// Detection

Deprecated TLS negotiated

A session negotiated on TLS 1.0 or 1.1. A hygiene finding rather than an intrusion, but it is how downgrade paths stay open.

LowInvestigating0alerts raisedSignature

Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

Any event where eventType is TLS_NEGOTIATION

{
  "kind": "match",
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "TLS_NEGOTIATION"
    }
  ]
}

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

NameSeverity

Description

CategoryATT&CK tacticTechnique

Logic

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

What this rule has actually caught.

Armed, but nothing in the retained window has matched it.