Critical Alerts

• Cisco AI Defense Security Alerts by Application Name :
  endpoint Web Application None version:8
  This analytic summarizes Cisco AI Defense events by application, connection, action, message direction, and severity over ten-minute intervals. Allowed responses flagged for privacy guardrails are handled by the dedicated sensitive-response detection. Allowed prompts flagged for privacy guardrails are handled by Cisco AI Defense Allowed Sensitive Prompt. Repeated prompt injection, code detection, PII, or PCI events are handled by the repeated high-risk activity detection.


• Microsoft Defender Incident Alerts :
  endpoint Endpoint None version:9
  The following analytic is to leverage alerts from Microsoft Defender O365 Incidents. This query aggregates and summarizes all alerts from Microsoft Defender O365 Incidents, providing details such as the destination, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a static mapping to set the risk score based on the severity of the alert.


• Detect Spike in AWS Security Hub Alerts for User :
  network AWS Instance None version:11
  The following analytic identifies a spike in the number of AWS Security Hub alerts for an AWS IAM User within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect significant deviations. This activity is significant as a sudden increase in alerts for a specific user may indicate suspicious behavior or a potential security incident. If confirmed malicious, this could signify an ongoing attack, unauthorized access, or misuse of IAM credentials, potentially leading to data breaches or further exploitation.


• Detect Spike in AWS Security Hub Alerts for EC2 Instance :
  endpoint AWS Instance None version:12
  The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.


• Splunk Secure Application Alerts for Runtime Security :
  threat Web Application None version:1
  The following analytic leverages alerts from Splunk Secure Application, which identifies and monitors exploit attempts targeting business applications. Attacks observed include exploiting vulnerabilities in web applications, such as injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution, LOG4J, and zero-day attacks. These events are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality. Splunk Secure Application provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by: * Identifying active exploitation attempts in real-time, allowing for quicker incident response. * Categorizing attack severity to prioritize remediation efforts based on risk level. * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications. * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows. * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability. By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.


• Microsoft Defender ATP Alerts :
  endpoint Endpoint None version:8
  The following analytic is to leverage alerts from Microsoft Defender ATP Alerts. This query aggregates and summarizes all alerts from Microsoft Defender ATP Alerts, providing details such as the source, file name, severity, process command line, ip address, registry key, signature, description, unique id, and timestamps. This detection is not intended to detect new activity from raw data, but leverages Microsoft provided alerts to be correlated with other data as part of risk based alerting. The data contained in the alert is mapped not only to the risk object, but also the threat object. This detection filters out evidence that has a verdict of clean from Microsoft. It dynamically maps the MITRE technique at search time to auto populate the annotation field with the value provided in the alert. It also uses a dynamic mapping to set the risk score in Enterprise Security based on the severity of the alert.


• Cisco AI Defense Repeated High Risk Activity :
  endpoint Web Application None version:1
  Detects bursts of five or more distinct Cisco AI Defense event IDs, or three or more occurrences of the same event ID, matching prompt injection, code detection, PII, or PCI guardrails for the same application and connection within ten minutes. Allowed PII/PCI prompt events are handled by Cisco AI Defense Allowed Sensitive Prompt. These patterns can indicate iterative prompt-injection probing or repeated attempts to use an AI application to access restricted data or capabilities.


• Detect Critical Alerts from Security Tools :
  endpoint Endpoint 2025-01-13 version:2
  The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection.


• Cisco AI Defense Allowed Sensitive Response :
  endpoint Web Application None version:1
  Detects Cisco AI Defense response events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. These events may indicate that sensitive information was returned to an AI application user and should be reviewed promptly.


• Cisco AI Defense Allowed Sensitive Prompt :
  endpoint Web Application None version:1
  Detects Cisco AI Defense prompt events that were allowed and matched a privacy guardrail for personally identifiable information or payment card data. These events may indicate that sensitive information was submitted to an AI application and should be reviewed against the organization's data handling policy.


• Cisco Secure Application Alerts :
  threat Web Application 2025-08-04 version:3
  The following analytic is to leverage alerts from Cisco SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality. Cisco SecureApp provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by: * Identifying active exploitation attempts in real-time, allowing for quicker incident response. * Categorizing attack severity to prioritize remediation efforts based on risk level. * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications. * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows. * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability. By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.


• CrowdStrike Falcon Stream Alerts :
  endpoint Endpoint None version:6
  The following analytic is to leverage alerts from CrowdStrike Falcon Event Stream. This query aggregates and summarizes DetectionSummaryEvent and IdpDetectionSummaryEvent alerts from CrowdStrike Falcon Event Stream, providing details such as destination, user, severity, MITRE information, and Crowdstrike id and links. The evals in the search do multiple things to include align the severity, ensure the user, dest, title, description, MITRE fields are set properly, and the drilldowns are defined based on the type of alert. The search is highly dynamic to account for different alert types in which some fields may or may not be populated. Having all these fields properly set ensure the appropriate risk and analyst queue fields are correctly populated.


• Splunk AppDynamics Secure Application Alerts :
  threat Web Application None version:5
  The following analytic is to leverage alerts from Splunk AppDynamics SecureApp, which identifies and monitors exploit attempts targeting business applications. The primary attack observed involves exploiting vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J and zero day attacks. These attacks are typically aimed at gaining unauthorized access, exfiltrating sensitive data, or disrupting application functionality. Splunk AppDynamics SecureApp provides real-time detection of these threats by analyzing application-layer events and correlating attack behavior with known vulnerability signatures. This detection methodology helps the Security Operations Center (SOC) by: * Identifying active exploitation attempts in real-time, allowing for quicker incident response. * Categorizing attack severity to prioritize remediation efforts based on risk level. * Providing visibility into attacker tactics, including source IP, attack techniques, and affected applications. * Generating risk-based scoring and contextual alerts to enhance decision-making within SOC workflows. * Helping analysts determine whether an attack was merely an attempt or if it successfully exploited a vulnerability. By leveraging this information, SOC teams can proactively mitigate security threats, patch vulnerable applications, and enforce security controls to prevent further exploitation.