify potential intrusion attempts and malware	CIS – IDS/IPS Alerts Available for: Fortigate, Sonic Wall, Palo Alto, Checkpoint, Sophos XG

Log Type	Detection Rule Name	Details
HTTP Access (Apache/IIS/NginX)	NEW - ConnectWise ScreenConnect SetupWizard Authentication Bypass CVE-2024-1709	This new P1 detection rule alerts when a device makes a web request to `SetupWizard.aspx` with a trailing path. This activity may be related to potential exploitation of ConnectWise ScreenConnect CVE-2024-1709
Multi-Source	NEW - ConnectWise ScreenConnect Path Traversal Exploitation CVE-2024-1708	This new P1 detection rule alerts when a device shows activity related to potential exploitation of ConnectWise ScreenConnect CVE-2024-1708. It detects the creation of files with `.ASPX` or `.ASHX` extensions in the `Program Files (x86)\ScreenConnect\App_Extensions\` directory, which is unusual behavior that is not performed by ScreenConnect as part of normal operation.
Multi-Source	NEW - ConnectWise ScreenConnect SetupWizard User Database Modification CVE-2024-1709	This new P1 detection rule alerts when a device shows activity related to potential exploitation of ConnectWise ScreenConnect CVE-2024-1709.
Google GSuite	NEW - Google Workspace: Suspicious Login	This new P3 detection rule alerts when Google flags a suspicious login for a user.
Google GSuite	NEW - Google Workspace: Login from Outside the U.S.	This new default disabled detection rule alerts when a user has logged in to Google Workspace from outside of the U.S.
Google GSuite	NEW - Google Workspace: Impossible Travel Login	This new P2 detection rule alerts when one or more Google Workspace users exhibit behavior matching impossible travel activity, which means logins or access attempts from different geographic locations within an unrealistically short timeframe, indicating potential malicious activity.
Microsoft 365 Azure AD	NEW - Microsoft 365: Login Blocked due to Conditional Access Policy	This new operational detection rule triggers when a user attempts to log in but is blocked by a Conditional Access policy.
Microsoft 365 Azure AD	NEW - Microsoft 365: MFA Change of Method	This new default-disabled detection alerts when a user changes their MFA methods, with details in the `info` evidence field to show which methods the user selected.
Microsoft 365 Azure AD	NEW - Microsoft 365: Successful Login Using Commonly Targeted Account Name	This new default-disabled detection alerts when there is a successful login to a user account that is part of a "watchlist" of account types commonly targeted in password spraying and brute force attacks. That list includes shared, service, or test accounts, which are vulnerable to account takeover due to their shared or temporary status.
Multi-source	NEW - DFIR Report: SocGholish Command and Control	This new P2 detection rule alerts when there is traffic on your network to a known command and control server that is likely related to the SocGholish infrastructure.
Multi-source	NEW - Discovery via ADGet	This new P1 detection rule alerts when a process runs that is associated with ADGet, which is leveraged by threat actors to gather information about Active Directory users, computers, domains, and trusts. The tool exports Active Directory data to a Zip archive.
Multi-source	NEW - Execution of Cisco Jabber ProcessDump	This new P2 detection rule alerts when Cisco Jabber-bundled `ProcessDump.exe` is executed on a device. This utility could be abused by threat actors to dump the memory of any running process.
Multi-source	NEW - Invocation of Sudo for Windows	This new P3 detection rule alerts when a user is seen invoking Sudo for Windows on a device.
Multi-source	NEW - PUA: Restic Backup Activity	This new P3 detection rule alerts when a user is seen executing the application restic on a device. Although restic is used to make backups for legitimate purposes, it has also been leveraged by threat actors to exfiltrate data.
Multi-source	NEW - Remote Access Tool: NetSupport Manager	This new default-disabled rule monitors for NetSupport Manager being launched from suspicious locations.
Multi-source	NEW - Suspicious Invocation of Finger.exe	This new P2 detection alerts when `Finger.exe` has been launched on a device. Finger is now more often leveraged by threat actors to drop malware or exfiltrate data from a host than to be used for non-malicious activity.
Sophos XG	NEW - Sophos XG: Firewall Rule Configuration Change	This new default-disabled detection rule monitors for changes to Sophos XG firewall rules. A global report by the same name was released as well for auditing via a scheduled report.
Windows	NEW - Share Enumeration Write Access Check via SoftPerfect Network Scanner	This new P3 detection rule alerts when a signature matching SoftPerfect Network Scanner scanning activity is observed on a device.

Blumira Product Updates Timeline

Category

January 2026 Product Releases

Detection Updates

Bug Fixes and Improvements

December 2025 Release Notes

Your Cybersecurity Gameplan with Blumira

The Sales Process

Understanding Your Security Needs

What’s unique about Blumira?

Which team members should we bring to our initial discussions?

What information should my team bring to the table?

What's discussed in the initial call?

Implementation Process

Deploying and Rolling Out

What's the demo call like?

Can we try the platform first?

What's involved in the pilot phase?

What information should we provide to make the most of the pilot program?

Customer Success

Your Long-Term Partner

How soon do we finalize onboarding after we sign a contract?

How long does the onboarding process take?

What does long-term partnership look like?

December 2025 Product Releases

Detection Updates

Bug Fixes and Improvements

November 2025 Release Notes

Blumira at 2025 Fall Cyber Solutions Fest: Revolutionizing Security Ops!

November 2025 Product Releases

Feature and Platform Updates

Detection Updates

Bug Fixes and Improvements

October 2025 Release Notes

October 2025 Product Releases

Feature and Platform Updates

Detection Updates

Bug Fixes and Improvements

September 2025 Release Notes

AI Integration at Blumira: Looking Into the Future

Learning and Evolving

Development Challenges and Technical Insights

Development Challenges

Technical Decisions

Where do we go from here?

Join the Conversation

AI Integration at Blumira: How We Did It

A user-centric approach to AI

The Blumira Technical Foundation

Data Sources

Findings and evidence

Playbooks

Context enrichment

Integrating AI into Blumira

The Data Pipeline

Prompt Engineering and Management

Output Generation

Internally Tested and Validated

Slackbot makes real-world testing fast and simple

Quality assurance driven by experienced experts

Security and privacy are paramount

What we learned: Start simple, add complexity

The Human Side of AI: Why Blumira's Investigation Capabilities Put Partnership First

The Investigation Paralysis Crisis

Why AI Partnership, Not AI Automation

The Blumira Difference: Empowerment Over Automation

Building Trust Through Transparency

The Human Side of Security Intelligence

What Comes Next

Never Go It Alone—Even with AI

SOC Auto-Focus Cuts Investigation And Response Time Through AI-Powered Analysis

Introducing SOC Auto-Focus

How it Works

How Our Partners are Using SOC Auto-Focus

See SOC Auto-Focus in Action

VIDEO: Accelerate Security Decisions With SOC Auto-Focus

September 2025 Product Releases

Feature and Platform Updates

Detection Updates

Bug Fixes and Improvements

Log Type	Detection Rule Name	Details
Fortigate System/VPN	Fortigate: Authentication Bypass CVE-2022-40684	We updated this detection rule to reduce false positive events, and we added more logic to capture updated IOCs and additional fields to support detection filters.
HTTP Access (Apache/IIS/NginX)	CVE-2023-34362: MoveIT Indicator of Compromise	We updated this detection rule’s logic to reduce false positives caused by standard MoveIT activity.
Microsoft 365	Microsoft 365: Impossible Travel AAD Login	This existing detection rule now includes a tip to run “Microsoft 365 – Azure AD: Login Report” in the app to review the agents related to the detected activity.
Microsoft365 Azure AD	NEW – Potential Issue with Microsoft to Blumira Log Flow	This operational detection alerts you when the client secret has expired in your Microsoft 365 Cloud Connector and logs are no longer being sent to Blumira.
Multi-source	Nltest Domain Enumeration	We improved this detection rule by adding logic to capture parent_domain nltest invocations as well as command invocation of nltest or process_name like nltest.
Okta	Okta: Log Failure	This operational detection rule now includes logic to alert you if your Okta logs have stopped flowing to Blumira when either 401 or 403 errors appear in the Okta logs. This indicates that the integration has failed due to invalid credentials, which must be regenerated then updated in your Okta sensor module in the app.

Log Type	Detection Rule Name	Details
Blumira Agent (multi-source)	NEW - macOS: Potential Autostart Re-Opened Application Modification	This new informational detection is triggered when `loginwindow.plist` is accessed on a device. Any unauthorized modifications to `loginwindow.plist` files should be investigated.
Blumira Agent (multi-source)	NEW - macOS: Logging Service Shut Down	This new P3 detection triggers when a device shuts down its logging service. While this may indicate a normal actuation of the logging service it may also indicate an attacker is attempting to halt evidence retrieval similar to Windows Log alerting.
Blumira Agent (multi-source)	NEW - macOS: UnSafe File Permissions - Chmod 777	This new P3 risk detection triggers when a file has had permissions set to allow read, write, and execute to all users on the system. Setting these permissions on a file can result in unsafe modification of content or leaking of sensitive data and is not a recommended practice.
Blumira Agent (multi-source)	macOS: Mac User Added to Local Administrator Group via command line	This P2 suspect detection triggers when a user has been granted administrator privileges on a device via a command-line tool. Such a method of user elevation is uncommon and potentially risky. Achieving administrative status allows the user complete control over the device, including overriding existing policies or permissions.
Blumira Agent (multi-source)	Bash/Zsh History Manipulation	We updated this detection rule to work with Blumira Agent logs. The detection was renamed from "Indicator: T1070.003 Bash History Manipulation" to "Bash/Zsh History Manipulation" and covers several types of history manipulation.
Blumira Agent (multi-source)	Indicator: T1222.002 Linux Unusual File Attribute Action	These existing detections are now compatible with Blumira Agent logs.
Blumira Agent (multi-source)	Indicator: T1136.001 - New user with root UID and GID	These existing detections are now compatible with Blumira Agent logs.
Blumira Agent (multi-source)	Indicator: T1222.002 Linux UnSafe File Permissions: Chmod 777	These existing detections are now compatible with Blumira Agent logs.
Blumira Agent (multi-source)	Linux: Logging Service Shut Down	These existing detections are now compatible with Blumira Agent logs.
Blumira Agent (multi-source)	Execution of Python tty Shell	These existing detections are now compatible with Blumira Agent logs.
Cisco ASA System	NEW - Cisco ASA: Excessive Authentication Errors	This new P2 Threat detection triggers when one or more user accounts have failed AAA authentication at an excessive rate (5+ failed logins within an hour), which could indicate a brute force attack where word lists are used to guess username/password combinations.
Microsoft 365 Exchange	NEW - Microsoft 365: Suspicious Exchange Transport Rule Creation	This new P2 Threat detection triggers when a new transport rule is created with signatures that match malicious rules used by threat actors, such as antispam header removal. To learn more about compromises related to transport rule techniques, see Microsoft’s article: Malicious OAuth applications abuse cloud email services to spread spam.
Microsoft Outlook	Outlook .pst File Export	We added an info field to the evidence for this detection to assist customers in investigating the related activity. The field will appear only when the information is available in the logs and is not null.
Microsoft Windows	NEW - Authentication by Known Attack Tool	This new P1 Suspect detection is triggered when a device authenticates to your network using a workstation with a known bad workstation name. This activity is often used to scan a network during the reconnaissance phase of an intrusion.
Microsoft Windows	NEW - Disabling of Windows Firewall	This new P3 Suspect detection triggers when a device is seen disabling the Windows Firewall. Threat actors have been observed disabling firewalls to permit malicious traffic, so this activity should be investigated and validated for security.
Microsoft Windows	NEW - Excessive Failed IIS Logins per User	This new detection triggers when there are excessive failures against public web services (RDP, Exchange, etc) to surface brute force attacks.
Microsoft Windows	Kerberoast attack behavior	We updated the detection logic to make this more sensitive and performative on newer versions of Windows while also maintaining high-fidelity alerting.
Multi-source	NEW - Dump LSASS.exe Memory using Windows Error Reporting	This new P1 Suspect detection triggers when a local administrator has used Windows Error Reporting (WerFault.exe) to perform a process dump of all running processes on the system.
Multi-source	NEW - DFIR Report: BianLian Command and Control	This new P2 threat detection, which is included in Automated blocking with Blumira’s Dynamic Blocklists, triggers when traffic to a known command and control server has been observed on your network. This command and control traffic is likely related to the infrastructure of BianLian, a criminal group known for ransomware operations.

ISO 27001 Controls	Blumira’s Global Reports
A.9.2 Privileged Access – Track access by administrators and power users	ISO 27001 - Windows Privileged Access Available for: Windows
A.9.2 Password Resets – Track password changes for awareness of compromised accounts	ISO 27001 Password Modification Tracking Available for: Windows
A.9.2 Failed Logins – Identify brute force and other credential attacks	ISO 27001 - Failed Logins Available for: Linux, Palo Alto, Fortigate, Microsoft 365
A.9.2 USB Device Usage – Detect unauthorized devices plugged into endpoints	ISO 27001 USB Device Use Alerts
A.9.2 Account Lockouts – Find accounts locked due to excessive failed logins	ISO 27001 Account Lockouts
A.9.2 Logins by Location – Spot access from unfamiliar regions	ISO 27001 Logins from Outside US ISO 27001 Logins from Outside UK ISO 27001 Logins from Outside CA ISO 27001 Logins from Outside AUS Available for: Azure, Microsoft 365, Duo, Okta
A.9.2 VPN Connections – Monitor remote access methods and users	ISO 27001 VPN Connections Available for: Fortigate, Cisco ASA, Watchguard, GlobalProtect, SonicWall, Sophos
A.12.1 System Changes – Record critical configuration and policy changes	ISO 27001 Windows GPO Updates ISO 27001 Firewall Configuration Change Available for: Windows, Fortigate, Palo Alto, Sophos XG, Cisco ASA, Sonicwall
A.12.4 Earliest Timestamps – Prove log data retention meets policy	ISO 27001 Earliest Timestamps - Total Logs
A.12.4 Log Tampering – Detect modifications or deletions of log data	ISO 27001 Log Tampering - Clearing of Windows Security Event Log ISO 27001 Log Tampering - Clearing of Windows Event Log Available for: Windows
A.13.1 Firewall Traffic – Analyze allowed/blocked connections at perimeter	ISO 27001 - Firewall Traffic
A.16.1 IDS/IPS Alerts – Identify potential intrusion attempts and malware	ISO 27001 IDS/IPS Alerts Available for: Fortigate, Umbrella, Checkpoint, PaloAlto, Sonicwall, Sophos XG

NIST 800-171 Controls	Blumira Report
NIST 3.1 Access Control 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).	(NIST) Unauthorized Access Attempts Blumira’s report lists out all failed login attempts, access denied events, etc. over the last 90 days. This verifies proper logging and monitoring of access. Available for: Windows & Linux
3.1.2 Limit system access to the types of transactions and functions that authorized users are permitted to execute.	(NIST) Service Account Access This report lists all service account login events to help you confirm appropriate use of these accounts. Available for: Azure & Windows
3.1.5 Employ the principle of least privilege, including for specific security functions and privileged accounts.	(NIST) User Entitlement This report shows all user permissions and roles to validate proper access controls and least privilege. Available for: Azure AD, GSuite (Now Google Workspace) & Windows
3.1.7 Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.	(NIST) Privilege Elevations Blumira's report shows all instances where user privileges were temporarily escalated, such as sudo commands. This verifies proper approval and monitoring. Available for: Windows & Linux
3.1.12 Monitor and control remote access sessions	(NIST) VPN Connection This lists all VPN connection events for remote users within your environment. This validates connections were authorized. Available for: Fortigate, GlobalProtect, Cisco ASA, SonicWall, Sophos, & WatchGuard
NIST 3.3 Audit & Accountability 3.3.1 Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.	(NIST) Audit Logs & Records This report shows your "earliest" log by type to help you prove data retention and show length of time period.
NIST 3.4 Configuration Management 3.4.3 Track, review, approve or disapprove, and log changes to organizational systems.	(NIST) Configuration Changes Blumira's report lists all configuration changes made to systems and devices over the last 90 days, such as firewall changes. This verifies proper change management. Available for: Cisco ASA, Fortigate, & Palo Alto
NIST 3.14 System & Information Integrity 3.14.2 Provide protection from malicious code at designated locations within organizational systems.	(NIST) Malware Detection This report lists out instances where anti-malware tools detected malware over a certain time period. Available for: Microsoft 365, Carbon Black, CrowdStrike, Cylance, Defender