Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk Okta MFA Exhaustion Hunt production 2026-05-13
splunk Okta Mismatch Between Source and Response for Verify Push Request production 2026-05-13
splunk Okta Multi-Factor Authentication Disabled production 2026-05-13
splunk Okta Multiple Accounts Locked Out production 2026-05-13
splunk Okta Multiple Failed MFA Requests For User production 2026-05-13
splunk Okta Multiple Failed Requests to Access Applications experimental 2026-05-13
splunk Okta Multiple Users Failing To Authenticate From Ip production 2026-05-13
splunk Okta New API Token Created production 2026-05-13
splunk Okta New Device Enrolled on Account production 2026-05-13
splunk Okta Phishing Detection with FastPass Origin Check experimental 2026-05-13
splunk Okta Risk Threshold Exceeded production 2026-05-13
splunk Okta Successful Single Factor Authentication production 2026-05-13
splunk Okta Suspicious Activity Reported production 2026-05-13
splunk Okta Suspicious Use of a Session Cookie production 2026-05-13
splunk Okta ThreatInsight Threat Detected production 2026-05-13
splunk Okta Unauthorized Access to Application production 2026-05-13
splunk Okta User Logins from Multiple Cities production 2026-05-13
splunk Ollama Abnormal Network Connectivity experimental 2026-05-13
splunk Ollama Abnormal Service Crash Availability Attack experimental 2026-05-13
splunk Ollama Excessive API Requests experimental 2026-05-13
splunk Windows Office Product Spawned Rundll32 With No DLL production 2026-05-13
splunk Ollama Possible Memory Exhaustion Resource Abuse experimental 2026-05-13
splunk Ollama Possible Model Exfiltration Data Leakage experimental 2026-05-13
splunk Ollama Possible RCE via Model Loading experimental 2026-05-13
splunk Ollama Suspicious Prompt Injection Jailbreak experimental 2026-05-13
splunk PingID Mismatch Auth Source and Verification Response production 2026-05-13
splunk PingID Multiple Failed MFA Requests For User production 2026-05-13
splunk PingID New MFA Method After Credential Reset production 2026-05-13
splunk PingID New MFA Method Registered For User production 2026-05-13
splunk Splunk AppDynamics Secure Application Alerts production 2026-05-13
splunk GitHub Enterprise Repository Archived production 2026-05-13
splunk GitHub Enterprise Repository Deleted production 2026-05-13
splunk GitHub Organizations Delete Branch Ruleset production 2026-05-13
splunk GitHub Organizations Disable 2FA Requirement production 2026-05-13
splunk GSuite Email Suspicious Attachment production 2026-05-13
splunk GitHub Organizations Disable Classic Branch Protection Rule production 2026-05-13
splunk GitHub Organizations Disable Dependabot production 2026-05-13
splunk GitHub Organizations Repository Archived production 2026-05-13
splunk GitHub Organizations Repository Deleted production 2026-05-13
splunk Gsuite Drive Share In External Email experimental 2026-05-13