promotions

CrowdStrike External Alerts

Sep 2, 2025 · Data Source: Crowdstrike Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each CrowdStrike alert written to the configured indices. Enabling this rule allows you to immediately begin investigating CrowdStrike alerts in the app.

Elastic Security External Alerts

Aug 5, 2025 · Data Source: Elastic Security Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each Elastic Security alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Elastic Security alerts in the app.

Google SecOps External Alerts

Aug 4, 2025 · Data Source: Google SecOps Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each Google SecOps alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Google SecOps alerts in the app.

Microsoft Sentinel External Alerts

Aug 4, 2025 · Data Source: Microsoft Sentinel Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each Microsoft Sentinel alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Microsoft Sentinel alerts in the app.

SentinelOne Alert External Alerts

Aug 4, 2025 · Data Source: SentinelOne Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each SentinelOne alert written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne alerts in the app.

SentinelOne Threat External Alerts

Aug 4, 2025 · Data Source: SentinelOne Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each SentinelOne threat written to the configured indices. Enabling this rule allows you to immediately begin investigating SentinelOne threat alerts in the app.

Splunk External Alerts

Aug 4, 2025 · Data Source: Splunk Use Case: Threat Detection Resources: Investigation Guide Promotion: External Alerts ·

Share on:

Generates a detection alert for each Splunk alert written to the configured indices. Enabling this rule allows you to immediately begin investigating Splunk alerts in the app.

Adversary Behavior - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Resources: Investigation Guide ·

Share on:

Elastic Endgame detected an Adversary Behavior. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Credential Dumping - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Elastic Endgame detected Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Credential Dumping - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented Credential Dumping. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Credential Manipulation - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame detected Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Credential Manipulation - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented Credential Manipulation. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Exploit - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Execution Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame detected an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Exploit - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Execution Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented an Exploit. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

External Alerts

Mar 27, 2025 · OS: Windows Data Source: APM OS: macOS OS: Linux Resources: Investigation Guide ·

Share on:

Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.

Malware - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Resources: Investigation Guide ·

Share on:

Elastic Endgame detected Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Malware - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented Malware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Permission Theft - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame detected Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Permission Theft - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented Permission Theft. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Process Injection - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame detected Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Process Injection - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Use Case: Threat Detection Tactic: Privilege Escalation Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented Process Injection. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Ransomware - Detected - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Resources: Investigation Guide ·

Share on:

Elastic Endgame detected ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.

Ransomware - Prevented - Elastic Endgame

Mar 27, 2025 · Data Source: Elastic Endgame Resources: Investigation Guide ·

Share on:

Elastic Endgame prevented ransomware. Click the Elastic Endgame icon in the event.module column or the link in the rule.reference column for additional information.