Thinkst Canary

Search Thinkst Canary rules.

Telemetry Evidence

These values show how indexed rules identify Thinkst Canary telemetry.

Kusto

Queried source table ThinkstCanaryIncidents_CL (1 rule)

Panther

Log type ThinkstCanary.Alert (3 rules)
Platform thinkstcanary (3 rules)

Detection Rules

Panther #

Thinkst Canary DCRC source high: A Canary has disconnected/reconnected.
Thinkst Canary Incident source high: A Canary incident has been detected.
Thinkst Canarytoken Incident source high: A Canarytoken incident has been detected.

Other Index Content

This content is indexed for research but excluded from the detection-rule headline.

Kusto #

Canary alerts to incidents source high: Creates Microsoft Sentinel incidents from Thinkst Canary alerts.T1021, T1041