Aegis
Rule library
// Detection

Threat intelligence match

An indicator from a threat intelligence feed observed in telemetry. Matching runs over the whole window each sweep, so intel added today surfaces activity already stored.

HighInvestigating0alerts raisedSignature
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is __INTEL_SENTINEL__

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "__INTEL_SENTINEL__"
    }
  ]
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (0)

What this rule has actually caught.

Never fired

Armed, but nothing in the retained window has matched it.

Rule

Category
Threat Intelligence
ATT&CK tactic
Command and Control
Technique
T1071
Kind
Signature
State
Armed
Created
7d ago
Last changed
7d ago

Firing history

Total alerts
0
First fired
Never
Last fired
Never
Escalated to cases
0
Dismissed benign
0

Related