Aegis
Rule library
// Detection

Bulk containment by a single operator

Several destructive automations executed by one operator in a short window. Legitimate during a live incident, worth a second pair of eyes at any other time.

HighInvestigating0alerts raisedThreshold
Armed

What this rule does

Rendered from the stored logic, so it cannot drift from what executes.

4+ events where eventType is PLATFORM_AUTOMATION_EXECUTED, grouped by username, within 15 minutes

{
  "kind": "threshold",
  "count": 4,
  "where": [
    {
      "op": "eq",
      "field": "eventType",
      "value": "PLATFORM_AUTOMATION_EXECUTED"
    }
  ],
  "groupBy": "username",
  "windowMinutes": 15
}

Revise

Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.

Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city

Alerts raised (0)

What this rule has actually caught.

Never fired

Armed, but nothing in the retained window has matched it.

Rule

Category
Platform
ATT&CK tactic
Impact
Technique
T1531
Kind
Threshold
State
Armed
Created
7d ago
Last changed
7d ago

Firing history

Total alerts
0
First fired
Never
Last fired
Never
Escalated to cases
0
Dismissed benign
0

Related