detection.wiki
133,551 events and 16,127 detection rules. Search operator reference
More
| Platform or product telemetry catalog. | Telemetry source and the records it catalogs. | Cataloged event types, operations, actions, or record groupings. | Catalog entries with at least one sample event. | Catalog events with at least one mapped detection rule. |
|---|---|---|---|---|
| macOSEndpoint Security events by domain | Endpoint Security events by domain | 148 | 57 | 13 |
| auditdLinux audit record types | Linux audit record types | 205 | 171 | 20 |
| Sysmon for LinuxSysmon events for Linux endpoints | Sysmon events for Linux endpoints | 14 | 10 | 3 |
| WindowsWindows Event Log providers and events | Windows Event Log providers and events | 102294 | 10161 | 449 |
| Microsoft 365Microsoft 365 audit log operations | Microsoft 365 audit log operations | 364 | 270 | 154 |
| Entra IDEntra ID directory and sign-in logs | Entra ID directory and sign-in logs | 970 | 112 | 116 |
| AzureAzure control plane operations | Azure control plane operations | 4210 | 195 | 120 |
| Microsoft IntuneIntune device-management audit events | Intune device-management audit events | 138 | 36 | 12 |
| Power PlatformPower Platform audit events | Power Platform audit events | 214 | 5 | 9 |
| Defender XDRDefender Advanced Hunting ActionTypes | Defender Advanced Hunting ActionTypes | 392 | 135 | 70 |
| AWSCloudTrail events by service and API action | CloudTrail events by service and API action | 17863 | 3500 | 565 |
| GCPCloud Audit Log operations by service and method | Cloud Audit Log operations by service and method | 1550 | 319 | 119 |
| Google WorkspaceAdmin SDK events by application and event name | Admin SDK events by application and event name | 838 | 40 | 80 |
| GitHubAudit log actions by category prefix | Audit log actions by category prefix | 1161 | 361 | 333 |
| KubernetesAudit log API operations by resource and verb | Audit log API operations by resource and verb | 758 | 607 | 146 |
| OktaSystem Log event types by namespace | System Log event types by namespace | 1179 | 250 | 98 |
| SublimeEmail detection events | Email detection events | 28 | 15 | 28 |
| 1PasswordEvents Reporting API audit events, item usages, and sign-in attempts | Events Reporting API audit events, item usages, and sign-in attempts | 204 | 69 | 21 |
Products with attributed detection rules but no event catalog.
Identity and SaaS
| Product | Telemetry | Rules |
|---|---|---|
| Auth0 Auth0 tenant and authentication events | Auth0 tenant and authentication events | 57 |
| Duo Duo authentication and administrator activity | Duo authentication and administrator activity | 43 |
| Snowflake Snowflake access and account usage telemetry | Snowflake access and account usage telemetry | 41 |
| Databricks Databricks audit logs | Databricks audit logs | 37 |
| Atlassian Atlassian Jira and Bitbucket audit logs | Atlassian Jira and Bitbucket audit logs | 33 |
| Slack Slack audit and access logs | Slack audit and access logs | 31 |
| Zscaler Zscaler web, firewall, and private-access logs | Zscaler web, firewall, and private-access logs | 30 |
| osquery osquery result and differential logs | osquery result and differential logs | 29 |
| OneLogin OneLogin authentication and administration events | OneLogin authentication and administration events | 28 |
| Tailscale Tailscale configuration and network-flow logs | Tailscale configuration and network-flow logs | 27 |
| Box Box enterprise events | Box enterprise events | 26 |
| Cloudflare Cloudflare audit, HTTP, and firewall events | Cloudflare audit, HTTP, and firewall events | 26 |
| SAP SAP audit, gateway, and HANA security logs | SAP audit, gateway, and HANA security logs | 26 |
| Mimecast Mimecast email-security logs | Mimecast email-security logs | 23 |
| Notion Notion audit logs | Notion audit logs | 22 |
| Asana Asana audit logs | Asana audit logs | 19 |
| Azure DevOps Azure DevOps audit logs | Azure DevOps audit logs | 19 |
| Netskope Netskope security and audit events | Netskope security and audit events | 19 |
| Wiz Wiz audit and security findings | Wiz audit and security findings | 18 |
| Anthropic Anthropic API usage logs | Anthropic API usage logs | 17 |
| Zoom Zoom operation and activity logs | Zoom operation and activity logs | 17 |
| Proofpoint Proofpoint email and security telemetry | Proofpoint email and security telemetry | 16 |
| Ping PingFederate, PingID, and PingOne logs | PingFederate, PingID, and PingOne logs | 15 |
| Teleport Teleport audit events | Teleport audit events | 13 |
| Zendesk Zendesk audit logs | Zendesk audit logs | 13 |
| MongoDB MongoDB database and audit logs | MongoDB database and audit logs | 12 |
| GitLab GitLab audit events | GitLab audit events | 11 |
| Snyk Snyk group and organization audit logs | Snyk group and organization audit logs | 10 |
| Dropbox Dropbox team events | Dropbox team events | 9 |
| NordPass NordPass activity logs | NordPass activity logs | 9 |
| Push Security Push Security activity and findings | Push Security activity and findings | 9 |
| Tines Tines audit logs | Tines audit logs | 9 |
| Salesforce Salesforce event monitoring and audit logs | Salesforce event monitoring and audit logs | 8 |
| OpenAI OpenAI API and administration logs | OpenAI API and administration logs | 7 |
| Axonius Axonius activity logs | Axonius activity logs | 5 |
| DocuSign DocuSign monitor events | DocuSign monitor events | 5 |
| LastPass LastPass enterprise activity | LastPass enterprise activity | 5 |
| Thinkst Canary Thinkst Canary alerts | Thinkst Canary alerts | 3 |
Security and infrastructure
| Product | Telemetry | Rules |
|---|---|---|
| CrowdStrike CrowdStrike Falcon endpoint and alert telemetry | CrowdStrike Falcon endpoint and alert telemetry | 875 |
| SentinelOne SentinelOne endpoint and cloud funnel telemetry | SentinelOne endpoint and cloud funnel telemetry | 449 |
| Cisco Network Security Cisco ASA, IOS, FTD, Meraki, SD-WAN, WSA, SEG, Umbrella, and NVM logs | Cisco ASA, IOS, FTD, Meraki, SD-WAN, WSA, SEG, Umbrella, and NVM logs | 133 |
| Veeam Veeam backup and security events | Veeam backup and security events | 113 |
| Pathlock Pathlock access risk and audit telemetry | Pathlock access risk and audit telemetry | 77 |
| Palo Alto Networks Palo Alto Networks firewall and Cortex telemetry | Palo Alto Networks firewall and Cortex telemetry | 68 |
| VMware VMware ESXi and SD-WAN logs | VMware ESXi and SD-WAN logs | 51 |
| Suricata Suricata network IDS events | Suricata network IDS events | 44 |
| Zeek Zeek network protocol logs | Zeek network protocol logs | 43 |
| Nginx Nginx access and error logs | Nginx access and error logs | 36 |
| IIS Microsoft IIS web server logs | Microsoft IIS web server logs | 31 |
| OpenCanary OpenCanary honeypot events | OpenCanary honeypot events | 24 |
| Tenable Identity Exposure Tenable Identity Exposure telemetry | Tenable Identity Exposure telemetry | 24 |
| Trend Micro Trend Micro security telemetry | Trend Micro security telemetry | 20 |
| Corelight Corelight network security telemetry | Corelight network security telemetry | 18 |
| Fortinet Fortinet FortiGate and FortiOS logs | Fortinet FortiGate and FortiOS logs | 18 |
| Vectra Vectra detections and audit telemetry | Vectra detections and audit telemetry | 15 |
| CyberArk CyberArk privileged access telemetry | CyberArk privileged access telemetry | 14 |
| Infoblox Infoblox DNS and DDI logs | Infoblox DNS and DDI logs | 12 |
| Cisco Secure Endpoint Cisco Secure Endpoint and AMP telemetry | Cisco Secure Endpoint and AMP telemetry | 11 |
| Imperva WAF Imperva web application firewall logs | Imperva web application firewall logs | 10 |
| Oracle Cloud Infrastructure OCI audit logs | OCI audit logs | 10 |
| Carbon Black VMware Carbon Black endpoint telemetry | VMware Carbon Black endpoint telemetry | 6 |
| Check Point Check Point firewall and security logs | Check Point firewall and security logs | 3 |
Detection rules: Explore 16,127 rules by source, platform, and ATT&CK mapping.
ATT&CK coverage: Compare rule coverage across techniques, platforms, and vendors.