|
| 1 | +# |
| 2 | +# config classification:shortname,short description,priority |
| 3 | +# |
| 4 | + |
| 5 | +config classification: not-suspicious,Not Suspicious Traffic,3 |
| 6 | +config classification: unknown,Unknown Traffic,3 |
| 7 | +config classification: bad-unknown,Potentially Bad Traffic, 2 |
| 8 | +config classification: attempted-recon,Attempted Information Leak,2 |
| 9 | +config classification: successful-recon-limited,Information Leak,2 |
| 10 | +config classification: successful-recon-largescale,Large Scale Information Leak,2 |
| 11 | +config classification: attempted-dos,Attempted Denial of Service,2 |
| 12 | +config classification: successful-dos,Denial of Service,2 |
| 13 | +config classification: attempted-user,Attempted User Privilege Gain,1 |
| 14 | +config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1 |
| 15 | +config classification: successful-user,Successful User Privilege Gain,1 |
| 16 | +config classification: attempted-admin,Attempted Administrator Privilege Gain,1 |
| 17 | +config classification: successful-admin,Successful Administrator Privilege Gain,1 |
| 18 | + |
| 19 | +# NEW CLASSIFICATIONS |
| 20 | +config classification: rpc-portmap-decode,Decode of an RPC Query,2 |
| 21 | +config classification: shellcode-detect,Executable code was detected,1 |
| 22 | +config classification: string-detect,A suspicious string was detected,3 |
| 23 | +config classification: suspicious-filename-detect,A suspicious filename was detected,2 |
| 24 | +config classification: suspicious-login,An attempted login using a suspicious username was detected,2 |
| 25 | +config classification: system-call-detect,A system call was detected,2 |
| 26 | +config classification: tcp-connection,A TCP connection was detected,4 |
| 27 | +config classification: trojan-activity,A Network Trojan was detected, 1 |
| 28 | +config classification: unusual-client-port-connection,A client was using an unusual port,2 |
| 29 | +config classification: network-scan,Detection of a Network Scan,3 |
| 30 | +config classification: denial-of-service,Detection of a Denial of Service Attack,2 |
| 31 | +config classification: non-standard-protocol,Detection of a non-standard protocol or event,2 |
| 32 | +config classification: protocol-command-decode,Generic Protocol Command Decode,3 |
| 33 | +config classification: web-application-activity,access to a potentially vulnerable web application,2 |
| 34 | +config classification: web-application-attack,Web Application Attack,1 |
| 35 | +config classification: misc-activity,Misc activity,3 |
| 36 | +config classification: misc-attack,Misc Attack,2 |
| 37 | +config classification: icmp-event,Generic ICMP event,3 |
| 38 | +config classification: inappropriate-content,Inappropriate Content was Detected,1 |
| 39 | +config classification: policy-violation,Potential Corporate Privacy Violation,1 |
| 40 | +config classification: default-login-attempt,Attempt to login by a default username and password,2 |
| 41 | + |
| 42 | +# Update |
| 43 | +config classification: targeted-activity,Targeted Malicious Activity was Detected,1 |
| 44 | +config classification: exploit-kit,Exploit Kit Activity Detected,1 |
| 45 | +config classification: external-ip-check,Device Retrieving External IP Address Detected,2 |
| 46 | +config classification: domain-c2,Domain Observed Used for C2 Detected,1 |
| 47 | +config classification: pup-activity,Possibly Unwanted Program Detected,2 |
| 48 | +config classification: credential-theft,Successful Credential Theft Detected,1 |
| 49 | +config classification: social-engineering,Possible Social Engineering Attempted,2 |
| 50 | +config classification: coin-mining,Crypto Currency Mining Activity Detected,2 |
| 51 | +config classification: command-and-control,Malware Command and Control Activity Detected,1 |
0 commit comments