Detection Rule and Telemetry Catalog

133,657 events and 16,085 detection rules. Search operator reference


macOSEndpoint Security events by domain	Endpoint Security events by domain	148	57	13
auditdLinux audit record types	Linux audit record types	205	171	20
Sysmon for LinuxSysmon events for Linux	Sysmon events for Linux	14	10	3
WindowsEvent Log providers and events	Event Log providers and events	102294	10161	450
Microsoft 365Audit log operations	Audit log operations	364	274	154
Entra IDDirectory and sign-in logs	Directory and sign-in logs	970	161	118
AzureControl plane operations	Control plane operations	4210	223	120
Microsoft IntuneDevice management audit events	Device management audit events	138	36	12
Power PlatformAudit events	Audit events	214	5	9
Defender XDRAdvanced Hunting ActionTypes	Advanced Hunting ActionTypes	392	135	70
AWSCloudTrail events by service and API action	CloudTrail events by service and API action	17942	3500	584
GCPCloud Audit Log operations by service and method	Cloud Audit Log operations by service and method	1551	319	119
Google WorkspaceAdmin SDK events by application and event name	Admin SDK events by application and event name	838	40	80
GitHubAudit log actions by category prefix	Audit log actions by category prefix	1174	361	333
KubernetesAudit log API operations by resource and verb	Audit log API operations by resource and verb	758	607	146
OktaSystem Log event types by namespace	System Log event types by namespace	1192	250	98
SublimeEmail detection events	Email detection events	28	15	28
1PasswordEvents Reporting API audit events, item usages, and sign-in attempts	Events Reporting API audit events, item usages, and sign-in attempts	204	69	21

Products with attributed detection rules but no event catalog.

Identity and SaaS

Product	Telemetry	Rules
Auth0 Tenant and authentication events	Tenant and authentication events	57
Duo Authentication and administrator activity	Authentication and administrator activity	43
Snowflake Access and account usage telemetry	Access and account usage telemetry	41
Databricks Audit logs	Audit logs	37
Atlassian Jira and Bitbucket audit logs	Jira and Bitbucket audit logs	33
osquery Result and differential logs	Result and differential logs	33
Slack Audit and access logs	Audit and access logs	31
Zscaler Web, firewall, and private access logs	Web, firewall, and private access logs	30
OneLogin Authentication and administration events	Authentication and administration events	28
Tailscale Configuration and network flow logs	Configuration and network flow logs	27
Box Enterprise events	Enterprise events	26
Cloudflare Audit, HTTP, and firewall events	Audit, HTTP, and firewall events	26
SAP Audit, gateway, and HANA security logs	Audit, gateway, and HANA security logs	26
Mimecast Email security logs	Email security logs	23
Notion Audit logs	Audit logs	22
Asana Audit logs	Audit logs	19
Azure DevOps Audit logs	Audit logs	19
Netskope Security and audit events	Security and audit events	19
Wiz Audit and security findings	Audit and security findings	18
Anthropic API usage logs	API usage logs	17
Zoom Operation and activity logs	Operation and activity logs	17
Proofpoint Email and security telemetry	Email and security telemetry	16
Ping PingFederate, PingID, and PingOne logs	PingFederate, PingID, and PingOne logs	15
Teleport Audit events	Audit events	13
Zendesk Audit logs	Audit logs	13
MongoDB Database and audit logs	Database and audit logs	12
GitLab Audit events	Audit events	11
Snyk Group and organization audit logs	Group and organization audit logs	10
Dropbox Team events	Team events	9
NordPass Activity logs	Activity logs	9
Push Security Activity and findings	Activity and findings	9
Tines Audit logs	Audit logs	9
Salesforce Event monitoring and audit logs	Event monitoring and audit logs	8
OpenAI API and administration logs	API and administration logs	7
Axonius Activity logs	Activity logs	5
DocuSign Monitor events	Monitor events	5
LastPass Enterprise activity	Enterprise activity	5
Thinkst Canary Alerts	Alerts	3

Security and infrastructure

Product	Telemetry	Rules
CrowdStrike Falcon endpoint and alert telemetry	Falcon endpoint and alert telemetry	880
SentinelOne Endpoint and cloud funnel telemetry	Endpoint and cloud funnel telemetry	452
Cisco Network Security Cisco ASA, IOS, FTD, Meraki, SD-WAN, WSA, SEG, Umbrella, and NVM logs	Cisco ASA, IOS, FTD, Meraki, SD-WAN, WSA, SEG, Umbrella, and NVM logs	133
Veeam Backup and security events	Backup and security events	113
Pathlock Access risk and audit telemetry	Access risk and audit telemetry	77
Palo Alto Networks Firewall and Cortex telemetry	Firewall and Cortex telemetry	69
VMware ESXi and SD-WAN logs	ESXi and SD-WAN logs	51
Suricata Network IDS events	Network IDS events	44
Zeek Network protocol logs	Network protocol logs	43
Nginx Access and error logs	Access and error logs	36
IIS Web server logs	Web server logs	31
Fortinet FortiGate and FortiOS logs	FortiGate and FortiOS logs	28
OpenCanary Honeypot events	Honeypot events	24
Tenable Identity Exposure Identity exposure telemetry	Identity exposure telemetry	24
Trend Micro Security telemetry	Security telemetry	20
Corelight Network security telemetry	Network security telemetry	18
Vectra Detections and audit telemetry	Detections and audit telemetry	15
CyberArk Privileged access telemetry	Privileged access telemetry	14
Infoblox DNS and DDI logs	DNS and DDI logs	12
Cisco Secure Endpoint Endpoint and AMP telemetry	Endpoint and AMP telemetry	11
Imperva WAF Web application firewall logs	Web application firewall logs	10
Oracle Cloud Infrastructure Audit logs	Audit logs	10
Carbon Black Endpoint telemetry	Endpoint telemetry	6
Check Point Firewall and security logs	Firewall and security logs	3

Detection rules: Explore 16,085 rules by source, platform, and ATT&CK mapping.

ATT&CK coverage: Compare rule coverage across techniques, platforms, and vendors.

detection.wiki

Identity and SaaS

Security and infrastructure