March 24, 2025 - Content Release
This content release includes Threat Intelligence match rules that use the new hasThreatMatch operator to support both global and custom threat intelligence feeds.
To reduce initial signal volume, basic inbound and outbound IP address threat match rules with a low or medium confidence level are disabled by default (see below). We highly recommend tuning these rules before enabling them to reduce signal volume, and therefore entity risk assignment, to manageable levels.
Rules
- MATCH-S00999 Threat Intel - IMPHASH Match
- MATCH-S01000 Threat Intel - MD5 Match
- MATCH-S01001 Threat Intel - PEHASH Match
- MATCH-S01002 Threat Intel - SSDEEP Match
- MATCH-S01003 Threat Intel - SHA1 Match
- MATCH-S01004 Threat Intel - SHA256 Match
- MATCH-S01005 Threat Intel - Source Hostname
- MATCH-S01006 Threat Intel - Device Hostname
- MATCH-S01007 Threat Intel - Destination Device Hostname
- MATCH-S01008 Threat Intel - HTTP Hostname
- MATCH-S01009 Threat Intel - HTTP Referrer Hostname
- MATCH-S01010 Threat Intel - DNS Query Domain
- MATCH-S01011 Threat Intel - DNS Reply Domain
- MATCH-S01012 Threat Intel - HTTP Referrer Domain
- MATCH-S01013 Threat Intel - HTTP URL Root Domain
- MATCH-S01014 Threat Intel - HTTP URL FQDN
- MATCH-S01015 Threat Intel - HTTP URL
- MATCH-S01025 Threat Intel - Inbound Traffic from Threat Feed IP (Low Confidence) - Disabled By Default
- MATCH-S01026 Threat Intel - Destination IP Address (Low Confidence) - Disabled By Default
- MATCH-S01027 Threat Intel - Inbound Traffic from Threat Feed IP (Medium Confidence) - Disabled By Default
- MATCH-S01028 Threat Intel - Destination IP Address (Medium Confidence) - Disabled By Default
- MATCH-S01023 Threat Intel - Inbound Traffic from Threat Feed IP (High Confidence)
- MATCH-S01024 Threat Intel - Destination IP Address (High Confidence)
- MATCH-S01018 Threat Intel - Successful Authentication from Threat Feed IP
