New-Scale Security Operations PlatformNew-Scale Security Operations Platform Release Notes

REST API Context Tables in the Context Management Guide.

Configure the REST API Context Cloud Collector in the Get Started with Collector Onboarding Guide.

timeofday() – Evaluates the time of day of the event time as hours after midnight, including fractions.

timeofweek() – Evaluates the day of the week of the event time as a number between 0 and 6, including fractions.

timeofmonth() – Evaluates the day of the month of the event time as a number between 0 and 30, including fractions.

Prof-PLA-Loc-U-LocDoor – This is the first time this user has physically accessed this door.

Prof-GMA-GN-O-GN – This is the first time a user has been added to this group.

Prof-USB-E-O-SE – This is the first time a peripheral device activity has been observed from this endpoint.

Prof-FPM-CloudACL-B-U – This is the first time this user has modified the ACL of a cloud storage object in this bucket.

Prof-DllLoad-Ext-SE-FileExt – This is the first time a DLL image file with this extension was loaded on this endpoint.

Prof-PwdChkout-SV-U-SV – This is the first time this user retrieved a password from this safe.

Prof-VPNIn-E-UD-SE – This is the first time a user in this department attempted to log into a VPN from this endpoint. These events may include both failed and successful logins.

Prof-Fwrite-U-O-U-Plist – This is the first time a plist file was created by this user.

Prof-EL-EDC-U-SZ – This is the first time an endpoint login event to a domain controller has been observed originating from this network zone for this user. These events may include both failed and successful logins.

Prof-WinSC-E-O-DE – This is the first time a service creation has been observed on this endpoint.

Prof-PC-CmdArgs-InstallUtil-O-DLLParam – This is the first time the 'installutil.exe' process has been executed with this DLL file as a parameter.

Prof-DB-U-DBN-U – This is the first time a database event in this database has been observed for this user. A database event consists of any event or operation performed on a database. These events may include both failed and successful operations.

Prof-PCwmic-IR-O-U-usr – This is the first time a user account has been renamed using 'wmic.exe' for this user.

Prof-CPM-AzureRoleAssign-O-U – This is the first time this user assigned Azure roles. Roles can be manipulated for privilege escalation and persistence, and should not be managed by every user.

Prof-BPM-U-PBPolicy-O-U – This is the first time this user has successful edited the IAM policy of a bucket in AWS. IAM bucket policies determine the access users and other identities have to the files and objects inside the storage bucket.

Prof-EL-NTLM-O-SE – This is the first time a successful NTLM login has been observed from this endpoint.

Prof-CPM-DestUT-U-DestUT – This is the first time a member with this user type was successfully granted IAM permissions in a GCP policy. IAM policies determine the roles and permissions granted to users on a resource.

Prof-EMS-FileExt-U-FileExt – This is the first time this user has sent an email attachment with this extension.

Prof-GMA-OU-GN-UOU – This is the first time a user in this OU has been added to this group.

Prof-RegA-PP-O-PP – This is the first time this process has performed a registry activity.

Prof-CPM-Resource-O-R – This is the first time an IAM policy of a resource in this directory has been successfully modified in GCP. IAM policies determine the roles and permissions granted to users on a resource.

Prof-SA-Elbl-DZ-Dlbl – This is the first time a security alert triggered on a server for this destination network zone.

Prof-PCnet-U-O-U-netuser – This is the first time a user account has been enabled or disabled using 'net.exe' for this user.

Prof-EMR-FileExt-O-FileExt – This is the first time a user in the organization has received an email attachment with this extension.

Prof-SA-AS-SE-AS – This is the first time a security alert with this subject triggered from this endpoint.

Prof-RegW-Services-O-U – This is the first time this user has modified or created a service by writing a registry key\value under the key 'HKLM\SYSTEM\CurrentControlSet\Services'.

NumSP-Web-AIA-U-AILLMBytesOut – An abnormal volume of outbound data to AI/LLM web applications has been observed for this user.

Prof-GA-OS-U-OS – This is the first time this operating system has been observed for this user.

Prof-SA-U-O-UD – This is the first time a security alert triggered for users in this department.

Prof-GMA-U-O-UD – This is the first time a user has been added to a group by a user in this department.

Prof-FUpld-E-O-SE – This is the first time a file has been uploaded from this endpoint.

Prof-PC-U-O-USudo – This is the first time a process execution of a 'sudo' (Superuser Do) command has been observed for this user.

Prof-EMR-ED-O-ED – This is the first time a user from the organization has received an email from this email domain.

Prof-DS-E-O-SZ – This is the first time a user in the organization performed an activity on a directory service object from this network zone.

Prof-DS-E-U-SZ – This is the first time this user performed an activity on a directory service object from this network zone.

Prof-UCreate-DC-U-DC – This is the first time this domain controller has processed a user creation request for this user.

Prof-AuditPolicyMod-E-O-SE – This is the first time an audit policy modification has been observed from this endpoint. These events may include both failed and successful modifications.

Prof-MPermMod-U-O-U – This is the first time this user has modified permissions in a mailbox.

Prof-BC-U-O-U – This is the first time this user has successfully created a cloud storage bucket.

Prof-RA-U-O-U – This is the first time this user assumed a role.

Prof-USB-U-O-U – This is the first time a peripheral device activity has been observed for this user.

Prof-FPM-PublicCloud-P-U – This is the first time this user modified a cloud storage object to become public. By manipulating file permissions to make the object public, attackers can expose the data of important or sensitive files, making them available to read, download or even modify by everyone.

Prof-CA-IRC-O-U – This is the first time this user executed a remote command on an instance. These events may include both failed and successful executions.

Prof-RegR-SAM-O-U – This is the first time this user has read a registry value under the SAM registry key.

Prof-PC-E-O-SE-Modprobe – This is the first time a process execution of a 'modprobe' (Module Probe, a kernel module management tool) command has been observed on this endpoint.

Prof-PCnet-U-O-U-netuserdel – This is the first time a user account has been deleted using 'net.exe' for this user.

Prof-SA-DP-O-DP – This is the first time a network alert on this port has been triggered in the organization.

Prof-Fwrite-AuditRule-O-U – This is the first time an audit rule file has been modified by this user.

Prof-USB-DevId-UD-DevId – This is the first time this peripheral device ID has been observed for users in this department.

Prof-SA-AN-SZ-AN – This is the first time this security alert triggered in this network zone.

Prof-PLA-Loc-U-LocBldg – This is the first time this user has physically accessed this building.

Prof-RegW-CORPROFILER-O-U – This is the first time this user has modified or created a registry value for an environment variable associated with the COR_PROFILER.

Prof-RegD-Services-O-U – This is the first time this user has deleted a service by deleting a registry key\value under the key 'HKLM\SYSTEM\CurrentControlSet\Services'.

Prof-UCreate-Dom-U-DDom – This is the first time this user has created a user account on this domain.

Prof-RA-R-UDPlt-RN – This is the first time this role was assigned by users in this department on this platform.

Prof-EMS-FileExt-UD-FileExt – This is the first time a user in this department has sent an email attachment with this extension.

Prof-Fwrite-E-O-DE-Xdg – This is the first time a XDG autostart file was created on this endpoint.

Prof-LogCl-U-O-U – This is the first time an audit log has been cleared by this user.

Prof-DS-E-O-SE – This is the first time a user in the organization performed an activity on a directory service object from this endpoint.

Prof-CA-IC-Publisher-O-Publisher – This is the first time this image publisher has been observed in a successful virtual machine image creation for the organization.

Prof-SA-AN-SE-AN – This is the first time this security alert triggered from this endpoint.

Prof-RA-R-UPlt-RN – This is the first time this user has assigned this role on this platform.

Prof-Login-EmD-Plt-EmD – This is the first time this email domain has been used to successfully log into this platform.

Prof-FDel-U-O-U-LogFile – This is the first time a log file has been deleted by this user.

Prof-PrivUse-U-O-UD – This is the first time a Windows privileged has been used and invoked for users in this department.

Prof-FPM-CloudACL-AzureContainer-O-U – This is the first time this user has modified the ACL of a container in Azure. Container ACLs manage user access permissions and determine the access user have to the blobs inside, so modifications must be treated carefully.

Prof-PCnet-U-O-U-user – This is the first time local user accounts have been enumerated using 'net.exe' for this user.

Prof-CA-IKM-KeyCreateGCP-O-U – This is the first time this user added or modified an SSH key of an instance in GCP. These events may include both failed and successful modifications.

Prof-SA-PN-U-PN – This is the first time an alert triggered on this process for this user.

Prof-STC-PP-TN-PP – This is the first time a scheduled task has been created and configured to execute this process for this task name.

Prof-Login-Plt-U-Plt – This is the first time this user has attempted to log into this platform. These events do not include endpoint events and may include both failed and successful logins.

Prof-SEPwrshell-wmi-O-U – This is the first time this user executed a PowerShell script with WMI commands.

Prof-CPM-Resource-U-R – This is the first time an IAM policy of a resource in this directory has been successfully modified by this user in GCP. IAM policies determine the roles and permissions granted to users on a resource.

Prof-FDnld-E-O-SE – This is the first time a file has been downloaded to this endpoint.

Prof-DSF-AT-U-AT – This is the first time this directory service activity type failed for this user. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-PwdChkout-U-O-UD – This is the first time a user in this department retrieved a password.

Prof-AI-AC-O-AT – This is the first time a user in the organization has created an AI agent.

Prof-STC-O-UD – This is the first time a scheduled task has been created for users in this department.

Prof-PwdChkout-E-U-SE – This is the first time this user retrieved a password from this endpoint.

Prof-DS-Attr-U-Attr – This is the first time this privileged user accessed this directory service attribute.

Prof-PC-CmdArgs-Regsvr32-O-SCTParam – This is the first time the 'regsvr32.exe' process has been executed with this SCT file as a parameter.

Prof-STC-E-O-DE – This is the first time a scheduled task has been created on this endpoint.

Prof-FDnld-E-U-SE – This is the first time a file has been downloaded to this endpoint for this user.

Prof-AL-E-O-SE – This is the first time a user in the organization attempted to log into an application from this endpoint. These events may include both failed and successful logins.

Prof-PC-U-O-U-Kextload – This is the first time a process execution of a 'kextload' (Kernel Extension Load) command has been observed for this user.

Prof-GMA-U-O-U – This is the first time a user has been added to a group by this user.

Prof-VPNIn-U-O-U – This is the first time this user attempted to log into a VPN. These events may include both failed and successful logins.

Prof-DL-E-O-SE – This is the first time a kernel module\driver was loaded on this endpoint.

Prof-STC-O-PN – This is the first time a scheduled task has been created and configured to execute this process for the organization.

Prof-PCnet-U-O-U-groups – This is the first time local groups have been enumerated using 'net.exe' for this user.

Prof-GA-CSVC-U-SVC – This is the first time this cloud service was observed in events in this platform for this user.

Prof-SA-PN-O-PN – This is the first time a security alert triggered on this process for the organization.

Prof-DBQ-RS-U-RS – An abnormal successful database query response size has been observed in this database for this user.

Prof-Login-E-UD-DZ – This is the first time a user in this department successfully logged into this network zone.

Prof-RegW-AppPaths-O-U – This is the first time this user has modified a registry key\value under the App Paths key '[HKLM/HKCU]\Software\Microsoft\Windows\CurrentVersion\App Paths'.

Prof-RegW-SilentExitMon-O-U – This is the first time this user has modified or created the silent exit configuration of a process by writing a registry key\value under the key 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit'.

Prof-VPNIn-U-O-UC – This is the first time a user in this country attempted to log into a VPN. These events may include both failed and successful logins.

Prof-RegR-Certs-U-RP – This is the first time this user has read this certificate\private key related registry value.

Prof-GA-RGN-U-RGN – This is the first time this cloud region has been observed for this user.

Prof-CPM-UAttachAWS-O-U – This is the first time this user attached a policy to an identity (user, group and role) in AWS. Policies in AWS are the documents that dictate what permissions are granted to identities and resources. These events may include both failed and successful attachments.

Prof-GA-Country-O-DCountry – This is the first time an activity has been observed to this country, determined by geolocation lookup.

Prof-DS-DSOC-UD-DSOC – This is the first time a user in this department performed an activity on a directory service object with this object class.

Prof-LogCl-E-O-DE – This is the first time an audit log has been cleared on this endpoint.

Prof-DBQ-RS-SZ-RS – An abnormal successful database query response size has been observed for this source network zone.

Prof-UKeyCreate-U-O-U – This is the first time this user has generated an access key for a user account.

Prof-PrivUse-E-SE-SZ – This is the first time a Windows privileged has been used and invoked from this endpoint and from this network zone.

Prof-UCreate-U-Plt-U – This is the first time this user has created a user account on this platform.

Prof-PCroute-NetDisc-U-PN – This is the first time a process execution of 'route.exe' has been observed for this user.

Prof-CA-IKM-AWSKeyPair-O-U – This is the first time this user has modified an instance's SSH key pair in AWS.

Prof-DllLoad-Ext-PN-FileExt – This is the first time a DLL image file with this extension was loaded for this process.

Prof-RCM-U-O-UPlt – This is the first time this user modified or created a role on this platform.

Prof-SA-E-O-SZ – This is the first time a security alert triggered in this network zone.

Prof-GMA-E-O-DE – This is the first time a user has been added to a group on this endpoint.

Prof-USB-DevId-U-DevId – This is the first time this peripheral device ID has been observed for this user.

Prof-Login-E-U-DZ – This is the first time this user successfully logged into this network zone.

Prof-GA-Country-O-SCountry – This is the first time an activity has been observed from this country, determined by geolocation lookup.

Prof-FPM-PublicCloud-B-U – This is the first time a cloud storage object was modified to become public in this bucket. By manipulating file permissions to make the object public, attackers can expose the data of important or sensitive files, making them available to read, download or even modify by everyone.

Prof-MFA-MFADevice-U-MFADevice – This is the first time this user authenticates with MFA authentication using this device. These events may include both failed and successful logins.

Prof-EMS-Country-UD-DCountry – This is the first time a user in this department has sent an email to this country, as determined by geolocation lookup.

Prof-WinSC-E-O-DZ – This is the first time a service creation has been observed in this network zone.

Prof-Login-E-SE-DZ – This is the first time a user on this endpoint successfully logged into this network zone.

Prof-PC-U-O-U-Insmod – This is the first time a process execution of a 'insmod' (Install Module) command has been observed for this user.

Prof-UDel-U-O-U – This is the first time this user has deleted a user account.

Prof-RPM-U-O-UPlt – This is the first time this user modified the permissions of a role on this platform.

Prof-FA-SCFA-O-UD – This is the first time source code file activity (by file extension) has been observed for users in this department. File activity could include read, delete, write or any other type of file related operations.

Prof-DB-U-DBN-UD – This is the first time a database event in this database has been observed for a user in this department. A database event consists of any event or operation performed on a database. These events may include both failed and successful operations.

Prof-MFA-FailureReason-U-FailureReason – This is the first time this user failed to authenticate with MFA authentication with this failure reason.

Prof-AI-U-Guardrail-Block – This is the first time this user has triggered an AI guardrail violation.

Prof-VPNIn-E-U-DE – This is the first time this user attempted to log into a VPN with this server. These events may include both failed and successful logins.

Prof-FWrite-AuthorizedKeys-O-UD – This is the first time an 'authorized_keys' file has been modified by users in this department.

Prof-EL-EDC-O-SZ – This is the first time an endpoint login event to a domain controller has been observed originating from this network zone for the organization. These events may include both failed and successful logins.

Prof-DB-E-UDBN-SE – This is the first time a successful database event in this database has been observed for this user from this endpoint.

Prof-RA-R-U-RA – This is the first time this user assumed this role.

Prof-DS-A-UDSOT-A – This is the first time this activity has been observed on this directory service object class for this user. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-PwdChkout-U-O-U – This is the first time this user retrieved a password.

Prof-STC-O-U – This is the first time a scheduled task has been created for this user.

Prof-STC-TN-O-TN – This is the first time a scheduled task with this name has been created.

Prof-GA-Mime-O-Mime – This is the first time this MIME type has been observed for the organization. These events do not include network or endpoint platforms.

Prof-SEPwrshell-U-O-U – This is the first time this user executed a PowerShell script.

Prof-DB-DBOp-UDBN-DBOp – This is the first time a database operation has been observed for this user. A database operation consists of any action in a database query (i.e. SELECT, DROP, UPDATE, etc...).

Prof-EW-DCShadow-SE-O-SE – This is the first time the GC (global catalog) and DRS (directory replication service) service principal names have been added to this matured endpoint. These SPNs are required for the active directory replication process, and can be added to a rogue domain controller to execute a DCShadow attack.

Prof-PCpwrshell-En-O-PP – This is the first time a process execution of PowerShell with an encrypted command has been observed for this parent process.

Prof-STC-TN-UD-TN – This is the first time a scheduled task with this name has been created for users in this department.

Prof-PrivUse-U-O-U – This is the first time a Windows privileged has been used and invoked from this directory for this process.

Prof-WinSC-E-UD-DE – This is the first time a service creation has been observed on this endpoint for users in this department.

Prof-CA-AzureSAS-O-U – This is the first time this user has generated a shared access signature (SAS) to a compute resource in Azure. By generating SAS, attackers can make a resource public and download its content.

Prof-PC-CmdArgs-Msbuild-O-XMLParam – This is the first time the 'msbuild.exe' process has been used to build a project with this xml file.

Prof-PC-CmdArgs-InstallUtil-O-EXEParam – This is the first time the 'installutil.exe' process has been executed with this EXE file as a parameter.

Prof-PCca-U-O-U – This is the first time root certificate has been installed on a Linux machine using 'update-ca-certificates' or 'update-ca-trust' for this user.

Prof-SA-AN-O-AN – This is the first time this security alert triggered in the organization.

Prof-CA-FromSnapshot-O-U – This is the first time this user has created a compute resource from an existing snapshot.

Prof-STC-U-PN – This is the first time a scheduled task has been created and configured to execute this process for this user.

Prof-CA-IE-O-U – This is the first time this user has exported a compute instance. Instance export could be used by an attacker to collect sensitive data that resides inside the organization's virtual machines.

Prof-RegW-UAC-O-U – This is the first time this user has modified or created a registry key\value under the UAC configuration key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'.

Prof-AL-E-U-SE – This is the first time this user attempted to log into an application from this endpoint. These events may include both failed and successful logins.

Prof-PC-O-Pdir – This is the first time a process execution has been observed from this directory.

Prof-Web-TI-U-WebDom-Malicious – This is the first time an HTTP communication attempt to this malicious web domain has been observed for this user. These events may include both failed and successful traffic.

Prof-WinSC-PP-SN-PP – This is the first time this service was created with this command process path.

Prof-ShA-SE-SN – This is the first time this network share has been accessed from this endpoint.

Prof-SA-DP-LE-DP – This is the first time a network alert on this port has been triggered for this destination endpoint.

Prof-PC-E-NetUserAdd-O-DE – This is the first time a user account has been created using 'net.exe' on this endpoint.

Prof-FWrite-Cloud-ExecObject-O-U – This is the first time this user created an executable storage object in a cloud bucket. An abnormal upload could indicate this user is trying to implant a malicious file in the organization, and these files are extremely critical to note when abnormal, since they are usually used for code execution.

Prof-SA-E-SZ-SE – This is the first time a security alert triggered from this endpoint in this network zone.

Prof-AI-AC-O-UD – This is the first time a user in this department has created an AI agent.

Prof-SA-AN-SE-RN – This is the first time this correlation rule triggered from this endpoint.

Prof-ULck-U-O-U – This is the first time this user has locked a user account.

Prof-SA-PN-UD-PN – This is the first time an alert triggered on this process for users in this department.

Prof-FPM-CloudACL-O-U – This is the first time this user has modified the ACL of a cloud storage object.

Prof-EMS-FileExt-O-FileExt – This is the first time a user in the organization has sent an email attachment with this extension.

Prof-CA-IC-O-U – This is the first time this user has created an image. An abnormal image upload could mean the image was created with a malicious intent. A malicious image could be used to trick users to create a VM that will contains a shellcode or a malware implanted in advance by an attacker.

Prof-CA-RI-O-U – This is the first time this user imported an instance, volume, snapshot or image. An unknown compute resource that was imported maliciously could indicate that the user's available compute data cloud has compromised. An instance or a volume created from a malicious source could possibly contain a shellcode or a malware implanted in advance by an attacker.

Prof-SEPwrshell-CmdInv-U-CmdInv – This is the first time this user executed a PowerShell script with this command.

Prof-Login-E-DZ-SZ – This is the first time a successful login has been observed from this source network zone to this destination network zone.

Prof-PC-Sysvol-O-UD – This is the first time a SYSVOL domain group policy has been accessed by a process for users in this department.

Prof-UCreate-E-O-DE – This is the first time a user account was created on this endpoint.

Prof-Fwrite-U-O-U-KernelExtExt – This is the first time a kernel extension file was created on MacOS system by this user.

Prof-RegW-IFEO-O-U – This is the first time this user has modified or created the Image File Execution Options of a process by writing to the registry value 'Debugger' under the key 'HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<executable>'.

Prof-EL-E-U-SC – This is the first time this user has successfully logged into an endpoint from this country, determined by geolocation lookup.

Prof-RegW-Services-O-UD – This is the first time users in this department have modified or created a service by writing a registry key\value under the key 'HKLM\SYSTEM\CurrentControlSet\Services'.

Prof-PCMsbuild-E-O-DE – This is the first time the 'msbuild.exe' process has been used to build and execute a project on this endpoint.

Prof-PC-FPermMod-Cacl-O-U – This is the first time a file or folder permissions have been modified using 'icacls.exe' or 'cacls.exe' for this user.

Prof-RegD-Services-O-UD – This is the first time users in this department have deleted a service by deleting a registry key\value under the key 'HKLM\SYSTEM\CurrentControlSet\Services'.

Prof-USB-DevId-O-DevId – This is the first time this peripheral device ID has been observed for the organization.

Prof-EMS-Country-U-DCountry – This is the first time this user has sent an email to this country, as determined by geolocation lookup.

Prof-Web-BinURL-O-U – This is the first time an executable file was downloaded during an HTTP session for this user. These events may include both failed and successful traffic.

Prof-PCnetsh-U-O-U – This is the first time firewall policies have been enumerated using 'netsh.exe' for this user.

Prof-MFA-AuthMethod-U-AuthMethod – This is the first time this user authenticates with MFA authentication using this authentication method. These events may include both failed and successful logins.

Prof-DS-DSOC-O-DSOC – This is the first time a user in the organization performed an activity on a directory service object with this object class.

Prof-VPNIn-Rlm-U-Rlm – This is the first time this user attempted to log into a VPN with this realm. These events may include both failed and successful logins.

Prof-VPNIn-SC-U-SC – This is the first time this user attempted to log into a VPN from this country. These events may include both failed and successful logins.

Prof-UCreate-U-O-UD – This is the first time a user in this department has created a user account.

Prof-DS-AT-U-AT – This is the first time this directory service activity has been observed for this user. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-CA-IC-Plt-U – This is the first time this user has created a virtual instance on this platform.

Prof-PC-CmdArgs-Msbuild-O-CsprojParam – This is the first time the 'msbuild.exe' process has been used to build this C# project.

Prof-VPNIn-E-O-SE – This is the first time a user attempted to log into a VPN from this endpoint. These events may include both failed and successful logins.

Prof-BPM-U-PBACL-O-U – This is the first time this user has successful edited the ACL policy of a bucket in AWS.

Prof-DS-AT-DSOC-AT – This is the first time this activity has been observed for this directory service object class. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-CPM-UCreate-O-U – This is the first time this user created or modified an IAM policy on this cloud platform. IAM policies determine the roles and permissions granted to users on a resource. These events may include both failed and successful creations\modifications.

Prof-VPNIn-E-UD-DE – This is the first time a user in this department attempted to log into a VPN with this server. These events may include both failed and successful logins.

Prof-PC-E-O-SE-Insmod – This is the first time a process execution of a 'insmod' (Install Module) command has been observed on this endpoint.

Prof-GA-RGN-O-RGN – This is the first time this cloud region has been observed for the organization.

Prof-PCnet-U-O-U-netlocalgroupadmin – This is the first time a user account has been added to the administrators group using 'net.exe' for this user.

Prof-FA-FDir-DE-NTDSDir – This is the first time a NTDS access has been observed in this folder on this endpoint. NTDS activities could include database attach or detach.

Prof-PCnet-U-O-U-netlocalgroup – This is the first time a user account has been added to a group using 'net.exe' for this user.

Prof-ShA-U-SN – This is the first time this network share has been accessed by this user.

Prof-RegW-FileAssoc-O-U – This is the first time this user has modified a command of a file assocation handler by modifing its registry configuration.

Prof-EMS-AC-U-A – An abnormal number of email attachments have been observed in an outgoing email for this user.

Prof-AuditPolicyMod-U-O-U – This is the first time this user has performed an audit policy modification. These events may include both failed and successful modifications.

Prof-PCipconfig-NetDisc-U-PN – This is the first time a process execution of 'ipconfig.exe' has been observed for this user.

Prof-FA-SCFA-O-U – This is the first time source code file activity (by file extension) has been observed for this user. File activity could include read, delete, write or any other type of file related operations.

Prof-SEPwrshell-SN-U-SN – This is the first time this user executed a PowerShell script with this name.

Prof-DS-E-UD-SE – This is the first time a user in this department performed an activity on a directory service object from this endpoint.

Prof-Fwrite-SystemdService-O-U – This is the first time a systemd service file has been modified by this user.

Prof-WinSC-U-DE-DU – This is the first time a service permitted to run under this user's credentials was created on this endpoint.

Prof-GA-CSVC-UD-SVC – This is the first time this cloud service was observed in events in this platform for users in this department.

Prof-EA-Kerberos-O-ET – This is the first time a Kerberos authentication has been observed with this encryption type for the organization. These events may include both failed and successful authentication.

Prof-Auth-U-Okta-AnonVPN – This is the first time an Okta user has used an anonymous VPN to authenticate.

Prof-SA-AN-UD-RN – This is the first time this correlation rule triggered for users in this department.

Prof-WinSC-E-DE-DZ – This is the first time a service creation has been observed on this endpoint for this destination network zone.

Prof-ShA-SZ-SN – This is the first time this network share has been successfully accessed from this network zone.

Prof-DB-DBOp-UDDBN-DBOp – This is the first time a database operation has been observed for a user in this department (i.e. "HR", "Finance", etc...). A database operation consists of any action in a database query (i.e. SELECT, DROP, UPDATE, etc...)

Prof-ELNAC-Loc-U-Loc – This is the first time this user has been observed logging into an endpoint using a network access control platform from this network location.

Prof-PCvssadmin-SCC-O-SE – This is the first time a shadow copy was created using 'vssadmin.exe' from this endpoint.

Prof-Login-E-U-SZ – This is the first time a successful login has been observed from this network zone for the this user.

Prof-USwtch-U-U-DU – This is the first time this user has performed an account switch to this account.

Prof-RegW-U-DetailsLen – An abnormal registry details length has been observed for this user.

Prof-DSF-AT-UD-AT – This is the first time this directory service activity type failed for users in this department. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-SA-DP-DZ-DP – This is the first time a network alert on this port has been triggered for this destination network zone.

Prof-UCreate-E-U-DE – This is the first time this user has created a user account on this endpoint.

Prof-SA-E-O-SE – This is the first time a security alert triggered from this endpoint.

Prof-DllLoad-Ext-O-FileExt – This is the first time a DLL image file with this extension was loaded for the organization.

Prof-SEPwrshell-Web-O-U – This is the first time this user has executed a PowerShell script that performs a web request.

Prof-EL-HT-U-HT – This is the first time this user has attempted to log into an endpoint of this type (server, workstation...). These events may include both failed and successful logins.

Prof-CA-SC-O-U – This is the first time this user has successfully created a snapshot of a compute instance.

Prof-Web-WebDom-O-Tld – This is the first time a successful HTTP communication to this top level domain has been observed for the organization.

Prof-VPNOut-SDM-U-SD – An abnormal VPN session length has been observed for this user.

Prof-CA-IKM-AWSAdminRetrv-O-U – This is the first time this user has retrieved the administrator password of an instance in AWS. Instance administrator passwords can be extracted from the instance resource even if the user does not have permissions to connect to the instance itself. These passwords can be used by attackers to identify with an administrator user on the instance and gain complete control of the machine.

Prof-AI-AC-O-U – This is the first time this user has created an AI agent.

Prof-RegR-LSA-O-UD – This is the first time users in this department read have read a LSA secret from the registry.

Prof-UCreate-Z-O-SZ – This is the first time a user account has been created in this network zone.

Prof-CPM-DestD-U-DestD – This is the first time a user from this domain was successfully granted IAM permissions in a GCP policy. IAM policies determine the roles and permissions granted to users on a resource.

Prof-AI-UD-Guardrail-Block – This is the first time a user in this department has triggered an AI guardrail violation.

Prof-SA-AN-UD-AN – This is the first time this security alert triggered for users in this department.

Prof-DS-AT-SE-AT – This is the first time this directory service activity has been observed from this endpoint. Directory services typically manage various types of objects to organize and administer resources within a network environment.

Prof-EMS-Country-O-DCountry – This is the first time a user in the organization has sent an email to this country, as determined by geolocation lookup.

Prof-FWrite-AuthorizedKeys-O-U – This is the first time an 'authorized_keys' file has been modified by this user.

Prof-DS-DSOC-U-DSOC – This is the first time this user performed an activity on a directory service object with this object class.

Prof-DB-E-UDBN-SZ – This is the first time a successful database event in this database has been observed for this user from this network zone.

Prof-EL-E-U-DE – This is the first time this user attempted to log into this endpoint. These events may include both failed and successful logins.

Prof-PC-E-NetUserAdd-O-DZ – This is the first time a user account has been created using 'net.exe' on this network zone.

Prof-RegW-EnvVarPath-O-U – This is the first time this user has modified the PATH environment variable by writing to the registry value 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path'.

Prof-AI-O-Guardrail-Block – This is the first time a user in the organization has triggered an AI guardrail violation.

Prof-GMA-E-O-SZ – This is the first time a user has been added to a group from this network zone.

Prof-UCreate-U-O-U – This is the first time this user has created a user account.

Prof-PCwmic-IR-O-U-grp – This is the first time a group has been renamed using 'wmic.exe' for this user.

Prof-FWrite-UMWorkerProcess-PN-FN – This is the first time this file was created by the 'umworkerprocess.exe' process.

Prof-PC-U-O-U-Modprobe – This is the first time a process execution of a 'modprobe' (Module Probe, a kernel module management tool) command has been observed for this user.

Prof-DS-E-UD-SZ – This is the first time a user in this department performed an activity on a directory service object from this network zone.

Prof-Web-WebDom-O-U-WebDomIP – This is the first time an HTTP communication attempt directly to an IP address has been observed for this user. These events may include both failed and successful traffic.

Prof-RegR-SAM-O-UD – This is the first time users in this department have read a registry value under the SAM registry key.

Prof-DB-DBOp-SZDBN-DBOp – This is the first time a database operation has been observed from this network zone. A database operation consists of any action in a database query (i.e. SELECT, DROP, UPDATE, etc...).

Prof-RegR-LSA-O-U – This is the first time this user has read a LSA secret from the registry.

Prof-CPM-URevertAWS-O-U – This is the first time this user has successfully changed the default policy version of a policy in AWS. Policies in AWS are the documents that dictate what permissions are granted to identities and resources.

Prof-USB-E-UD-SE – This is the first time a peripheral device activity has been observed from this endpoint for users in this department.

Prof-Login-E-O-SZ – This is the first time a successful login has been observed from this network zone for the organization.

Prof-DL-U-O-Uplt – This is the first time a kernel module\driver was loaded for this user.

Prof-RA-R-Plt-RN – This is the first time this role was assigned on this platform.

Prof-Login-E-DE-SZ – This is the first time a successful login has been observed from this network zone to this endpoint.

Prof-SA-AN-U-RN – This is the first time this correlation rule triggered for this user.

Prof-UCreate-U-Plt-UD – This is the first time users in this department have created a user account on this platform.

Prof-FDel-UnixLogFiles-O-U – This is the first time a log file deletion has been observed for this user in Unix systems.

Prof-RegW-SafeBoot-O-U – This is the first time this user has modifed the safe mode boot configuration by writing to a registry value/key under the registry key HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal.

Prof-EL-E-UD-DE – This is the first time a user from this department attempted to log into this endpoint. These events may include both failed and successful logins.

Prof-VPNIn-Rlm-UD-Rlm – This is the first time a user in this department attempted to log into a VPN with this realm. These events may include both failed and successful logins.

Prof-DB-E-UDBN-SIP – This is the first time a successful database event in this database has been observed for this user from this IP address.

Prof-SA-AN-O-RN – This is the first time this correlation rule triggered in the organization.

Prof-ELNAC-E-U-SMac – This is the first a network access control login event has been observed coming from this MAC address for this user. These events may include both failed and successful logins.

Prof-GMA-U-DE-U – This is the first time this system account has added a user to a group on this endpoint.

Prof-PLA-Loc-U-LocCity – This is the first time this user has physically accessed a building in this city.

Prof-PCpwrshell-En-O-U – This is the first time a process execution of a PowerShell process with an encrypted command has been observed for this user.

Prof-SA-E-UD-SE – This is the first time a security alert triggered from this endpoint for users in this department.

Prof-ELF-E-U-DE – This is the first time this user has failed to log into this endpoint. The user might have logged in successfully before, but this is the first time a failed login event was observed on the endpoint.

Prof-USB-DevId-SE-DevId – This is the first time this peripheral device ID has been observed from this endpoint.

Prof-UCreate-U-DE-U-SystemAcct – This is the first time this system account has created a user account on this endpoint.

Prof-CA-DA-O-U – This is the first time this user has successfully attached a volume to an instance.

Prof-BPM-Public-O-U – This is the first time this user has attempte to modify the IAM policy or the ACL of an AWS bucket to make it public to all users. These events may include both failed and successful modifications.

Prof-PC-PN-Pdir – This is the first time a process execution has been observed from this directory for this process.

Prof-VPNIn-U-O-UD – This is the first time a user in this department attempted to log into a VPN. These events may include both failed and successful logins.

Prof-DL-O-Sig – This is the first time a kernel module or driver has been loaded with this signature for the organization.

Prof-AL-MFA-U-MFA – This is the first time this user has logged into an application without using multi factor authentication (MFA).

Prof-FUpld-E-U-SE – This is the first time this user has uploaded a file from this endpoint.

Prof-RPM-PR-R-Public – This is the first time this role's permissions were modified to make it public.

Prof-PCIOC-IOCPenT-U-PenT – This is the first time a process execution of a known pentesting tool has been observed for this user.

Prof-USB-E-O-SE – This is the first time a peripheral device activity has been observed from this endpoint.

Prof-USB-U-O-U – This is the first time a peripheral device activity has been observed for this user.

Prof-USB-DevId-U-DevId – This is the first time this peripheral device ID has been observed for this user.

Prof-USB-DevId-UD-DevId – This is the first time this peripheral device ID has been observed for users in this department.

Prof-SA-AN-SE-RN – This is the first time this correlation rule triggered from this endpoint.

Prof-USB-DevId-O-DevId – This is the first time this peripheral device ID has been observed for the organization.

Prof-USB-E-U-SE – This is the first time a peripheral device activity has been observed from this endpoint for this user.

Prof-FA-FDir-DE-NTDSDir – This is the first time a NTDS access has been observed in this folder on this endpoint. NTDS activities could include database attach or detach.

Prof-USB-E-UD-SE – This is the first time a peripheral device activity has been observed from this endpoint for users in this department.

Prof-SA-AN-U-RN – This is the first time this correlation rule triggered for this user.

Prof-SA-AN-O-RN – This is the first time this correlation rule triggered in the organization.

Prof-USB-DevId-SE-DevId – This is the first time this peripheral device ID has been observed from this endpoint.

Fact-EMRC-FwR-ExtDom – An inbox rule has been configured to forward emails to an email address that's in a different domain than the rule's creator.

NumCP-Web-AIA-U-AILLMSessionCount – An abnormal number of AI/LLM web sessions has been observed for this user.

NumSP-Web-AIA-U-AILLMBytesOut – An abnormal volume of outbound data to AI/LLM web applications has been observed for this user.

Prof-FS-T-U-IT – This is the first time an item shared of this type (file, folder, etc) has been observed for this user.

Fact-PCsharphound-BloodHound – The 'sharphound.exe' (a network domain enumeration tool) process has been executed.

Fact-PC-TFE-Write – The Tasks folder in system32 and syswow64 are globally writable paths that can be abused using shell built-ins such as 'copy', 'echo', 'type', 'file createnew' to stage or execute payloads. This sigma rule is authored by Sreeman. The content of this repository is released under the [Detection Rule License (DRL) 1.1](https://github.com/SigmaHQ/Detection-Rule-License). Reference: https://github.com/SigmaHQ/sigma/blob/799acec38b9e0696cc1d5767a9416033f620aca0/rules/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml

NumCP-AI-MC-U – An abnormal amount of AI agent modifications have been observed for a user.

NumCP-Git-EC-U – An abnormal amount of GitHub API access events have been observed for this user.

NumCP-AI-QC-WID – An abnormal number of successful AI requests has been observed for this workspace. AI requests may consist of one or more prompts.

NumCP-AI-QC-U – An abnormal number of successful AI requests have been performed by this user. AI requests consist of one or more prompts.

NumCP-AI-U-Guardrail-Block – An abnormal amount of AI guardrail violations have been observed for a user.

NumCP-AI-QC-UO – An abnormal number of successful AI requests for the organization have been performed by this user. AI requests may consist of one or more prompts.

Prof-PC-AIT-SE-CURL-Framework – This is the first time an AI development framework has been installed using CURL on this endpoint.

Prof-PC-AIT-U-CURL-Framework – This is the first time an AI development framework has been installed using CURL by this user.

Prof-PC-AIT-UD-CURL-Framework – This is the first time an AI development framework has been installed using CURL by users in this department.

Prof-PC-AIT-UD-CURL-Agent – This is the first time an AI agent has been installed using CURL by users in this department.

Prof-PC-AIT-SE-CURL-Agent – This is the first time an AI agent has been installed using CURL on this endpoint.

Prof-PC-AIT-U-CURL-Agent – This is the first time an AI agent has been installed using CURL by this user.

Prof-PC-O-COD – This is the first time a process execution of an Office application has opened a remote document from this web domain.

Fact-PCDotNet-CommandLine – This .NET supporting process was created with an URL in the commandline.

Fact-PC-OpenClawInstall – OpenClaw has been installed using the command line tool 'curl'. There is nothing inherently malicious about OpenClaw, however, by default it uses insecure practices and may expose significant security flaws.

Fact-FRead-Lssas – A process has directly read from the memory space of 'lsass.exe'.

Fact-PCcsc-AP – The CSC (C# Compiler) process has been spawned by a command line executable or a Microsoft Office process. This sigma rule is authored by Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) and is licensed under Detection Rule License (DRL), https://github.com/SigmaHQ/sigma/blob/master/LICENSE.Detection.Rules.md. Reference: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml

Prof-FA-FDir-DE-NTDSDir – This is the first time a NTDS access has been observed in this folder on this endpoint. NTDS activities could include database attach or detach.

Prof-PwdChkout-U-O-UD – This is the first time a user in this department retrieved a password.

Prof-PwdChkout-U-O-U – This is the first time this user retrieved a password.

Prof-SA-AN-SE-RN – This is the first time this correlation rule triggered from this endpoint.

Prof-SA-AN-UD-RN – This is the first time this correlation rule triggered for users in this department.

Prof-SA-AN-U-RN – This is the first time this correlation rule triggered for this user.

Prof-SA-AN-O-RN – This is the first time this correlation rule triggered in the organization.

Fact-LogCl-LogClear-AT – An audit log has been cleared.

Prof-EL-E-U-SC – This is the first time this user has successfully logged into an endpoint from this country, determined by geolocation lookup.