detection.wiki
133,319 events and 15,987 detection rules. Search operator reference
More
| Platform or product telemetry catalog. | Telemetry source and the records it catalogs. | Cataloged event types, operations, actions, or record groupings. | Catalog entries with at least one sample event. | Catalog entries mapped to at least one detection rule. |
|---|---|---|---|---|
| macOSEndpoint Security events by domain | Endpoint Security events by domain | 148 | 57 | 13 |
| auditdLinux audit record types | Linux audit record types | 205 | 171 | 20 |
| Sysmon for LinuxSysmon events for Linux endpoints | Sysmon events for Linux endpoints | 14 | 10 | 3 |
| WindowsWindows Event Log providers and events | Windows Event Log providers and events | 102294 | 10161 | 449 |
| Microsoft 365Microsoft 365 audit log operations | Microsoft 365 audit log operations | 364 | 270 | 154 |
| Entra IDEntra ID directory and sign-in logs | Entra ID directory and sign-in logs | 970 | 112 | 116 |
| AzureAzure control plane operations | Azure control plane operations | 4210 | 195 | 120 |
| Microsoft IntuneIntune device-management audit events | Intune device-management audit events | 138 | 36 | 12 |
| Power PlatformPower Platform audit events | Power Platform audit events | 214 | 5 | 9 |
| Defender XDRDefender Advanced Hunting ActionTypes | Defender Advanced Hunting ActionTypes | 392 | 135 | 70 |
| AWSCloudTrail events by service and API action | CloudTrail events by service and API action | 17851 | 3500 | 564 |
| GCPCloud Audit Log operations by service and method | Cloud Audit Log operations by service and method | 1534 | 319 | 118 |
| Google WorkspaceAdmin SDK events by application and event name | Admin SDK events by application and event name | 838 | 40 | 80 |
| GitHubAudit log actions by category prefix | Audit log actions by category prefix | 1161 | 361 | 333 |
| KubernetesAudit log API operations by resource and verb | Audit log API operations by resource and verb | 758 | 607 | 154 |
| OktaSystem Log event types by namespace | System Log event types by namespace | 1179 | 250 | 98 |
| SublimeEmail detection events | Email detection events | 28 | 0 | 28 |
Detection rules: Explore 15,987 rules by source, platform, and ATT&CK mapping.
ATT&CK coverage: Compare rule coverage across techniques, platforms, and vendors.