deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs failed login attempts by users in Microsoft 365, including details about the user account, IP address, and reason for failure.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4700
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4948
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of an application role assignment to a service principal in Azure Active Directory, including details about the role, service principal, and the user or process performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs successful login attempts to Google Workspace accounts, including details about the user, IP address, and session metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs anomalous or unexpected network behaviors identified by Zeek (formerly Bro), including protocol violations and unusual traffic patterns.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1134
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-08-21

Description:
Data source object for Cisco IOS system logs. Cisco IOS logs provide operational and security telemetry from Cisco network devices (IOS, IOS XE, IOS XR, NX-OS, WLC, and APs). The Cisco Networks Add-on for Splunk (TA-cisco_ios) normalizes these events by setting proper sourcetypes and extracting fields for switches, routers, controllers, and access points; deploy the TA on indexers/HFs and search heads, and the Cisco Networks (cisco_ios) App on search heads. Supported platforms include Catalyst, ASR, ISR, Nexus, CRS, and other IOS-based devices, enabling consistent investigation, alerting, and reporting in Splunk Enterprise and Splunk Cloud. This data is ingested via SYSLOG.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4702
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new Active Directory object, including details about the object name, type, and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs activities related to CI/CD pipelines executed in CircleCI, including job execution, workflow progress, and configuration changes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs cryptographic operations performed by a Windows system, including details about the certificate or key used and the operation type.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a request is made to retrieve the administrator password of an EC2 instance.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a domain policy, such as account or lockout policy, is modified in Active Directory or local security settings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Raven Tait, Splunk
Date: 2025-11-04

Description:
Data source object for syslog data from VMWare ESXi
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-08-05

Description:
This data source captures Windows Event Logs from the Microsoft-Windows-AppXPackaging/Operational channel, specifically focusing on EventCode 171. These events are generated when a user clicks on or attempts to interact with an MSIX package, even if the package is not fully installed.

Event ID 171 provides information about user interactions with MSIX packages, including the package full name and the user who initiated the interaction. This data is valuable for security monitoring as it can help identify what MSIX packages users are attempting to open in an environment, which may help detect malicious MSIX packages before they're fully installed.

MSIX package abuse has been observed in various threat campaigns, including those from FIN7, Zloader (Storm-0569), and FakeBat (Storm-1113). Monitoring these interactions can provide early warning of potential MSIX package abuse.


References:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/
  - https://redcanary.com/blog/msix-installers/
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-03-04

Description:
Data source object for Windows Event Log Application 15457
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2023-10-15

Description:
Logs an event when a model is invoked within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Data source object for Cisco Duo Administrator
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs the execution of processes on a Linux system, including details about the executed command, arguments, and the initiating process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the successful installation of a new Windows service, including details about the service name, executable path, and service type.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-11-18

Description:
Captures detailed process connection events—including source and destination process metadata, execution lineage (ancestry), and Kubernetes workload context—generated by Cisco Isovalent instrumentation. Enables technical analysis of inter-process communications, container-level activity, and workload-specific network flows in cloud-native environments.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the access of raw disk data by a process, including details about the disk name, process ID, and process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-02-26

Description:
Data source object for Windows Event Log Application 8128
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs HTTP traffic analyzed by Zeek (formerly Bro), including details such as request methods, URLs, user agents, response codes, and headers.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of a new service principal in Azure Active Directory, including details about the service principal, associated application, and the user or process performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of new versions of IAM policies, including changes to permissions and attached roles or resources.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when the authentication method for a domain in Azure Active Directory is set or modified.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs changes to IIS server configuration, including updates to settings, modules, authentication methods, and site bindings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs events related to the stoppage of a service on a Linux system, including details about the service name, the process initiating the stop, and associated timestamps.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the disabling of strong authentication (e.g., multi-factor authentication) for a user or group in Microsoft 365, including details about the affected accounts and the action initiator.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when the default version of a resource policy in AWS is set or changed.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a virtual Multi-Factor Authentication (MFA) device is deleted in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-06-30

Description:
Data source object for Netflow events from Cisco Network Visibility Module
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs state changes of a Windows service, including details about the service name and its new state (e.g., started or stopped).
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the creation of a new task in AWS services, such as ECS, including details about the task definition and resource allocation.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when the print spooler service fails to load a printer plug-in module.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when an attempt is made to reset an account's password, whether successful or not.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2025-04-07

Description:
Data source object for raw file events from Cisco Secure Firewall Threat Defense
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-02-26

Description:
Data source object for Windows Event Log Application 17135
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2026-04-15

Description:
Logs an event when the audit log is cleared.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-13

Description:
Data source object for Azure Monitor Activity.  The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub.  To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-04

Description:
Data source object for alerts from Cisco Secure Application
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs activities related to Google Drive in G Suite, including file creation, modification, sharing, and access details.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when Windows Defender antimalware settings are modified.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Sysmon EventID 14
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-02-20

Description:
Logs file system access events on a Linux system, including details about file paths, permissions, and associated processes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs process creation events on Linux systems, including details about the process name, process ID, command line arguments, and parent process ID.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Data source object for Cisco Duo Activity
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the loading of a driver into the kernel or user mode, including details about the driver name, file path, and associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Rod Soto, Splunk
Date: 2026-02-05

Description:
MCP server activity (JSON-RPC protocol messages capturing AI assistant tool invocations including file operations, API calls, GitHub activity, File System, PostGress and many more resource access patterns) via Splunk MCP TA by configuring file monitoring inputs to your MCP server log directories (sourcetype mcp:jsonrpc). Provides CIM-compliant field extractions for security monitoring of Model Context Protocol communications, enabling detection of unauthorized tool usage, anomalous AI behavior, and shadow AI governance. TA available in Splunkbase'
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an admin resets a user's password in Azure Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an Amazon GuardDuty detector, including details about the detector ID and associated configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the result of a cryptographic operation, including details about the key, algorithm used, and whether the operation succeeded or failed.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the termination of a process, including details about the process, its termination code, and timestamp.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4759
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for Office 365 Universal Audit Log
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new file stream, including details about the file stream's hash, path, and associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the loading of an image (module) into a process, including details about the image name, file path, and hash information.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of a member to a role in Microsoft 365, including details about the role, the added member, and the user or administrator performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-03-12

Description:
Data source object for Zeek connection logs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an error when attempting to verify the digital signature of a file, including details about the file path, signature failure, and the process involved.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs authentication and administrative activities captured by Okta, including user login attempts, session management, and configuration changes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new file, including details about the file path, hash information, and associated process metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2026-03-26

Description:
Logs network traffic and security events detected by Suricata, including details about connections, protocol metadata, and potential threats.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when the event logging service has shut down.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an authorization policy is updated in Azure Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a modification is made to an AWS database instance, such as parameters or configurations.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-23

Description:
Logs the deletion of a cloud resource snapshot, such as an Amazon EBS snapshot, including details about the snapshot ID and associated resource.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs administrative actions within Active Directory, including user and group modifications, permission changes, and policy updates.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs WMI (Windows Management Instrumentation) consumer activity, including details about the WMI event consumer, associated process, and event data.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for AWS CloudTrail DescribeSnapshotAttribute
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logged when an account logon is attempted by a process by explicitly specifying the credentials of that account
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs Network Time Protocol (NTP) activity captured by Zeek (formerly Bro), including details such as NTP requests, responses, and server metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs events where one process accesses another process, typically for memory reads or injections, including details about the source and target processes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a member is added to a security-enabled local group on a Windows system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs successful login events by users in Microsoft 365, including details about the user account, IP address, and session metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when replication configurations are added or modified for an S3 bucket.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs authentication and authorization events on a Linux system, including login attempts, SSH connections, and privilege escalation activities.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Bryan Pluta, Splunk
Date: 2025-07-01

Description:
Logs of CrowdStrike Falcon Stream Alerts
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs Kerberos service ticket requests, including details about the requesting user, target service, and client IP address.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a cloud service in AWS, such as CloudTrail, is deactivated or stopped.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2024-07-24

Description:
All AWS CloudTrail events
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an AWS account's password policy is updated.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2026-04-08

Description:
Data source object for Windows Event Log System 104
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an IAM user's login profile is updated.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs attempts to sign in to the AWS Management Console, including successful and failed login events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a Remote Desktop Service session is initialized.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the deletion of a cryptographic key container, including details about the key container name and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for NTLM Operational 8006
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for Azure Active Directory MicrosoftGraphActivityLogs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs activity related to the association of a WMI event consumer with a filter, including details about the consumer, filter, and associated process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Represents AWS API dataset data collection from Amazon Security Lake.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs updates to user account properties in Microsoft 365, including changes to roles, permissions, and profile information.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2026-03-23

Description:
Data source object for Windows Event Log Security 4756