synoti logosynoti logo
Overview

Detection Rules

Unified Security Stack includes a comprehensive library of 622 built-in detection rules that constantly watch your environment for threats, suspicious behavior, and policy violations. These rules draw on the Unified Security Stack correlation engine and align directly with the MITRE ATT&CK framework.

Detection Rules Refer to What They Are

Detection rules are YAML-based definitions that identify particular patterns of malicious or suspicious activity in your log sources. When incoming events meet a rule's conditions, Unified Security Stack produces an alert with the relevant severity, MITRE ATT&CK classification, and recommended next actions.

Each rule includes:

  • Name A clear, readable name that explains what the rule identifies.

  • Description A description of the threat situation and why it is important.

  • Category — The MITRE ATT&CK tactic, for example Credential Access, Lateral Movement, or Persistence.

  • Technique The exact MITRE ATT&CK technique identifier and its name.

  • Impact — A score for Confidentiality, Integrity, and Availability on a 1-3 scale.

  • Detection Logic The criteria and event sequences that cause the rule to fire.

  • References References to MITRE ATT&CK pages and additional resources.

Supported Data Sources

Rules are grouped by the data source or integration they cover. Unified Security Stack offers detection rules in the categories below:

Endpoint and Operating Systems

  • Windows — Active Directory attacks, credential theft, ransomware, lateral movement, among others.

  • Linux — Brute force attacks, kernel module tampering, reverse shells, and privilege escalation across the General, Debian, and RHEL families.

  • macOS — Mechanisms for persistence, privilege escalation, keychain access, and signs of malware.

Network Security

  • Cisco — Rules for ASA, Firepower, Meraki, and Switch that cover firewall events, intrusion detection, and network anomalies.

  • Fortinet — FortiGate and FortiWeb rules that address firewall and web application firewall events.

  • Palo Alto — PA Firewall rules for detecting threats and traffic anomalies.

  • SonicWall Rules for firewalls covering intrusion and access control events.

  • pfSense Firewall rules intended for open-source firewall installations.

  • MikroTik Firewall rules for network devices that run RouterOS.

Cloud Platforms

  • AWS — 73 rules spanning IAM, S3, EC2, CloudTrail, GuardDuty, and others.

  • Azure — 46 rules addressing events in identity, storage, compute, and security center.

  • Google Cloud A set of 34 rules spanning IAM, compute, storage, and audit logs.

SaaS and Productivity

  • Office 365 — 54 rules for events in Exchange, SharePoint, Teams, and Azure AD.

  • GitHub — Security for repositories, workflow injection, secret scanning, and access control.

Antivirus and EDR

  • Bitdefender GravityZone, ESMC/ESET, Kaspersky, SentinelOne, Deceptive Bytes Detection of threats, agent tampering, and policy violations.

  • CrowdStrike — Detection alerts from Falcon EPP and XDR, credential dumping, and defense evasion.

Network Monitoring

  • Netflow — Analysis of traffic, detection of beaconing, cryptomining, DDoS, and data exfiltration.

  • NIDS / Suricata Signatures and alerts for network intrusion detection.

Infrastructure

  • VMware ESXi Hypervisor security events and anomalies affecting virtual machines.

  • IBM AIX and AS/400 Security events from mainframe and midrange systems.

  • Sophos Events from Central and XG Firewall.

Log Formats

  • Syslog / CEF Analysis of logs in Common Event Format.

  • JSON Input General rules for log sources based on JSON.

How Rules Work

  1. Log Ingestion — Unified Security Stack gathers logs from the data sources you have configured.

  2. Normalization — Logs undergo parsing and normalization into the Unified Security Stack standard event schema.

  3. Correlation — The correlation engine checks every event against all active rules.

  4. Alert Generation — Once a rule's conditions are satisfied, an alert is generated with complete context.

  5. Response — Alerts may initiate automated response actions through the SOAR module.

Rule Source Code

Detection rules ship with the platform and are maintained as part of Unified Security Stack.

Browse the pages in this section to see every rule organized by category, with descriptions, MITRE ATT&CK mappings, impact scores, and reference details.

Creating Custom Rules

Unified Security Stack enables custom detection rules. To learn how to write your own rules, see the SIEM section under Configuration and Implementation for the rule authoring guide, CEL overloads reference, and practical examples.