Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Okta Risk Threshold Exceeded production 2026-05-13
splunk Okta Successful Single Factor Authentication production 2026-05-13
splunk Okta Suspicious Activity Reported production 2026-05-13
splunk Okta Suspicious Use of a Session Cookie production 2026-05-13
splunk Okta ThreatInsight Threat Detected production 2026-05-13
splunk Okta Unauthorized Access to Application production 2026-05-13
splunk Okta User Logins from Multiple Cities production 2026-05-13
splunk Ollama Abnormal Network Connectivity experimental 2026-05-13
splunk Ollama Abnormal Service Crash Availability Attack experimental 2026-05-13
splunk Ollama Excessive API Requests experimental 2026-05-13
splunk Ollama Possible API Endpoint Scan Reconnaissance experimental 2026-05-13
splunk Ollama Possible Memory Exhaustion Resource Abuse experimental 2026-05-13
splunk Ollama Possible Model Exfiltration Data Leakage experimental 2026-05-13
splunk Ollama Possible RCE via Model Loading experimental 2026-05-13
splunk Ollama Suspicious Prompt Injection Jailbreak experimental 2026-05-13
splunk PingID Mismatch Auth Source and Verification Response production 2026-05-13
splunk PingID Multiple Failed MFA Requests For User production 2026-05-13
splunk PingID New MFA Method After Credential Reset production 2026-05-13
splunk PingID New MFA Method Registered For User production 2026-05-13
splunk Splunk AppDynamics Secure Application Alerts production 2026-05-13
splunk Suspicious Email Attachment Extensions experimental 2026-05-13
splunk Suspicious Java Classes experimental 2026-05-13
splunk Zoom High Video Latency experimental 2026-05-13
splunk Zoom Rare Audio Devices experimental 2026-05-13
splunk Zoom Rare Input Devices experimental 2026-05-13
splunk Zoom Rare Video Devices experimental 2026-05-13
splunk Amazon EKS Kubernetes cluster scan detection experimental 2026-05-13
splunk Amazon EKS Kubernetes Pod scan detection experimental 2026-05-13
splunk O365 Service Principal Privilege Escalation production 2026-05-13
splunk ASL AWS Concurrent Sessions From Different Ips production 2026-05-13
splunk ASL AWS Create Access Key production 2026-05-13
splunk ASL AWS Create Policy Version to allow all resources production 2026-05-13
splunk ASL AWS Credential Access GetPasswordData production 2026-05-13
splunk ASL AWS Credential Access RDS Password reset production 2026-05-13
splunk ASL AWS Defense Evasion Delete Cloudtrail production 2026-05-13
splunk ASL AWS Defense Evasion Delete CloudWatch Log Group production 2026-05-13
splunk ASL AWS Defense Evasion Impair Security Services production 2026-05-13
splunk ASL AWS Defense Evasion PutBucketLifecycle production 2026-05-13
splunk ASL AWS Defense Evasion Stop Logging Cloudtrail production 2026-05-13
splunk ASL AWS Defense Evasion Update Cloudtrail production 2026-05-13