# Generated by scripts/generate_siem_detections.py from detections.json.
# Replace <audit_index>, then enable the searches you want. Every search is disabled by default and defines no action.

[Decision Terrain - Audit or data-governance policy changed]
description = Audit evidence retention or Organization data-governance policy was changed. Shortening retention can erase evidence.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:policy_updated|organization_data_governance_policy_updated)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Audit evidence revealed or exported]
description = Full agent evidence was revealed, used, or exported, or an Organization export was requested or downloaded.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 4
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:evidence_revealed|export_created|export_downloaded|investigation_evidence_used|audit_explanation_evidence_requested|audit_explanation_evidence_used|audit_explanation_revealed|security_audit_exported|organization_portable_export_requested)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - SIEM forwarding stopped or restricted]
description = A SIEM destination was stopped, paused or retired, or installation forwarding scope or limits changed. Treat as possible log tampering.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:siem_destination_stop|siem_destination_pause|siem_destination_retire|siem_installation_forwarding_changed|siem_installation_eligibility_changed|siem_installation_storage_limits_changed)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Credential or machine identity issued]
description = An API key, SCIM token, machine identity, security service identity or native integration credential was created or rotated.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 4
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:organization_api_key_created|scim_token_created|scim_token_rotated|machine_identity_created|machine_identity_version_activated|security_service_identity_created|security_service_credential_rotated|native_integration_credentials_created)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Role mapping or access policy changed]
description = A member role, SCIM role mapping, default role or Organization access policy was changed, or an invitation was created.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 4
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:organization_member_role_updated|scim_group_mapping_updated|scim_default_role_updated|organization_access_policy_updated|organization_invite_created)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - SSO enforcement weakened or recovery used]
description = An SSO connection was deactivated, enforcement was relaxed, a recovery kit was created, rotated or used, or an identity was unlinked.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:connection_deactivated|recovery_enforcement_relaxed|recovery_kit_created|recovery_kit_rotated|recovery_session_started|identity_unlinked)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Agent security hold placed]
description = An external, internal or rule-driven security hold was accepted for an agent or a group of agents.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:security_rule_halt_accepted|external_security_halt_accepted|internal_security_halt_accepted|security_halt_batch_started)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Emergency control step failed]
description = A platform or sandbox emergency control step reported failure, so containment may be incomplete.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:agent_emergency_.*|sandbox_emergency_.*)$") \
| where match('audit.result', "^(?:failed)$") \
| table _time audit.organization.id audit.actor.kind audit.actor.user_id audit.action audit.result audit.resource.type audit.resource.id audit.event.id

[Decision Terrain - Repeated failed sign-ins for one account]
description = Five failed sign-ins for the same account within ten minutes.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -10m
dispatch.latest_time = now
alert.severity = 5
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:member_login_failed)$") \
| stats count BY audit.organization.id audit.resource.id | where count>=5

[Decision Terrain - Repeated rejected API key or service credential]
description = Three rejections of the same API key or service credential within ten minutes.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -10m
dispatch.latest_time = now
alert.severity = 4
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="organization.security" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:api_key_authentication_failed|service_credential_authentication_failed)$") \
| stats count BY audit.organization.id audit.resource.id | where count>=3

[Decision Terrain - Agent repeatedly denied by policy]
description = Ten security-rule or sandbox-network denials for the same agent within fifteen minutes.
disabled = 1
enableSched = 1
cron_schedule = */5 * * * *
dispatch.earliest_time = -15m
dispatch.latest_time = now
alert.severity = 4
alert.track = 1
counttype = number of events
relation = greater than
quantity = 0
search = index=<audit_index> source="decisionterrain-audit" "event.name"="agent.audit" "audit.schema.version"=1 \
| dedup event.name audit.organization.id audit.event.id \
| where match('audit.action', "^(?:security_rule_evaluated|sandbox_network_request)$") \
| where match('audit.result', "^(?:denied)$") \
| stats count BY audit.organization.id audit.agent.id | where count>=10