Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
Rule feed

Detection rules

Every rule tracked across all seven sources, newest updates first.

Source Rule Status Updated
splunk MCP Github Suspicious Operation production 2026-05-13
splunk MCP Postgres Suspicious Query production 2026-05-13
splunk MCP Prompt Injection production 2026-05-13
splunk MCP Sensitive System File Search production 2026-05-13
splunk No Windows Updates in a time frame experimental 2026-05-13
splunk Okta Authentication Failed During MFA Challenge production 2026-05-13
splunk Okta IDP Lifecycle Modifications production 2026-05-13
splunk Okta MFA Exhaustion Hunt production 2026-05-13
splunk Okta Mismatch Between Source and Response for Verify Push Request production 2026-05-13
splunk Okta Multi-Factor Authentication Disabled production 2026-05-13
splunk Okta Multiple Accounts Locked Out production 2026-05-13
splunk Okta Multiple Failed MFA Requests For User production 2026-05-13
splunk Okta Multiple Failed Requests to Access Applications experimental 2026-05-13
splunk Okta Multiple Users Failing To Authenticate From Ip production 2026-05-13
splunk Okta New API Token Created production 2026-05-13
splunk Okta New Device Enrolled on Account production 2026-05-13
splunk Okta Phishing Detection with FastPass Origin Check experimental 2026-05-13
splunk Okta Risk Threshold Exceeded production 2026-05-13
splunk Okta Successful Single Factor Authentication production 2026-05-13
splunk Okta Suspicious Activity Reported production 2026-05-13
splunk Okta Suspicious Use of a Session Cookie production 2026-05-13
splunk Okta ThreatInsight Threat Detected production 2026-05-13
splunk Okta Unauthorized Access to Application production 2026-05-13
splunk Okta User Logins from Multiple Cities production 2026-05-13
splunk Ollama Abnormal Network Connectivity experimental 2026-05-13
splunk Ollama Abnormal Service Crash Availability Attack experimental 2026-05-13
splunk Ollama Excessive API Requests experimental 2026-05-13
splunk Ollama Possible API Endpoint Scan Reconnaissance experimental 2026-05-13
splunk Ollama Possible Memory Exhaustion Resource Abuse experimental 2026-05-13
splunk Ollama Possible Model Exfiltration Data Leakage experimental 2026-05-13
splunk Ollama Possible RCE via Model Loading experimental 2026-05-13
splunk Ollama Suspicious Prompt Injection Jailbreak experimental 2026-05-13
splunk PingID Mismatch Auth Source and Verification Response production 2026-05-13
splunk PingID Multiple Failed MFA Requests For User production 2026-05-13
splunk PingID New MFA Method After Credential Reset production 2026-05-13
splunk PingID New MFA Method Registered For User production 2026-05-13
splunk Splunk AppDynamics Secure Application Alerts production 2026-05-13
splunk AWS CreateAccessKey production 2026-05-13
splunk AWS CreateLoginProfile production 2026-05-13
splunk AWS Credential Access Failed Login production 2026-05-13