mirror of
https://github.com/socfortress/Wazuh-Rules.git
synced 2025-10-23 00:02:11 +00:00
44 lines
1.3 KiB
XML
44 lines
1.3 KiB
XML
<group name="sophos,api">
|
|
<rule id="200700" level="5">
|
|
<field name="customer_id">\.+</field>
|
|
<description>Sophos Alert - $(name)</description>
|
|
</rule>
|
|
</group>
|
|
<group name="sophos,low">
|
|
<rule id="200701" level="1">
|
|
<if_sid>200700</if_sid>
|
|
<field name="severity">low</field>
|
|
<description>Low Sophos Alert - $(name)</description>
|
|
</rule>
|
|
</group>
|
|
<group name="sophos,medium">
|
|
<rule id="200702" level="10">
|
|
<if_sid>200700</if_sid>
|
|
<field name="severity">medium</field>
|
|
<description>Medium Sophos Alert - $(name)</description>
|
|
</rule>
|
|
</group>
|
|
<group name="sophos,high">
|
|
<rule id="200703" level="12">
|
|
<if_sid>200700</if_sid>
|
|
<field name="severity">high</field>
|
|
<description>High Sophos Alert - $(name)</description>
|
|
</rule>
|
|
</group>
|
|
<group name="sophos,health">
|
|
<rule id="200704" level="5">
|
|
<field name="healthcheck">bad</field>
|
|
<description>Sophos Alert - Bad Health</description>
|
|
</rule>
|
|
<rule id="200705" level="5">
|
|
<field name="healthcheck">good</field>
|
|
<description>Sophos Alert - Good Health</description>
|
|
</rule>
|
|
</group>
|
|
<group name="sophos,sophos_inventory">
|
|
<rule id="200706" level="5">
|
|
<field name="assignedProducts">\.+</field>
|
|
<description>Sophos Alert - Inventory</description>
|
|
</rule>
|
|
</group>
|