deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-01-23

Description:
Logs an event when network traffic flow information such as source and destination IPs, ports, protocol, and action (allow/deny) is captured for VPC in AWS.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs Kerberos pre-authentication requests, including details about the user account, authentication type, and client IP address.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4727
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new computer account in Active Directory, including details about the account name, domain, and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a user registers or updates their security information in Azure Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for AWS CloudTrail DeleteLoggingConfiguration
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs activities related to file transfers and user interactions in CrushFTP, including file uploads, downloads, user authentication, and session details.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when strong authentication methods are disabled in Azure Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user account has been disabled in Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a network ACL entry is replaced within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an event rule in AWS EventBridge, including details about the rule name and its associated targets or schedules.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs access to mailbox items in Microsoft 365, including details about the user accessing the items, the accessed content, and the method of access.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the export of a certificate from the local certificate store, including details about the certificate thumbprint, subject names, and the process involved.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when AWS Security Hub identifies potential security risks or deviations from configured best practices across AWS accounts.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs detailed content of PowerShell script blocks as they are executed, including the full command text and context for the execution.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when modifications are made to the attributes of a snapshot in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs process-related activities captured by CrowdStrike, including process creation, termination, and metadata such as hashes, parent processes, and command-line arguments.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4731
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs changes to user licenses in Microsoft 365, including additions, removals, or updates to service plans associated with a user account.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a new user account is created on a Windows system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs requests made to AWS CloudFront distributions, including details on client access, response data, and performance metrics.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs metadata about files transferred over the network captured by Zeek (formerly Bro), including details such as file names, hashes, MIME types, and transfer protocols.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1131
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs updates to organizational settings and company information in Microsoft 365, including changes to contact details, branding, and configuration policies.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the addition of a user to a security-enabled group, including details about the group name, user account, and associated domain.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log TaskScheduler 201
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-08-05

Description:
This data source captures Windows Event Logs from the Microsoft-Windows-AppXDeploymentServer/Operational channel, specifically focusing on EventCode 854. These events are generated when an MSIX/AppX package has been successfully installed on a system.

Event ID 854 provides information about successful package installations, including the path to the installed package and the user who performed the installation. This data is valuable for security monitoring as it can help identify unauthorized or suspicious package installations.

While most package installations are legitimate, monitoring these events can help identify potentially malicious activity, especially when correlated with other events such as unsigned package installations (EventID 603 with Flags=8388608) or full trust package installations (EventID 400 with HasFullTrust=true).


References:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://www.appdeploynews.com/packaging-types/msix/troubleshooting-an-msix-package/
  - https://www.advancedinstaller.com/msix-installation-or-launching-errors-and-fixes.html
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when aggregate details about AWS events are queried, often for analysis.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an ACL is set or modified for an S3 bucket in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Rod Soto, Splunk
Date: 2025-09-30

Description:
Access Logs from M365 Copilot access via Graph API
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-11-18

Description:
Logs process execution events within Cisco Isovalent environments, providing visibility into process exec ancestry and Kubernetes workload identity.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs modifications made to an Active Directory object, including details about the object name, type, and the changes applied.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-10-27

Description:
Data source object for Cisco ASA system logs. Cisco ASA logs provide firewall operational and security telemetry (connection events, ACL denies, VPN events, NAT translations, and device health). Deploy the Splunk Add-on for Cisco ASA (TA-cisco_asa) on indexers/heavy forwarders and the Cisco ASA App on search heads for best parsing, CIM mapping, and dashboards. This data is ingested via SYSLOG. You must be ingesting Cisco ASA syslog data into your Splunk environment. To ensure all detections work, configure your ASA and FTD devices to generate and forward both debug and informational level syslog messages before they are sent to Splunk. A few analytics are designed to be used with comprehensive logging enabled, as it relies on the presence of specific message IDs. You can find specific instructions on how to set this up here : https://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/63884-config-asa-00.html#toc-hId-[PII_REDACTED].
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs management activities in Microsoft 365, including administrative actions, user activities, and configuration changes across various services.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new thread in a process, including details about the thread ID, start address, and source process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deactivation of a multi-factor authentication (MFA) device, including details about the associated user and the device.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for NTLM Operational 8005
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a system audit policy is modified on a Windows system.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a webhook is created or updated in Azure Automation.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Michael Haag, Splunk
Date: 2025-01-23

Description:
Logs administrative and operational activities in Ivanti Virtual Traffic Manager (VTM), including configuration changes, user actions, and system events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-15

Description:
Data source object for GitHub Enterprise logs using Audit log streaming as described in this documentation https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-splunk using a Splunk HTTP Event Collector.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the deletion of a file, including details about the file path, associated process, and the time of deletion.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Rod Soto, Splunk
Date: 2025-11-04

Description:
Ollama server logs (HTTP access logs via GIN framework and system logs including GPU/CPU utilization, model loading, memory allocation, errors, and warnings) via Splunk TA-ollama add-on by configuring file monitoring inputs to your log directories (sourcetype: ollama:server), or enable HEC for real-time API telemetry and prompt analytics (sourcetypes: ollama:api, ollama:prompts). TA available in Splunkbase
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of a member to a directory role in Azure Active Directory, including details about the role, the member added, and the user or process performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4744
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs changes to mailbox properties in Microsoft 365, including updates to permissions, storage quotas, and configuration settings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs Online Certificate Status Protocol (OCSP) activity captured by Zeek (formerly Bro), including details such as certificate validation requests and responses.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user account is deleted from Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when an application in Azure Active Directory is updated, such as changes to its settings or permissions.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4783
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Gowthamaraj Rajendran
Date: 2025-01-23

Description:
Logs security alerts generated by Windows Defender, including details about detected threats, impacted files, and recommended actions for remediation.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs Gmail activities in G Suite, including email sending, receiving, and access details, as well as potential security-related events.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the connection to a named pipe, including details about the pipe name, source and destination processes, and communication direction.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the deletion of an IAM policy in AWS, including details about the policy name and its associated roles or users.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new process, including details such as process ID, parent process, command line arguments, and hashes of the executable.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs operations that copy objects within or between AWS S3 buckets, including details of source and destination.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2024-07-18

Description:
All Azure Active Directory events
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Nasreddine Bencherchali, Splunk
Date: 2026-03-09

Description:
Data source object for Cisco SD-WAN Service Proxy Access Logs
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the inventory of System Integrity Policies (SIP) on a system retrieved via PowerShell, including details about policy configurations and statuses.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs access to a network share, including details about the user, share path, and the access type.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs suspicious or anomalous activities within a Kubernetes environment detected by Falco, including system calls, file access, and network activity.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs attempts to assume roles via SAML authentication in AWS, including details of identity provider and role mapping.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user or process tried to access a file, directory, registry key, or other system object on the computer
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-11-14

Description:
Data source object for Sysmon EventID 29
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a user account is updated in Azure Active Directory.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs changes to authorization policies in Microsoft 365, including updates to access controls, permissions, and security settings.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs details about the scripts loaded by Zeek (formerly Bro) during initialization, including script names and paths.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs details about X.509 certificates observed in network traffic captured by Zeek (formerly Bro), including certificate fields, validity periods, and issuers.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a request is made to access an object stored in an AWS S3 bucket.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs changes made to AWS Key Management Service (KMS) key policies, including updates and permission assignments.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2023-10-15

Description:
Logs an event when a list of foundation models is requested within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of an owner to an application in Microsoft 365, including details about the application, the new owner, and the user or administrator performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs failed Kerberos pre-authentication attempts, including details about the user account, client IP, and failure reason.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
This event log records events related to cryptographic operations, including the deletion and export of certificates.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a lifecycle configuration is added to an S3 bucket in AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs user interface access events for Splunk, including details about user actions, accessed resources, and authentication information.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Steven Dick
Date: 2025-02-28

Description:
Data source object for Office 365 Reporting Message Trace
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-02-21

Description:
Data source object for NTLM Operational 8004
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Defender 1133
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs modifications to IIS server authentication settings, including updates to client certificate requirements and authentication methods.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs failed login attempts to Google Workspace accounts, including details about the user, IP address, and reason for failure.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the creation of a new user account, including details about the account name, associated domain, and the account performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Bhavin Patel, Splunk
Date: 2023-10-15

Description:
Logs an event when a guardrail is deleted within the AWS CloudTrail.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs detailed information about access to a network share, including the user, share path, accessed file, and access permissions.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs an event when a SAML provider is updated in AWS.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs user or administrator consent to an application's permissions in Microsoft 365, including details about the application, granted permissions, and the consenting user or process.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs the addition of an unverified domain to Azure Active Directory, including details about the domain name and the user or process performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Teoderick Contreras, Splunk
Date: 2025-07-10

Description:
Data source object for Windows Event Log Security 4946
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a process attempts to load a DLL that is blocked by an attack surface reduction rule.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Jacob Delgado, SnapAttack
Date: 2025-01-23

Description:
Logs DNS queries and responses captured by Zeek (formerly Bro), including details such as queried domains, resolved IPs, query types, and response codes.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs attempts to set the Directory Services Restore Mode (DSRM) administrator password, including details about the account name and the user performing the action.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-01-23

Description:
Logs IP traffic captured by Splunk Stream, including details about source and destination IPs, protocols, and packet metadata.
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs an event when a user accessed an object within the Active Directory, such as creating, modifying, or deleting it
Sigma Detection Rule: 
Repository: splunk/security_content
Author: Patrick Bareiss, Splunk
Date: 2025-07-10

Description:
Logs the termination of a process, including details about the process name, process ID, parent process, and associated metadata.