[ " {Jan:'01',Feb:'02',Mar:'03',Apr:'04',May:'05',Jun:'06',Jul:'07',Aug:'08',Sep:'09',Oct:'10',Nov:'11',Dec:'12'}[evt.Parsed.ts_m] + '/' + evt.Parsed.ts_d + '/' + evt.Parsed.ts_y + ' ' + evt.Parsed.ts_t", "\"20\" + evt.Parsed.year + \"/\" + evt.Parsed.month + \"/\" + evt.Parsed.day + \" \" + evt.Parsed.time", "'source_ip' in evt.Meta", "(\nUpper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&ow=2&no-switch=1&append=1') ||\nUpper(evt.Meta.http_path) contains Upper('/service/extension/backup/mboximport?account-name=admin&account-status=1&ow=cmd') \n)\nand evt.Meta.http_status startsWith ('40') and\nUpper(evt.Meta.http_verb) == 'POST'\n", "GetFromStash(\"auditd_pid_progname\", evt.Unmarshaled.auditd.ppid)", "IpToRange(evt.Overflow.Alert.Source.IP, \"/64\")", "IsIP(evt.Unmarshaled.cloudtrail.sourceIPAddress) ? evt.Unmarshaled.cloudtrail.sourceIPAddress : \"\"\n", "JsonExtract(evt.Line.Raw, \"common_log\")", "JsonExtract(evt.Line.Raw, \"metric_name\")", "JsonExtract(evt.Line.Raw, \"path_info\")", "JsonExtract(evt.Line.Raw, \"request.headers.User-Agent\")", "JsonExtract(evt.Line.Raw, \"request.host\")", "JsonExtract(evt.Line.Raw, \"request.method\")", "JsonExtract(evt.Line.Raw, \"request.remote_addr\")", "JsonExtract(evt.Line.Raw, \"request.remote_ip\")", "JsonExtract(evt.Line.Raw, \"request.uri\")", "JsonExtract(evt.Line.Raw, \"request_ip\")", "JsonExtract(evt.Line.Raw, \"resp_headers.Date[0]\")", "JsonExtract(evt.Line.Raw, \"status\")", "JsonExtract(evt.Line.Raw, \"time\")", "JsonExtract(evt.Line.Raw, \"timestamp\")", "JsonExtract(evt.Line.Raw, \"user_agent\")", "JsonExtract(evt.Line.Raw, 'status') == '401' && JsonExtract(evt.Line.Raw, 'request.headers.Authorization[0]') startsWith 'Basic ' ? 'auth_fail' : ''", "JsonExtract(evt.Parsed.line, \"bouncer_agent\")", "JsonExtract(evt.Parsed.line, \"customer_id\")", "JsonExtract(evt.Parsed.line, \"ip\")", "JsonExtract(evt.Parsed.line, \"order_id\")", "JsonExtract(evt.Parsed.line, \"payment_method\")", "JsonExtract(evt.Parsed.line, \"product_id\")", "JsonExtract(evt.Parsed.line, \"quote_id\")", "JsonExtract(evt.Parsed.line, \"type\")", "JsonExtract(evt.Parsed.line, \"x-forwarded-for-ip\")", "JsonExtract(evt.Parsed.message, \"alert.rev\")", "JsonExtract(evt.Parsed.message, \"alert.severity\")", "JsonExtract(evt.Parsed.message, \"alert.signature\")", "JsonExtract(evt.Parsed.message, \"alert.signature_id\")", "JsonExtract(evt.Parsed.message, \"attr.authenticationDatabase\")", "JsonExtract(evt.Parsed.message, \"attr.principalName\")", "JsonExtract(evt.Parsed.message, \"attr.remote\")", "JsonExtract(evt.Parsed.message, \"client_ip\")", "JsonExtract(evt.Parsed.message, \"dest_ip\")", "JsonExtract(evt.Parsed.message, \"dest_port\")", "JsonExtract(evt.Parsed.message, \"eventAudience\")", "JsonExtract(evt.Parsed.message, \"eventData.eventConfidence\")", "JsonExtract(evt.Parsed.message, \"eventData.httpSourceId\")", "JsonExtract(evt.Parsed.message, \"eventData.matchedLocation\")", "JsonExtract(evt.Parsed.message, \"eventData.matchedParameter\")", "JsonExtract(evt.Parsed.message, \"eventData.matchedSample\")", "JsonExtract(evt.Parsed.message, \"eventData.securityAction\")", "JsonExtract(evt.Parsed.message, \"eventData.sourceIP\")", "JsonExtract(evt.Parsed.message, \"eventData.waapIncidentType\")", "JsonExtract(evt.Parsed.message, \"eventName\")", "JsonExtract(evt.Parsed.message, \"eventPriority\")", "JsonExtract(evt.Parsed.message, \"eventSeverity\")", "JsonExtract(evt.Parsed.message, \"eventTime\")", "JsonExtract(evt.Parsed.message, \"flow_id\")", "JsonExtract(evt.Parsed.message, \"message\")", "JsonExtract(evt.Parsed.message, \"msg\")", "JsonExtract(evt.Parsed.message, \"proto\")", "JsonExtract(evt.Parsed.message, \"remote_ip\")", "JsonExtract(evt.Parsed.message, \"request_method\")", "JsonExtract(evt.Parsed.message, \"request_referer\")", "JsonExtract(evt.Parsed.message, \"request_user_agent\")", "JsonExtract(evt.Parsed.message, \"response_body_size\")", "JsonExtract(evt.Parsed.message, \"response_status\")", "JsonExtract(evt.Parsed.message, \"src_ip\")", "JsonExtract(evt.Parsed.message, \"t.$date\")", "JsonExtract(evt.Parsed.message, \"time\")", "JsonExtract(evt.Parsed.message, \"timestamp\")", "JsonExtract(evt.Parsed.message, \"url\")", "JsonExtractUnescape(evt.Line.Raw, \"log\")", "Lower(evt.Meta.http_path) contains '/index.php' &&\nUpper(evt.Parsed.verb) == 'POST' &&\nevt.Meta.http_status == '302' &&\nLower(evt.Parsed.http_args) matches 'login=.*[$|%24][\\\\(|%28].*[\\\\)|%29]'\n", "Lower(evt.Unmarshaled.iptables.PROTO)", "ParseKV(evt.Parsed.message, evt.Unmarshaled, \"iptables\")", "RegexpInFile(evt.Enriched.reverse_dns, 'rdns_seo_bots.regex')", "Split(evt.Unmarshaled.traefik.ClientAddr, ':')[0]", "Split(evt.Unmarshaled.traefik.RequestProtocol, '/')[1]", "UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, \"k8s_audit\")", "UnmarshalJSON(evt.Line.Raw, evt.Unmarshaled, 'cloudtrail')", "Upper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:javascript:java.lang.Runtime.getRuntime().exec(')\nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${script:js:java.lang.Runtime.getRuntime().exec(')\nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${url:UTF-8:') \nor\nUpper(PathUnescape(evt.Meta.http_path)) contains Upper('${dns:address|') \n", "Upper(PathUnescape(evt.Meta.http_path)) contains Upper('@java.lang.Runtime@getRuntime().exec(')", "Upper(evt.Meta.http_path) contains Upper('/autodiscover/autodiscover.json') &&\nUpper(evt.Parsed.http_args) contains Upper('powershell')\n", "Upper(evt.Meta.http_path) contains Upper('/ghost/api/admin/session') &&\nUpper(evt.Parsed.verb) == 'POST' &&\nevt.Meta.http_status == '404'\n", "Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&\nUpper(evt.Parsed.verb) == 'GET' &&\nLower(evt.Parsed.http_args) contains 'action=polldata' &&\nLower(evt.Parsed.http_args) matches 'poller_id=.*(;|%3b)'\n", "Upper(evt.Meta.http_path) contains Upper('/remote_agent.php') &&\nUpper(evt.Parsed.verb) == 'GET' &&\nLower(evt.Parsed.http_args) contains 'host_id' &&\nLower(evt.Parsed.http_args) contains 'local_data_ids'\n", "Upper(evt.Meta.http_path) contains Upper('/vendor/htmlawed/htmlawed/htmLawedTest.php')", "Upper(evt.Parsed.file_ext) in ['.JPG', '.CSS', '.JS', '.JPEG', '.PNG', '.SVG', '.MAP', '.ICO', '.OTF', '.GIF', '.MP3', '.MP4', '.WOFF', '.WOFF2', '.TTF', '.OTF', '.EOT', '.WEBP', '.WAV', '.GZ', '.BROTLI', '.BVR', '.TS', '.BMP'] ? 'true' : 'false'", "Upper(evt.Parsed.program) == 'BAIKAL'", "Upper(evt.Parsed.program) == 'GITLAB'", "Upper(evt.Parsed.program) == 'MONGODB'", "Upper(evt.Parsed.program) == 'NAMED'", "Upper(evt.Parsed.program) == 'NEXTCLOUD'", "Upper(evt.Parsed.program) == 'PAPERLESS-NGX'", "Upper(evt.Parsed.program) == 'UPTIME-KUMA'", "Upper(evt.Parsed.program) == 'VAULTWARDEN'", "Upper(evt.Parsed.program) == 'WEBMIN'", "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/Provider\", \"Name\")", "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/Security\", \"UserID\")", "XMLGetAttributeValue(evt.Line.Raw, \"/Event/System[1]/TimeCreated\", \"SystemTime\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[1]\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[2]\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[3]\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Archived']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CallTrace']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ClientInfo']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CommandLine']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Company']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Configuration']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ConfigurationFileHash']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Consumer']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CreationUtcTime']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='CurrentDirectory']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Description']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Destination']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationHostname']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationIp']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationIsIpv6']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationPort']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='DestinationPortName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Details']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Device']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='EventNamespace']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='EventType']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='FileVersion']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Filter']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='GrantedAccess']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Hashes']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Image']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ImageLoaded']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Initiated']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IntegrityLevel']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IpAddress']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='IsExecutable']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='LogonGuid']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='LogonId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Name']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='NewName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='NewThreadId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Operation']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='OriginalFileName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentCommandLine']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentImage']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentProcessGuid']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentProcessId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ParentUser']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='PipeName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ProcessGuid']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='ProcessId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Protocol']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Query']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryResults']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='QueryStatus']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='RuleName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SchemaVersion']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Session']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Signature']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SignatureStatus']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Signed']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceHostname']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceImage']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceIp']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceIsIpv6']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourcePort']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourcePortName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessGUID']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessGuid']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceProcessId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='SourceThreadId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartAddress']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartFunction']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='StartModule']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='State']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetFilename']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetImage']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetObject']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessGUID']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessGuid']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetProcessId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TargetUserName']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='TerminalSessionId']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Type']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='User']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='Version']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='c-ip']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-method']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-uri-query']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='cs-uri-stem']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='csUser-Agent']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='date']\") + \" \" + XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='time']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='s-sitename']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/EventData[1]/Data[@Name='sc-status']\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/Channel\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/Computer\")", "XMLGetNodeValue(evt.Line.Raw, \"/Event/System[1]/EventID\")", "all(evt.Overflow.Alert.Events, {.GetMeta('parent_progname') in ['/usr/bin/dpkg', '/usr/bin/dnf']})", "any(File('cloudflare_ip6s.txt'), { IpInRange(evt.Overflow.Alert.Source.IP ,#)})", "any(File('cloudflare_ips.txt'), { IpInRange(evt.Overflow.Alert.Source.IP ,#)})", "any(File('ip_seo_bots.txt'), { len(#) > 0 && IpInRange(evt.Overflow.Alert.Source.IP ,#)})", "any(File('rdns_seo_bots.txt'), { len(#) > 0 && evt.Enriched.reverse_dns endsWith #})", "any(['Authentication failure', 'Password mismatch', 'password mismatch', 'auth failed', 'unknown user'], {evt.Parsed.dovecot_login_message contains #}) ? 'auth_failed' : ''", "evt.Enriched.ASNNumber", "evt.Enriched.ASNOrg", "evt.Enriched.GeoCoords", "evt.Enriched.IsInEU", "evt.Enriched.IsoCode", "evt.Enriched.MarshaledTime", "evt.Enriched.SourceRange", "evt.Enriched.reverse_dns", "evt.Enriched.reverse_dns endsWith '.ptr.discord.com.'", "evt.GetType() == 'overflow' && evt.Overflow.Alert.Remediation == true", "evt.Line.Labels.external_format == 'fastly'", "evt.Line.Labels.program", "evt.Line.Labels.type", "evt.Line.Labels.type != 'syslog'", "evt.Line.Labels.type == 'aws-alb'", "evt.Line.Labels.type == 'containerd'", "evt.Line.Labels.type == 'docker'", "evt.Line.Labels.type == 'syslog'", "evt.Line.Labels.type == 'unifi'", "evt.Line.Module", "evt.Line.Module != 'wineventlog'", "evt.Line.Module == 'wineventlog'", "evt.Line.Raw", "evt.Line.Src", "evt.Meta.error in ['user_not_found', 'invalid_user_credentials']", "evt.Meta.http_path + '?' + evt.Parsed.http_args", "evt.Meta.http_status == '200' && evt.Parsed.static_ressource == 'false' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains '&x=' && evt.Parsed.http_args contains '&y=' && evt.Parsed.http_args contains 'etag='", "evt.Meta.http_status == '403' && evt.Meta.http_verb == 'POST' && evt.Meta.http_path contains \"/Sessions/Playing/Progress\"", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_trashbin/preview' && evt.Parsed.http_args contains 'fileId=' && evt.Parsed.http_args contains '&file='", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/files_versions/preview' && evt.Parsed.http_args contains 'version'", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path contains '/apps/photos/api/v1/preview' && evt.Parsed.http_args contains 'x' && evt.Parsed.http_args contains 'y'", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path matches '\\\\/apps\\\\/files\\\\/api\\\\/v1\\\\/thumbnail\\\\/(\\\\d+)/(\\\\d+)'", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Meta.http_path startsWith '/apps/mail/api/avatars/url/'", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.file_ext == '.vcf' && evt.Parsed.http_args contains \"photo\"", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request == '/ocs/v2.php/apps/text/workspace' && evt.Parsed.http_args contains 'path=%2F'", "evt.Meta.http_status == '404' && evt.Meta.http_verb == 'GET' && evt.Parsed.request contains '/core/preview' && evt.Parsed.http_args contains 'x=' && evt.Parsed.http_args contains 'y=' && evt.Parsed.http_args contains 'fileId='", "evt.Meta.http_status == '404' && evt.Meta.http_verb in ['PROPFIND', 'GET'] && evt.Meta.http_path matches '^/remote.php/(web)?dav/'", "evt.Meta.http_status in ['404', '403', '502'] ? 'false' : 'true'", "evt.Meta.log_subtype == 'zm_bad_password'", "evt.Meta.log_subtype == 'zm_bad_user'", "evt.Meta.log_type == 'gotify_failed_auth'", "evt.Meta.log_type == \"palo_alto\" && evt.Meta.severity in [\"medium\", \"high\", \"critical\"]", "evt.Meta.log_type == 'ADMIN_LOGIN_FAILED'", "evt.Meta.log_type == 'CVE-2021-4034-xpl'", "evt.Meta.log_type == 'PAYMENT_FAILED'", "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.ASNNumber != '' ", "evt.Meta.log_type == 'PAYMENT_FAILED' and evt.Meta.IsoCode != '' ", "evt.Meta.log_type == 'adguardhome_failed_auth'", "evt.Meta.log_type == 'apache-guacamole_failed_auth'", "evt.Meta.log_type == 'asterisk_failed_auth'", "evt.Meta.log_type == 'auth_bf_attempt'", "evt.Meta.log_type == 'auth_bf_log'", "evt.Meta.log_type == 'aws-cloudtrail'", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\n (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches \".*UnauthorizedOperation$\") ||\n (evt.Unmarshaled.cloudtrail.errorCode != nil && evt.Unmarshaled.cloudtrail.errorCode matches \"^AccessDenied.*\")\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\n evt.Meta.event_name == \"DeleteGroupPolicy\" ||\n evt.Meta.event_name == \"DeleteRolePolicy\" ||\n evt.Meta.event_name == \"DeleteUserPolicy\" ||\n evt.Meta.event_name == \"PutGroupPolicy\" ||\n evt.Meta.event_name == \"PutRolePolicy\" ||\n evt.Meta.event_name == \"PutUserPolicy\" ||\n evt.Meta.event_name == \"CreatePolicy\" ||\n evt.Meta.event_name == \"DeletePolicy\" ||\n evt.Meta.event_name == \"CreatePolicyVersion\" ||\n evt.Meta.event_name == \"DeletePolicyVersion\" ||\n evt.Meta.event_name == \"AttachRolePolicy\" ||\n evt.Meta.event_name == \"DetachRolePolicy\" ||\n evt.Meta.event_name == \"AttachUserPolicy\" ||\n evt.Meta.event_name == \"DetachUserPolicy\" ||\n evt.Meta.event_name == \"AttachGroupPolicy\" ||\n evt.Meta.event_name == \"DetachGroupPolicy\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"AuthorizeSecurityGroupIngress\" ||\nevt.Meta.event_name == \"AuthorizeSecurityGroupEgress\" ||\nevt.Meta.event_name == \"RevokeSecurityGroupIngress\" ||\nevt.Meta.event_name == \"RevokeSecurityGroupEgress\" ||\nevt.Meta.event_name == \"CreateSecurityGroup\" ||\nevt.Meta.event_name == \"DeleteSecurityGroup\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateCustomerGateway\" ||\nevt.Meta.event_name == \"DeleteCustomerGateway\" ||\nevt.Meta.event_name == \"AttachInternetGateway\" ||\nevt.Meta.event_name == \"CreateInternetGateway\" ||\nevt.Meta.event_name == \"DeleteInternetGateway\" ||\nevt.Meta.event_name == \"DetachInternetGateway\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateNetworkAcl\" ||\nevt.Meta.event_name == \"CreateNetworkAclEntry\" ||\nevt.Meta.event_name == \"DeleteNetworkAcl\" ||\nevt.Meta.event_name == \"DeleteNetworkAclEntry\" ||\nevt.Meta.event_name == \"ReplaceNetworkAclEntry\" ||\nevt.Meta.event_name == \"ReplaceNetworkAclAssociation\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateRoute\" ||\nevt.Meta.event_name == \"CreateRouteTable\" ||\nevt.Meta.event_name == \"ReplaceRoute\" ||\nevt.Meta.event_name == \"ReplaceRouteTableAssociation\" ||\nevt.Meta.event_name == \"DeleteRouteTable\" ||\nevt.Meta.event_name == \"DeleteRoute\" ||\nevt.Meta.event_name == \"DisassociateRouteTable\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateTrail\" ||\nevt.Meta.event_name == \"UpdateTrail\" ||\nevt.Meta.event_name == \"DeleteTrail\" ||\nevt.Meta.event_name == \"StartLogging\" ||\nevt.Meta.event_name == \"StopLogging\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(\nevt.Meta.event_name == \"CreateVpc\" ||\nevt.Meta.event_name == \"DeleteVpc\" ||\nevt.Meta.event_name == \"ModifyVpcAttribute\" ||\nevt.Meta.event_name == \"AcceptVpcPeeringConnection\" ||\nevt.Meta.event_name == \"CreateVpcPeeringConnection\" ||\nevt.Meta.event_name == \"DeleteVpcPeeringConnection\" ||\nevt.Meta.event_name == \"RejectVpcPeeringConnection\" ||\nevt.Meta.event_name == \"AttachClassicLinkVpc\" ||\nevt.Meta.event_name == \"DetachClassicLinkVpc\" ||\nevt.Meta.event_name == \"DisableVpcClassicLink\" ||\nevt.Meta.event_name == \"EnableVpcClassicLink\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\n(evt.Meta.event_name == 'ConsoleLogin' || evt.Meta.event_name == 'GetSessionToken' || evt.Meta.event_name == 'GetFederationToken') &&\nevt.Unmarshaled.cloudtrail.responseElements?.ConsoleLogin == 'Success' &&\n(\n (evt.Time.Hour() >= 18 || evt.Time.Hour() < 6) || \n (evt.Time.Weekday().String() == 'Saturday' || evt.Time.Weekday().String() == 'Sunday')\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Meta.event_name == \"ConsoleLogin\" &&\nevt.Unmarshaled.cloudtrail.additionalEventData.MFAUsed != \"Yes\" &&\nevt.Unmarshaled.cloudtrail.userIdentity.type == \"IAMUser\" &&\nevt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == \"Success\"\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.eventSource == \"kms.amazonaws.com\" &&\n(evt.Meta.event_name == \"DisableKey\" || evt.Meta.event_name == \"ScheduleKeyDeletion\")\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.eventSource == \"s3.amazonaws.com\" &&\n(\n evt.Meta.event_name == \"PutBucketAcl\" ||\n evt.Meta.event_name == \"PutBucketPolicy\" ||\n evt.Meta.event_name == \"PutBucketCors\" ||\n evt.Meta.event_name == \"PutBucketLifecycle\" ||\n evt.Meta.event_name == \"PutBucketReplication\" ||\n evt.Meta.event_name == \"DeleteBucketPolicy\" ||\n evt.Meta.event_name == \"DeleteBucketCors\" ||\n evt.Meta.event_name == \"DeleteBucketLifecycle\" ||\n evt.Meta.event_name == \"DeleteBucketReplication\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' &&\nevt.Unmarshaled.cloudtrail.userIdentity.type == \"Root\" &&\nevt.Unmarshaled.cloudtrail.userIdentity.invokedBy == nil &&\nevt.Unmarshaled.cloudtrail.eventType != \"AwsServiceEvent\"\n", "evt.Meta.log_type == 'aws-cloudtrail' && \nevt.Meta.event_name == \"ConsoleLogin\" && \nevt.Unmarshaled.cloudtrail.errorMessage == \"Failed authentication\"\n", "evt.Meta.log_type == 'aws-cloudtrail' && \nevt.Unmarshaled.cloudtrail.eventSource == \"config.amazonaws.com\" &&\n(\n evt.Meta.event_name == \"StopConfigurationRecorder\" ||\n evt.Meta.event_name == \"DeleteDeliveryChannel\" ||\n evt.Meta.event_name == \"PutDeliveryChannel\" ||\n evt.Meta.event_name == \"PutConfigurationRecorder\"\n)\n", "evt.Meta.log_type == 'aws-cloudtrail' && (\n (evt.Meta.event_name == 'ConsoleLogin' && evt.Unmarshaled.cloudtrail.responseElements.ConsoleLogin == 'Failure') || \n (evt.Meta.event_name == 'GetSessionToken' && evt.Meta.error_code=='AccessDenied') || \n (evt.Meta.event_name == 'GetFederationToken' && evt.Meta.error_code=='AccessDenied')\n)\n", "evt.Meta.log_type == 'baikal_failed_auth'", "evt.Meta.log_type == 'bind9_denied'", "evt.Meta.log_type == 'cas_failed-auth'", "evt.Meta.log_type == 'dovecot_logs' && evt.Meta.dovecot_login_result == 'auth_failed'", "evt.Meta.log_type == 'emby_failed_auth'", "evt.Meta.log_type == 'endlessh_accept'", "evt.Meta.log_type == 'execve'", "evt.Meta.log_type == 'execve' && evt.Meta.exe == '/usr/bin/pgrep'", "evt.Meta.log_type == 'execve' && evt.Meta.exe in ['/usr/bin/rm', '/bin/rm']", "evt.Meta.log_type == 'execve' and ( evt.Meta.exe startsWith \"/tmp/\" or evt.Meta.exe contains \"/.\" )", "evt.Meta.log_type == 'exim_failed_auth'", "evt.Meta.log_type == 'ftp_failed_auth'", "evt.Meta.log_type == 'gitea_failed_auth'", "evt.Meta.log_type == 'gitlab_failed_password'", "evt.Meta.log_type == 'grafana_failed_auth'", "evt.Meta.log_type == 'harbor_failed_auth'", "evt.Meta.log_type == 'home-assistant_failed_auth'", "evt.Meta.log_type == 'http_access-log' && Upper(evt.Parsed.http_args) contains 'AUTHOR='", "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_path startsWith '/apps/login' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'", "evt.Meta.log_type == 'http_access-log' && evt.Meta.http_status in ['400','405'] && (evt.Parsed.verb == 'CONNECT' || evt.Parsed.request matches '^http[s]?://')", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'wp-login.php' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '200'", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name == 'xmlrpc.php' && evt.Parsed.verb == 'POST'", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'w00tw00t.at.ISC.SANS.DFind'", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.file_name contains 'wp-config.php'", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '401'", "evt.Meta.log_type == 'http_access-log' && evt.Parsed.verb == 'POST' && evt.Meta.http_status == '403'", "evt.Meta.log_type == 'http_error-log' && evt.Parsed.program == 'nginx'", "evt.Meta.log_type == 'immich_failed_auth'", "evt.Meta.log_type == 'iptables_drop' && evt.Meta.service == 'tcp'", "evt.Meta.log_type == 'jellyfin_failed_auth'", "evt.Meta.log_type == 'jellyseerr_failed_auth'", "evt.Meta.log_type == 'k8s-audit' &&\n(\n (\n evt.Meta.datasource_type == \"k8s-audit\" &&\n evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&\n evt.Unmarshaled.k8s_audit.RequestObject != nil &&\n evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&\n evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes != nil &&\n any(evt.Unmarshaled.k8s_audit.RequestObject.spec.volumes, { .hostPath != nil && .hostPath.path in [\"/proc\", \"/var/run/docker.sock\", \"/\", \"/etc\", \"/root\", \"/var/run/crio/crio.sock\", \"/home/admin\", \"/var/lib/kubelet\", \"/var/lib/kubelet/pki\", \"/etc/kubernetes\", \"/etc/kubernetes/manifests\"] })\n )\n ||\n (\n evt.Meta.datasource_type != \"k8s-audit\" &&\n evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&\n evt.Unmarshaled.k8s_audit.requestObject != nil &&\n evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&\n evt.Unmarshaled.k8s_audit.requestObject.spec.volumes != nil &&\n any(evt.Unmarshaled.k8s_audit.requestObject.spec.volumes, { .hostPath != nil && .hostPath.path in [\"/proc\", \"/var/run/docker.sock\", \"/\", \"/etc\", \"/root\", \"/var/run/crio/crio.sock\", \"/home/admin\", \"/var/lib/kubelet\", \"/var/lib/kubelet/pki\", \"/etc/kubernetes\", \"/etc/kubernetes/manifests\"] })\n )\n)\n", "evt.Meta.log_type == 'k8s-audit' &&\n(\n (\n evt.Meta.datasource_type == \"k8s-audit\" &&\n evt.Unmarshaled.k8s_audit.Verb == 'create' &&\n evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' &&\n evt.Unmarshaled.k8s_audit.RequestObject != nil &&\n evt.Unmarshaled.k8s_audit.RequestObject.spec != nil &&\n any(evt.Unmarshaled.k8s_audit.RequestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })\n )\n ||\n (\n evt.Meta.datasource_type != \"k8s-audit\" &&\n evt.Unmarshaled.k8s_audit.verb == 'create' &&\n evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' &&\n evt.Unmarshaled.k8s_audit.requestObject != nil &&\n evt.Unmarshaled.k8s_audit.requestObject.spec != nil &&\n any(evt.Unmarshaled.k8s_audit.requestObject.spec.containers, { .securityContext != nil && .securityContext.privileged == true })\n )\n)\n", "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.ObjectRef?.Subresource == 'exec')\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.objectRef?.subresource == 'exec')\n)\n", "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource not in [\"healthz\", \"livez\", \"readyz\"]) \n || \n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.objectRef?.resource not in [\"healthz\", \"livez\", \"readyz\"])\n)\n&& evt.Meta.user in [\"system:anonymous\", \"system:unauthenticated\"]\n", "evt.Meta.log_type == 'k8s-audit' &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.Verb == 'create' && evt.Unmarshaled.k8s_audit.ObjectRef?.Resource == 'pods' && evt.Unmarshaled.k8s_audit.RequestObject?.spec?.hostNetwork == true)\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.verb == 'create' && evt.Unmarshaled.k8s_audit.objectRef?.resource == 'pods' && evt.Unmarshaled.k8s_audit.requestObject?.spec?.hostNetwork == true)\n)\n", "evt.Meta.log_type == 'k8s-audit' &&\nevt.Meta.user startsWith \"system:serviceaccount:\" &&\n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.Annotations[\"authorization.k8s.io/decision\"] == \"forbid\")\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.annotations[\"authorization.k8s.io/decision\"] == \"forbid\")\n)\n", "evt.Meta.log_type == 'k8s-audit' && \n(\n (evt.Meta.datasource_type == \"k8s-audit\" && evt.Unmarshaled.k8s_audit.ResponseStatus.code in [401, 403])\n ||\n (evt.Meta.datasource_type != \"k8s-audit\" && evt.Unmarshaled.k8s_audit.responseStatus.code in [401, 403])\n)\n", "evt.Meta.log_type == 'mail_auth' && evt.Meta.sub_type == 'auth_fail'", "evt.Meta.log_type == 'mailu_admin_auth_attempt'", "evt.Meta.log_type == 'mariadb_failed_auth'", "evt.Meta.log_type == 'meshcentral_failed_auth'", "evt.Meta.log_type == 'mikrotik_drop' && evt.Meta.service == 'tcp_udp'", "evt.Meta.log_type == 'mikrotik_failed_auth'", "evt.Meta.log_type == 'modsecurity' && (evt.Parsed.ruleseverity == 'CRITICAL' || evt.Parsed.ruleseverity == '2')", "evt.Meta.log_type == 'mongodb_failed_auth'", "evt.Meta.log_type == 'mssql_failed_auth'", "evt.Meta.log_type == 'mysql_failed_auth'", "evt.Meta.log_type == 'nextcloud_domain_error'", "evt.Meta.log_type == 'nextcloud_failed_auth'", "evt.Meta.log_type == 'odoo_failed_auth'", "evt.Meta.log_type == 'ombi_auth_failed'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'bot protection'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site redirect'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site request forgery'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'cross site scripting'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'error disclosure'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'error limit'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'evasion techniques'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'general'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'http limit violation'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'illegal http method violation'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'ldap injection'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'open redirect'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'path traversal'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'remote code execution'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'request rate limit'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'schema validation'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'sql injection'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'url instead of file'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'vulnerability scanning'", "evt.Meta.log_type == 'openappsec_security_log' and Lower(evt.Meta.security_action) in ['prevent', 'detect'] and Lower(evt.Meta.incident_type) contains 'xml external entity'", "evt.Meta.log_type == 'opnsense-gui-failed-auth'", "evt.Meta.log_type == 'paperless_ngx_failed_auth'", "evt.Meta.log_type == 'pf' and evt.Parsed.action == 'block'", "evt.Meta.log_type == 'pf_drop' && evt.Meta.service == 'tcp_udp'", "evt.Meta.log_type == 'pftpd_failed-auth'", "evt.Meta.log_type == 'pgsql_failed_auth'", "evt.Meta.log_type == 'pterodactly_wings_invalid_format'", "evt.Meta.log_type == 'pterodactly_wings_invalid_username_or_password'", "evt.Meta.log_type == 'pve_failed-auth'", "evt.Meta.log_type == 'redmine_failed_auth'", "evt.Meta.log_type == 'smb_failed_auth'", "evt.Meta.log_type == 'spam-attempt' && evt.Meta.service == 'exim'", "evt.Meta.log_type == 'ssh_bad_keyexchange'", "evt.Meta.log_type == 'ssh_failed-auth'", "evt.Meta.log_type == 'sshesame_cmd'", "evt.Meta.log_type == 'sshesame_input'", "evt.Meta.log_type == 'sshesame_login'", "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '1'", "evt.Meta.log_type == 'suricata_alert' && evt.Parsed.proto == 'TCP' && evt.Meta.suricata_rule_severity == '2'", "evt.Meta.log_type == 'synology-dsm_failed_auth'", "evt.Meta.log_type == 'telnet_new_session'", "evt.Meta.log_type == 'thehive_failed_auth'", "evt.Meta.log_type == 'ts3_fail_auth'", "evt.Meta.log_type == 'vaultwarden_failed_auth'", "evt.Meta.log_type == 'waf_naxsi-log' && len(evt.Parsed.naxsi_id) > 4", "evt.Meta.log_type == 'webmin_failed_auth_wrong_pass'", "evt.Meta.log_type == 'windows_failed_auth'", "evt.Meta.log_type == 'wireguard_failed_auth'", "evt.Meta.log_type == 'zimbra_auth_fail'", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand \n (\n ( Upper(evt.Meta.http_verb) == \"POST\" and\n Upper(evt.Meta.http_path) matches Upper('^(?P/.*index.php)?.*(?Pfile=.*</td></tr(?P.*)>)')\n )\n or \n Upper(evt.Parsed.rawrequest) matches Upper('^(?PPOST) (?P/.*index.php)?.*(?Pfile=.*</td></tr(?P.*)>)')\n )\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand \n(\n( Upper(evt.Meta.http_verb) == \"POST\" and\nUpper(evt.Meta.http_path) matches Upper('^(?P/.*index.php)?.*(?Pview=request|request=log|task=create)+.*(?Pview=request|request=log|task=create)+.*(?Pview=request|request=log|task=create)+.*')\n\n)\nor\nUpper(evt.Parsed.rawrequest) matches Upper('^(?PPOST) (?P/.*index.php)?.*(?Pview=request|request=log|task=create)+.*(?Pview=request|request=log|task=create)+.*(?Pview=request|request=log|task=create)+.*')\n)\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"]\nand Upper(evt.Meta.http_verb) == \"GET\"\nand Upper(evt.Meta.http_path) matches Upper('.*action=.*')\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] && RegexpInFile(evt.Parsed.http_user_agent, \"bad_user_agents.regex.txt\")", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and\n (Upper(evt.Meta.http_path) contains 'CLASS.MODULE.CLASSLOADER.')\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n (\n Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/..;/tmui/[^.]+.jsp\\\\?(fileName|command|directoryPath|tabId)=')\n or\n Upper(evt.Meta.http_path) matches Upper('/tmui/login.jsp/%2E%2E;/tmui/[^.]+.jsp\\\\?(fileName|command|directoryPath|tabId)=')\n )\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n (Upper(evt.Meta.http_path) contains \"/.%2E/.%2E/\"\n or\n Upper(evt.Meta.http_path) contains \"/%2E%2E/%2E%2E\")\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n (Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/../[./]+/'\n or\n Upper(evt.Meta.http_path) matches '/PUBLIC/PLUGINS/[^/]+/%2E%2E/[%2E/]+/')\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n (Upper(evt.Meta.http_path) matches Upper('/dana-na/../dana/html5acc/guacamole/../../../../../../../[^?]+\\\\?/dana/html5acc/guacamole/')\n or\n Upper(evt.Meta.http_path) matches Upper('/dana-na/%2E%2E/dana/html5acc/guacamole/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/[^?]+\\\\?/dana/html5acc/guacamole/'))\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n Upper(evt.Meta.http_path) contains \"/%%32%65%%32%65/\"\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n Upper(evt.Meta.http_path) contains Upper('/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession')\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \n(\n any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Meta.http_path) contains Upper(#)})\nor\n any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Parsed.http_user_agent) contains Upper(#)})\nor\n any(File(\"log4j2_cve_2021_44228.txt\"), { Upper(evt.Parsed.http_referer) contains Upper(#)}) \n)\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and \nUpper(evt.Meta.http_path) startsWith Upper('/api/v2/cmdb/system/admin/') and Lower(evt.Parsed.http_user_agent) == 'report runner'\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"backdoors.txt\"), { evt.Parsed.file_name == #})", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"jira_cve_2021-26086.txt\"), {Upper(evt.Meta.http_path) contains Upper(#)})\n", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"sensitive_data.txt\"), { evt.Parsed.request endsWith #})", "evt.Meta.log_type in [\"http_access-log\", \"http_error-log\"] and any(File(\"thinkphp_cve_2018-20062.txt\"), {Upper(evt.Meta.http_path) matches Upper(#)})\n", "evt.Meta.log_type in ['authelia_failed_clf_auth', 'authelia_failed_json_auth']", "evt.Meta.log_type in ['baikal_failed_auth', 'baikal_failed_auth_no_user']", "evt.Meta.log_type in ['bitwarden_failed_auth','bitwarden_failed_auth_2fa']", "evt.Meta.log_type in ['gitlab_failed_password', 'gitlab_failed_totp']", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Lower(QueryUnescape(evt.Meta.http_path)) startsWith Lower('/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=')\n", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Upper(QueryUnescape(evt.Meta.http_path)) startsWith Upper('/Telerik.Web.UI.WebResource.axd?type=rau')\n", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && Upper(QueryUnescape(evt.Meta.http_path)) startsWith Upper('/catalog-portal/ui/oauth/verify?error=&deviceUdid=${\"freemarker.template.utility.Execute\"?new()(')\n", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('http_path_traversal.txt'),{evt.Meta.http_path contains #})", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('sqli_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && any(File('xss_probe_patterns.txt'), {Upper(evt.Parsed.http_args) contains Upper(#)})", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Meta.http_path matches '/ui/vcav-bootstrap/rest/vcav-providers/provider-logo\\\\?url=(file|http)'\n", "evt.Meta.log_type in ['http_access-log', 'http_error-log'] && evt.Parsed.static_ressource == 'false' && evt.Parsed.verb in ['GET', 'HEAD']", "evt.Meta.log_type in ['nextcloud_failed_auth', 'nextcloud_bruteforce_attempt']", "evt.Meta.log_type in ['prowlarr_failed_authentication']", "evt.Meta.log_type in ['radarr_failed_authentication']", "evt.Meta.log_type in ['sonarr_failed_authentication']", "evt.Meta.log_type in ['uptime_kuma_failed_password', 'uptime_kuma_failed_totp']", "evt.Meta.log_type in ['vaultwarden_failed_auth', 'vaultwarden_failed_admin_auth', 'vaultwarden_failed_totp']", "evt.Meta.log_type_enh == 'spam-attempt' || evt.Meta.log_type == 'postfix' && evt.Meta.action == 'reject'", "evt.Meta.metric_name in ['account.login.failed_invalid_user', 'account.login.failed_invalid_password']", "evt.Meta.ppid", "evt.Meta.service == 'exchange' && evt.Meta.sub_type == 'auth_fail'", "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'acl_reject'", "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'auth_failure'", "evt.Meta.service == 'freeswitch' && evt.Meta.sub_type == 'user_enumeration'", "evt.Meta.service == 'http' && evt.Meta.http_status in ['404', '403', '400'] && evt.Parsed.static_ressource == 'false'", "evt.Meta.service == 'http' && evt.Meta.log_type in ['http_access-log', 'http_error-log']", "evt.Meta.service == 'http' && evt.Meta.sub_type == 'auth_fail'", "evt.Meta.service == 'http' && evt.Meta.sub_type == 'litespeed_admin_auth_fail'", "evt.Meta.service == 'llng' and evt.Meta.log_type == 'llng_auth_fail'", "evt.Meta.service == 'postscreen' && evt.Meta.pregreet == 'PREGREET'", "evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' &&\nevt.Parsed.ParentImage endsWith \"\\\\svchost.exe\" &&\nevt.Parsed.Image endsWith \"\\\\rundll32.exe\" &&\nevt.Parsed.CommandLine contains \"C:\\\\windows\\\\system32\\\\davclnt.dll,DavSetCookie\" &&\nevt.Parsed.CommandLine matches '://\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}\\\\.\\\\d{1,3}' &&\n(not (evt.Parsed.CommandLine contains \"://10.\" ||\n evt.Parsed.CommandLine contains \"://192.168.\" ||\n evt.Parsed.CommandLine contains \"://172.16.\" ||\n evt.Parsed.CommandLine contains \"://172.17.\" ||\n evt.Parsed.CommandLine contains \"://172.18.\" ||\n evt.Parsed.CommandLine contains \"://172.19.\" ||\n evt.Parsed.CommandLine contains \"://172.20.\" ||\n evt.Parsed.CommandLine contains \"://172.21.\" ||\n evt.Parsed.CommandLine contains \"://172.22.\" ||\n evt.Parsed.CommandLine contains \"://172.23.\" ||\n evt.Parsed.CommandLine contains \"://172.24.\" ||\n evt.Parsed.CommandLine contains \"://172.25.\" ||\n evt.Parsed.CommandLine contains \"://172.26.\" ||\n evt.Parsed.CommandLine contains \"://172.27.\" ||\n evt.Parsed.CommandLine contains \"://172.28.\" ||\n evt.Parsed.CommandLine contains \"://172.29.\" ||\n evt.Parsed.CommandLine contains \"://172.30.\" ||\n evt.Parsed.CommandLine contains \"://172.31.\" ||\n evt.Parsed.CommandLine contains \"://127.\" ||\n evt.Parsed.CommandLine contains \"://169.254.\"))\n", "evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1' && \nUpper(evt.Parsed.Image) endsWith 'MSDT.EXE' && \nUpper(evt.Parsed.ParentImage) endsWith 'WINWORD.EXE' &&\n(Upper(evt.Parsed.CommandLine) contains 'PCWDIAGNOSTIC' && Upper(evt.Parsed.CommandLine) contains 'IT_REBROWSEFORFILE' && Upper(evt.Parsed.CommandLine) contains 'IT_BROWSEFORFILE')\n", "evt.Meta.service in [\"tcp\", \"udp\"] && evt.Unmarshaled.iptables.OUT == \"\" ? \"iptables_drop\" : \"\"", "evt.Meta.source_ip", "evt.Meta.sub_type == 'req_limit_exceeded'", "evt.Meta.target_user", "evt.Meta.user_arn", "evt.Overflow.Alert.GetScenario() == 'crowdsecurity/auditd-sus-exec' && all(evt.Overflow.Alert.Events, {.GetMeta('exe') matches '\\\\.nvm\\\\/versions\\\\/node\\\\/v(\\\\d+)\\\\.(\\\\d+)\\\\.(\\\\d+)\\\\/bin\\\\/node$'})", "evt.Overflow.Alert.Remediation == true && IsIPV6(evt.Overflow.Alert.Source.IP)", "evt.Overflow.Alert.Remediation == true && evt.Overflow.Alert.GetScope() == 'Ip'", "evt.Overflow.Alert.Source.IP", "evt.Parsed.Channel == 'Application' && evt.Parsed.Source == 'MSSQLSERVER' && evt.Parsed.EventID == '18456'", "evt.Parsed.Channel == 'Microsoft-Windows-Sysmon/Operational'", "evt.Parsed.Channel == 'Security' && evt.Parsed.EventID == '4625'", "evt.Parsed.User", "evt.Parsed.action", "evt.Parsed.app", "evt.Parsed.asterisk_service", "evt.Parsed.asterisk_session_id", "evt.Parsed.auth_method", "evt.Parsed.auth_result", "evt.Parsed.cas_client_ip", "evt.Parsed.cas_invalid_user", "evt.Parsed.client", "evt.Parsed.client_ip", "evt.Parsed.clientip", "evt.Parsed.cri_timestamp", "evt.Parsed.date", "evt.Parsed.date + ' ' + evt.Parsed.time", "evt.Parsed.datetime", "evt.Parsed.day + \" \" + evt.Parsed.month + \" \" + evt.Parsed.monthday + \" \" + evt.Parsed.time + \".000000\" + \" \" + evt.Parsed.year", "evt.Parsed.db_name", "evt.Parsed.dest_ip", "evt.Parsed.dest_port", "evt.Parsed.dovecot_remote_ip", "evt.Parsed.dst_country", "evt.Parsed.dst_port", "evt.Parsed.elb_status_code", "evt.Parsed.email", "evt.Parsed.error", "evt.Parsed.event_inc_id", "evt.Parsed.fastly_timestamp + \".00+\" + evt.Parsed.tz_part1 + \":\" + evt.Parsed.tz_part2", "evt.Parsed.file_frag + evt.Parsed.file_ext", "evt.Parsed.haproxy_monthday + '/' + evt.Parsed.haproxy_month + '/' + evt.Parsed.haproxy_year + ':' + evt.Parsed.haproxy_hour + ':' + evt.Parsed.haproxy_minute + ':' + evt.Parsed.haproxy_second[0:2] + ' -0000'", "evt.Parsed.http_path", "evt.Parsed.http_request", "evt.Parsed.http_status_code", "evt.Parsed.http_user_agent", "evt.Parsed.http_verb", "evt.Parsed.invalid_user", "evt.Parsed.ipAddress", "evt.Parsed.ip_source", "evt.Parsed.log_level", "evt.Parsed.logsource", "evt.Parsed.message contains 'PVEFW-reject' or evt.Parsed.message contains 'DROP' or evt.Parsed.message contains 'REJECT'", "evt.Parsed.method", "evt.Parsed.naxsi_src_ip", "evt.Parsed.pgsql_dbname", "evt.Parsed.pgsql_target_user", "evt.Parsed.pregreet", "evt.Parsed.program == \"gotify\"", "evt.Parsed.program == \"suricata-evelogs\" && JsonExtract(evt.Parsed.message, \"event_type\") == \"alert\"\n", "evt.Parsed.program == \"zoneminder\"", "evt.Parsed.program == 'Prowlarr'", "evt.Parsed.program == 'Radarr'", "evt.Parsed.program == 'adguardhome'", "evt.Parsed.program == 'apache-guacamole'", "evt.Parsed.program == 'asterisk'", "evt.Parsed.program == 'audit'", "evt.Parsed.program == 'auditd'", "evt.Parsed.program == 'authelia'", "evt.Parsed.program == 'aws-cloudtrail'", "evt.Parsed.program == 'bitwarden'", "evt.Parsed.program == 'cas'", "evt.Parsed.program == 'cowrie'", "evt.Parsed.program == 'cpanel'", "evt.Parsed.program == 'dovecot'", "evt.Parsed.program == 'dropbear'", "evt.Parsed.program == 'emby'", "evt.Parsed.program == 'endlessh'", "evt.Parsed.program == 'exchange-imap'", "evt.Parsed.program == 'exchange-pop'", "evt.Parsed.program == 'exchange-smtp'", "evt.Parsed.program == 'exim'", "evt.Parsed.program == 'filterlog' or evt.Parsed.message matches '^filterlog:'", "evt.Parsed.program == 'gitea'", "evt.Parsed.program == 'grafana'", "evt.Parsed.program == 'harbor'", "evt.Parsed.program == 'home-assistant' or evt.Parsed.program endsWith 'homeassistant'", "evt.Parsed.program == 'iis'", "evt.Parsed.program == 'immich'", "evt.Parsed.program == 'jellyfin'", "evt.Parsed.program == 'jellyseerr'", "evt.Parsed.program == 'k8s-audit'", "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'IN=' and not (evt.Parsed.message contains 'ACCEPT')", "evt.Parsed.program == 'kernel' and evt.Parsed.message contains 'wireguard:'", "evt.Parsed.program == 'keycloak'", "evt.Parsed.program == 'laurel'", "evt.Parsed.program == 'litespeed'", "evt.Parsed.program == 'magento-extension'", "evt.Parsed.program == 'mailu-admin'", "evt.Parsed.program == 'meshcentral'", "evt.Parsed.program == 'mikrotik'", "evt.Parsed.program == 'modsecurity'", "evt.Parsed.program == 'mssql'", "evt.Parsed.program == 'mysql'", "evt.Parsed.program == 'odoo'", "evt.Parsed.program == 'ombi'", "evt.Parsed.program == 'openappsec' && JsonExtract(evt.Parsed.message, 'eventAudience') == 'Security' && Lower(JsonExtract(evt.Parsed.message, 'eventSeverity')) in ['critical', 'high'] && Lower(JsonExtract(evt.Parsed.message, 'eventData.practiceSubType')) in ['web application','web api']", "evt.Parsed.program == 'palo-alto-threat'", "evt.Parsed.program == 'pkexec'", "evt.Parsed.program == 'postgres'", "evt.Parsed.program == 'proftpd'", "evt.Parsed.program == 'pterodactyl'", "evt.Parsed.program == 'pure-ftpd'", "evt.Parsed.program == 'pvedaemon'", "evt.Parsed.program == 'redmine'", "evt.Parsed.program == 'smb'", "evt.Parsed.program == 'sshd'", "evt.Parsed.program == 'sshesame'", "evt.Parsed.program == 'sudo'", "evt.Parsed.program == 'suricata-fastlogs'", "evt.Parsed.program == 'tcpdump'", "evt.Parsed.program == 'thehive'", "evt.Parsed.program == 'ts3'", "evt.Parsed.program == 'vsftpd'", "evt.Parsed.program == 'windows-firewall' and evt.Parsed.message contains ' DROP TCP ' and evt.Parsed.message contains ' RECEIVE'", "evt.Parsed.program in ['LLNG','lemonldap-ng']", "evt.Parsed.program in ['mono', 'Sonarr']", "evt.Parsed.program in ['postfix/postscreen', 'haproxy/postscreen']", "evt.Parsed.program in ['postfix/smtpd','postfix/smtps/smtpd','postfix/submission/smtpd', 'postfix/smtps-haproxy/smtpd', 'postfix/submission-haproxy/smtpd']", "evt.Parsed.program matches 'synoscgi_SYNO.API.Auth_[1-9]([0-9])?_login'", "evt.Parsed.program startsWith 'apache2'", "evt.Parsed.program startsWith 'caddy'", "evt.Parsed.program startsWith 'freeswitch'", "evt.Parsed.program startsWith 'haproxy'", "evt.Parsed.program startsWith 'kasm'", "evt.Parsed.program startsWith 'mariadb'", "evt.Parsed.program startsWith 'nginx'", "evt.Parsed.program startsWith 'nginx-proxy-manager'", "evt.Parsed.program startsWith 'traefik'", "evt.Parsed.program startsWith 'zimbra'", "evt.Parsed.rbl_url", "evt.Parsed.remote_addr", "evt.Parsed.remote_host", "evt.Parsed.remote_ip", "evt.Parsed.remote_user", "evt.Parsed.request", "evt.Parsed.request_creation_time", "evt.Parsed.response", "evt.Parsed.rule", "evt.Parsed.rule_id", "evt.Parsed.ruledata", "evt.Parsed.ruleid", "evt.Parsed.rulemessage", "evt.Parsed.severity", "evt.Parsed.smtp_message", "evt.Parsed.source_dns", "evt.Parsed.source_helo", "evt.Parsed.source_ip", "evt.Parsed.source_rdns", "evt.Parsed.source_user", "evt.Parsed.sourcehost", "evt.Parsed.src_country", "evt.Parsed.src_ip", "evt.Parsed.sshd_client_ip", "evt.Parsed.sshd_invalid_user", "evt.Parsed.sshesame_cmd", "evt.Parsed.sshesame_input", "evt.Parsed.sshesame_user", "evt.Parsed.status", "evt.Parsed.suricata_rule_severity", "evt.Parsed.syslog_timestamp", "evt.Parsed.target_fqdn", "evt.Parsed.target_ip", "evt.Parsed.target_port", "evt.Parsed.target_uri", "evt.Parsed.target_user", "evt.Parsed.tcpflags contains 'S' ? 'true' : 'false'", "evt.Parsed.telnet_session", "evt.Parsed.threat_id", "evt.Parsed.time", "evt.Parsed.time + 'Z'", "evt.Parsed.time_local", "evt.Parsed.timestamp", "evt.Parsed.timestamp + \"Z\"", "evt.Parsed.timestamp8601", "evt.Parsed.traefik_router_name", "evt.Parsed.unix_epoch", "evt.Parsed.user", "evt.Parsed.user_agent", "evt.Parsed.username", "evt.Parsed.verb", "evt.Parsed.year+ \"/\" + evt.Parsed.month + \"/\" + evt.Parsed.day + \" \" + evt.Parsed.time", "evt.StrTime", "evt.StrTime != ''", "evt.Unmarshaled.auditd.auid", "evt.Unmarshaled.auditd.exe", "evt.Unmarshaled.auditd.msg", "evt.Unmarshaled.auditd.ppid", "evt.Unmarshaled.auditd.tty", "evt.Unmarshaled.auditd.uid", "evt.Unmarshaled.cloudtrail.awsRegion", "evt.Unmarshaled.cloudtrail.errorCode", "evt.Unmarshaled.cloudtrail.eventID", "evt.Unmarshaled.cloudtrail.eventName", "evt.Unmarshaled.cloudtrail.eventSource", "evt.Unmarshaled.cloudtrail.eventTime", "evt.Unmarshaled.cloudtrail.userAgent", "evt.Unmarshaled.cloudtrail.userIdentity.accountId", "evt.Unmarshaled.cloudtrail.userIdentity.type", "evt.Unmarshaled.cloudtrail.userIdentity?.arn ?? evt.Unmarshaled.cloudtrail.userIdentity.userName\n", "evt.Unmarshaled.iptables.CODE", "evt.Unmarshaled.iptables.DPT", "evt.Unmarshaled.iptables.DST", "evt.Unmarshaled.iptables.IN", "evt.Unmarshaled.iptables.LEN", "evt.Unmarshaled.iptables.PROTO", "evt.Unmarshaled.iptables.SPT", "evt.Unmarshaled.iptables.SRC", "evt.Unmarshaled.iptables.TYPE", "evt.Unmarshaled.k8s_audit.ObjectRef?.Name", "evt.Unmarshaled.k8s_audit.ObjectRef?.Namespace", "evt.Unmarshaled.k8s_audit.RequestObject?.kind", "evt.Unmarshaled.k8s_audit.RequestReceivedTimestamp", "evt.Unmarshaled.k8s_audit.SourceIPs[0]", "evt.Unmarshaled.k8s_audit.User.username", "evt.Unmarshaled.k8s_audit.objectRef?.name", "evt.Unmarshaled.k8s_audit.objectRef?.namespace", "evt.Unmarshaled.k8s_audit.requestObject?.kind", "evt.Unmarshaled.k8s_audit.requestReceivedTimestamp", "evt.Unmarshaled.k8s_audit.sourceIPs[0]", "evt.Unmarshaled.k8s_audit.user.username", "evt.Unmarshaled.laurel.ID", "evt.Unmarshaled.laurel.SYSCALL.PPID.exe", "evt.Unmarshaled.laurel.SYSCALL.SYSCALL", "evt.Unmarshaled.laurel.SYSCALL.exe", "evt.Unmarshaled.laurel.SYSCALL.tty", "evt.Unmarshaled.traefik.ClientHost", "evt.Unmarshaled.traefik.DownstreamContentSize != nil ? int(evt.Unmarshaled.traefik.DownstreamContentSize) : nil", "evt.Unmarshaled.traefik.RequestAddr", "evt.Unmarshaled.traefik.RequestMethod", "evt.Unmarshaled.traefik.RequestPath", "evt.Unmarshaled.traefik.RouterName", "evt.Unmarshaled.traefik.ServiceAddr != nil ? Split(evt.Unmarshaled.traefik.ServiceAddr, ':')[0] : nil", "evt.Unmarshaled.traefik.time", "evt.Unmarshaled.traefik[\"request_User-Agent\"]", "filter(JsonExtractSlice(evt.Parsed.message, \"params\"), {.key == 'user' && .value.login != ''})[0]['value']['login']", "int(evt.Unmarshaled.laurel.SYSCALL.auid)", "int(evt.Unmarshaled.laurel.SYSCALL.ppid)", "int(evt.Unmarshaled.laurel.SYSCALL.uid)", "int(evt.Unmarshaled.traefik.DownstreamStatus)", "int(evt.Unmarshaled.traefik.Duration)", "len(evt.Parsed.http_args)" ]