SYNOTI / Alerts & Rules
Alerts & Rules
Security detections, triage rules and automated containment · Updated 30s ago
Active Detections
148
12 in the last 24h
Critical Threats
12
2 new since yesterday
Auto-Contained
62%
of incidents · PB-041
IOCs Enriched / 24h
1.2M
8% coverage growth
Blocked by Reputation
9,847
9% automatic blocks
Detections by Source
Threat Score Distribution
Top MITRE Techniques
Active Detections
| Detection | Severity | Source | Status | Age |
|---|---|---|---|---|
| SSH brute force from 203.0.113.45 — ws-05 | High | Wazuh IDS/IPS | Open | 12m |
| Ransomware behavior on mail-01 | Critical | Wazuh EDR | Contained | 2m |
| DNS tunneling — exfil to 198.51.100.34 | Critical | Wazuh XDR | Investigating | 1h 20m |
| PowerShell encoded command — ws-05 | High | Wazuh EDR | Open | 41m |
| Office macro execution — HR-2026.xlsm | High | Mail Gateway (Postfix) | Open | 3h 30m |
| Phishing campaign — finance dept | Medium | Mail Gateway (Postfix) | Investigating | 1h |
| SMB lateral movement — waves | High | Wazuh IDS/IPS | Investigating | 9h |
| Policy violation — USB usage | Low | Wazuh XDR | Resolved | 3h |
Detection Rules — Top Hit
| Rule | Severity | Hits / 24h | Status |
|---|---|---|---|
| Ransomware behavior | CRITICAL | 42 | Active |
| DNS tunneling | CRITICAL | 18 | Active |
| SSH brute force | HIGH | 156 | Active |
| PowerShell encoded | HIGH | 33 | Active |
| Office macro exec | MEDIUM | 61 | Draft |
Triage Rules
| Rule | Match | Action | Status |
|---|---|---|---|
| critical-to-soc | severity=critical | Assign SOC lead + ChatOps | Active |
| auto-contain-ransom | rule=ransomware* | Run PB-041 auto-contain | Active |
| phish-quarantine | source=email & phish* | Quarantine + notify | Active |
| test-noise | source=~test.* | Drop | Paused |
Recent Activity
View allIncident INC-32464 opened — high CPU on app-02 CRITICAL
Auto-remediation playbook PB-031 triggered
Worker k8s-07 at 91% load
Auto-scaled +2 workers to queue 'scan'
Backup completed — 1.4 TB in 8m 12s
Snapshot verified · retention 30 days
Sync task 's3-archive' finished
2,104 objects · 0 conflicts
phy-12 added to monitoring
18 agents enrolled · health 100
Task T-9912 'patch-cron' succeeded
Ran on 96 hosts · 0 errors