Suspicious Activity Content Pack

Views

A high-level overview of suspicious events.

• Suspicious Activity Overview
• Network Flow Baseline

Watchlists

Prevents authorized network vulnerability scanning devices from triggering correlation rules.

• Recon - Network Scan Devices

Correlation Rules

Can be used to link different suspicious events together into meaningful intelligence.

• Suspicious Activity - Internal Device Communicating with External Device over Tor Ports
• Suspicious Activity - IRC Communication with Suspicious Host
• Suspicious Activity - Possible WannaCry Ransomware
• Suspicious Activity - WannaCry File Extensions
• Suspicious Activity - Windows Backup Canceled and Deleted
• Recon - Horizontal SMB Scan - Events or Flows