{"rules":[{"id":791,"uuid":"d0574756-9a00-4a7c-b299-d1796f3c33a1","group_id":1,"type":"syslog","vendor":"adt","product":"*","is_system":false,"is_active":true,"is_removed":false,"incident_name":"\u041a\u043e\u043f\u0438\u044f \u041c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 rudesktop, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430","incident_description":"The correlation rule \"Cisco Wireless: Numerous unsuccessful authentication attempts on the access point\" is triggered when an access point logs multiple failed authentication attempts within a specified timeframe. This rule helps to identify potential unauthorized access attempts or misconfigurations, ensuring that network security teams can quickly respond to possible threats or issues with legitimate user access","incident_type":"","incident_weight":5,"created_at":"2026-03-19 07:58:27","updated_at":"2026-03-19 10:47:20","group_by":["host","src.mac"],"time_period":["00:00 - 24:00","00:00 - 08:00|21:00 - 24:00","00:00 - 08:00|21:00 - 24:00","00:00 - 08:00|21:00 - 24:00","21:00 - 24:00|00:00 - 08:00","00:00 - 08:00|21:00 - 24:00","00:00 - 24:00"],"rule_condition_list":["(\\\"SESSION_STARTED\\\" contains [eventlog][category] )"],"rule_operator_list":[">="],"rule_counter_list":[1],"rule_period_list":[60],"rule_function_list":[""],"group_by_operator":"or","group_uuid":"cb59acd7-d1b1-4ced-bb1b-be7ff1975fef","incident_reopen":true,"event_body":"","is_generate_incident":true,"rules":[{"rule_number":0,"rule_operator":">=","rule_period":"60","rule_counter":"1","rule_function":null,"rule_condition":"(\"SESSION_STARTED\" contains [eventlog][category] )","conditions":[{"logical_negation":false,"left_operand":"(","field":"eventlog.category","operator":"contains","value":"SESSION_STARTED","lists":"","right_operand":")","end_operator":"AND","extra_operator":"","params":"","extra_params":[],"array_values":[],"id":"00","case_insensitive":0}],"actions":[],"counter_is_active":true}],"nodes":null,"rule_status":"ok","links":[""],"mitre_technique":[],"rule_actions_list":[null],"inc_cat_uuid":"59cd2b70-8eba-4199-a073-f142aedde2e4","group_inc_cat_uuid":"75f3f7db-4a3f-4edb-b7b4-862515f463c1","incidents_max_count":0,"incidents_count_time":0,"system_auto_disable":true,"create_correlation_event":false,"event_fields":[],"group_name":"Root","translation":[{"id":13132,"model":"App\\Models\\CorrelationRule","field":"incident_name","locale":"en","model_id":791,"text":"Copy Copy Cisco Wireless: Numerous unsuccessful authentication attempts on the access point","created_at":"2026-03-19 07:58:27","updated_at":"2026-03-19 07:58:27"},{"id":13133,"model":"App\\Models\\CorrelationRule","field":"incident_description","locale":"en","model_id":791,"text":"The correlation rule \"Cisco Wireless: Numerous unsuccessful authentication attempts on the access point\" is triggered when an access point logs multiple failed authentication attempts within a specified timeframe. This rule helps to identify potential unauthorized access attempts or misconfigurations, ensuring that network security teams can quickly respond to possible threats or issues with legitimate user access","created_at":"2026-03-19 07:58:27","updated_at":"2026-03-19 07:58:27"},{"id":13134,"model":"App\\Models\\CorrelationRule","field":"incident_name","locale":"ru","model_id":791,"text":"Rudesktop: \u041e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0432\u043d\u0435 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438.","created_at":"2026-03-19 07:58:27","updated_at":"2026-03-19 10:47:20"},{"id":13135,"model":"App\\Models\\CorrelationRule","field":"incident_description","locale":"ru","model_id":791,"text":"\u041f\u0440\u0430\u0432\u0438\u043b\u043e \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043e\u043f\u043e\u0432\u0435\u0449\u0435\u043d\u0438\u044f \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0447\u0435\u0440\u0435\u0437 Rudesktop \u0432\u043d\u0435 \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438.","created_at":"2026-03-19 07:58:27","updated_at":"2026-03-19 08:10:33"}],"notify":[],"cmd_shells":[],"retro":null,"auto_disable":null,"assigned_users":[],"assigned_roles":["\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440","\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u0418\u0411","\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440"]},{"id":792,"uuid":"0707a130-1fd6-465e-9664-acc8b80e4d5c","group_id":88,"type":"syslog","vendor":"adt","product":"*","is_system":false,"is_active":true,"is_removed":false,"incident_name":"\u041c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 rudesktop 2","incident_description":"\u041f\u0440\u0430\u0432\u0438\u043b\u043e \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043e\u043f\u043e\u0432\u0435\u0449\u0435\u043d\u0438\u044f \u043e \u0441\u0435\u0440\u0438\u0438 \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Rudesktop \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e.\n\u042d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0442\u0438 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043c\u0435\u0440\u044b \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","incident_type":"","incident_weight":2,"created_at":"2026-03-19 08:14:37","updated_at":"2026-03-19 10:48:05","group_by":["host","src.ip"],"time_period":"","rule_condition_list":["(\\\"AUTH_BLOCK_IP\\\" contains [eventlog][category] )"],"rule_operator_list":[">="],"rule_counter_list":[1],"rule_period_list":[900],"rule_function_list":[""],"group_by_operator":"or","group_uuid":"3600e18e-6abb-4d0d-a45e-0ab33b477293","incident_reopen":true,"event_body":"","is_generate_incident":true,"rules":[{"rule_number":0,"rule_counter":1,"rule_period":900,"rule_operator":">=","conditions":[{"id":"00","field":"eventlog.category","extra_operator":"","operator":"contains","value":"AUTH_BLOCK_IP","params":"","compare_key_period":"","extra_params":[],"left_operand":"(","right_operand":")","end_operator":"AND","logical_negation":0,"array_values":[],"case_insensitive":0}],"actions":[],"counter_is_active":true,"rule_function":null,"rule_condition":"(\"AUTH_BLOCK_IP\" contains [eventlog][category] )"}],"nodes":null,"rule_status":"ok","links":[""],"mitre_technique":[],"rule_actions_list":[null],"inc_cat_uuid":"6c0fb9c7-47a7-4809-947a-11602c60197f","group_inc_cat_uuid":"75f3f7db-4a3f-4edb-b7b4-862515f463c1","incidents_max_count":0,"incidents_count_time":0,"system_auto_disable":true,"create_correlation_event":false,"event_fields":[],"group_name":"Test","translation":[{"id":13136,"model":"App\\Models\\CorrelationRule","field":"incident_name","locale":"ru","model_id":792,"text":"Rudesktop: \u041c\u043d\u043e\u0433\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0435\u0443\u0441\u043f\u0435\u0448\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441.","created_at":"2026-03-19 08:14:37","updated_at":"2026-03-19 10:47:40"},{"id":13137,"model":"App\\Models\\CorrelationRule","field":"incident_description","locale":"ru","model_id":792,"text":"\u041f\u0440\u0430\u0432\u0438\u043b\u043e \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043e \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043e\u043f\u043e\u0432\u0435\u0449\u0435\u043d\u0438\u044f \u043e \u0441\u0435\u0440\u0438\u0438 \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u044b\u0445 \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f Rudesktop \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0435 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u0433\u043e.\n\u042d\u0442\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0442\u0438 \u0438 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0442\u044c \u043c\u0435\u0440\u044b \u0434\u043b\u044f \u0443\u0441\u0438\u043b\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.","created_at":"2026-03-19 08:14:37","updated_at":"2026-03-19 08:14:37"}],"notify":[],"cmd_shells":[],"retro":null,"auto_disable":null,"assigned_users":[],"assigned_roles":["\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440","\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u0418\u0411","\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u0418\u0422","\u041e\u043f\u0435\u0440\u0430\u0442\u043e\u0440"]},{"id":793,"uuid":"77d2e43b-a542-42e3-81a1-78fc95bd59a6","group_id":88,"type":"syslog","vendor":"adt","product":"*","is_system":false,"is_active":true,"is_removed":false,"incident_name":"\u041a\u0430\u043a\u0430\u044f-\u0442\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0430\u0441\u044c \u043d\u0435 \u043d\u0430 \u0432\u0441\u0435\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0443\u0441\u043f\u0435\u0448\u043d\u043e.","incident_description":"\u042d\u0442\u0430 \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043b\u044e\u0431\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0435\\\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Rudesktop - \u0431\u044b\u043b \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u0438\u043d \u0445\u043e\u0441\u0442, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\\\u0437\u0430\u0434\u0430\u0447\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u043e.","incident_type":"","incident_weight":3,"created_at":"2026-03-19 10:46:17","updated_at":"2026-03-19 10:46:58","group_by":["host","src.ip"],"time_period":"","rule_condition_list":["(\\\"JOB_RESULT\\\" contains [eventlog][category] ) AND ([outcome][result] notrgxp \/\\\\\\\"failures\\\\\\\":\\\\s[0]\/)"],"rule_operator_list":[">="],"rule_counter_list":[1],"rule_period_list":[900],"rule_function_list":[""],"group_by_operator":"or","group_uuid":"3600e18e-6abb-4d0d-a45e-0ab33b477293","incident_reopen":true,"event_body":"","is_generate_incident":true,"rules":[{"rule_number":0,"rule_counter":1,"rule_period":900,"rule_operator":">=","conditions":[{"id":"00","field":"eventlog.category","extra_operator":"","operator":"contains","value":"JOB_RESULT","params":"","compare_key_period":"","extra_params":[],"left_operand":"(","right_operand":")","end_operator":"AND","logical_negation":0,"array_values":[],"case_insensitive":0},{"id":"01","field":"outcome.result","extra_operator":"","operator":"notrgxp","compare_key_period":"","value":"\\\"failures\\\":\\s[0]","params":"","extra_params":[],"left_operand":"(","right_operand":")","end_operator":"AND","logical_negation":0,"array_values":[],"case_insensitive":0}],"actions":[],"counter_is_active":true,"rule_function":null,"rule_condition":"(\"JOB_RESULT\" contains [eventlog][category] ) AND ([outcome][result] notrgxp \/\\\"failures\\\":\\s[0]\/)"}],"nodes":null,"rule_status":"ok","links":[""],"mitre_technique":[],"rule_actions_list":[null],"inc_cat_uuid":"c7f329e5-e563-4b10-833d-0e3a17e022ef","group_inc_cat_uuid":"75f3f7db-4a3f-4edb-b7b4-862515f463c1","incidents_max_count":0,"incidents_count_time":0,"system_auto_disable":true,"create_correlation_event":false,"event_fields":[],"group_name":"Test","translation":[{"id":13138,"model":"App\\Models\\CorrelationRule","field":"incident_name","locale":"ru","model_id":793,"text":"Rudesktop: \u041a\u0430\u043a\u0430\u044f-\u0442\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0430\u0441\u044c \u043d\u0435 \u043d\u0430 \u0432\u0441\u0435\u0445 \u0445\u043e\u0441\u0442\u0430\u0445 \u0443\u0441\u043f\u0435\u0448\u043d\u043e.","created_at":"2026-03-19 10:46:17","updated_at":"2026-03-19 10:46:58"},{"id":13139,"model":"App\\Models\\CorrelationRule","field":"incident_description","locale":"ru","model_id":793,"text":"\u042d\u0442\u0430 \u043a\u043e\u0440\u0440\u0435\u043b\u044f\u0446\u0438\u044f \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u043b\u044e\u0431\u043e\u0439 \u0437\u0430\u0434\u0430\u0447\u0435\\\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 Rudesktop - \u0431\u044b\u043b \u0445\u043e\u0442\u044f \u0431\u044b \u043e\u0434\u0438\u043d \u0445\u043e\u0441\u0442, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\\\u0437\u0430\u0434\u0430\u0447\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u043b\u0430\u0441\u044c \u043d\u0435\u0443\u0434\u0430\u0447\u043d\u043e.","created_at":"2026-03-19 10:46:17","updated_at":"2026-03-19 10:46:17"}],"notify":[],"cmd_shells":[],"retro":null,"auto_disable":null,"assigned_users":[],"assigned_roles":["\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440","\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u0418\u0411","\u0410\u043d\u0430\u043b\u0438\u0442\u0438\u043a \u0418\u0422","\u0410\u0443\u0434\u0438\u0442\u043e\u0440"]}],"removed_rules":[],"groups":[{"id":1,"uuid":"cb59acd7-d1b1-4ced-bb1b-be7ff1975fef","name":"Root","parent_id":null,"is_system":true,"is_removed":false,"created_at":"2026-02-24 11:49:57","updated_at":"2026-02-24 11:49:57","inc_cat_uuid":"75f3f7db-4a3f-4edb-b7b4-862515f463c1","translation":[{"id":2910,"model":"App\\Models\\CorrelationGroup","field":"name","locale":"en","model_id":1,"text":"Root","created_at":"2026-02-24 11:49:57","updated_at":"2026-02-24 11:49:57"},{"id":2911,"model":"App\\Models\\CorrelationGroup","field":"name","locale":"ru","model_id":1,"text":"Root","created_at":"2026-02-24 11:49:57","updated_at":"2026-02-24 11:49:57"}]},{"id":88,"uuid":"3600e18e-6abb-4d0d-a45e-0ab33b477293","name":"Test","parent_id":1,"is_system":true,"is_removed":false,"created_at":"2026-02-24 11:49:59","updated_at":"2026-02-24 11:49:59","inc_cat_uuid":"75f3f7db-4a3f-4edb-b7b4-862515f463c1","translation":[{"id":3084,"model":"App\\Models\\CorrelationGroup","field":"name","locale":"en","model_id":88,"text":"Test","created_at":"2026-02-24 11:49:59","updated_at":"2026-02-24 11:49:59"},{"id":3085,"model":"App\\Models\\CorrelationGroup","field":"name","locale":"ru","model_id":88,"text":"Test","created_at":"2026-02-24 11:49:59","updated_at":"2026-02-24 11:49:59"}]}],"removed_groups":[],"dynTables":[],"dynLists":[],"staticLists":[],"statTables":[]}