Data Source
CommonSecurityLog
9 queries tagged with this data source.
-
Analytics Rules
Detect Nextjs Middleware Authorization Bypass
Next.js middleware authorization-bypass pattern — successful requests to authenticated routes without going through the expected auth path.
-
Analytics Rules
Detect Vpn Session Without Prior Authentication
PAN-OS GlobalProtect VPN sessions established without a matching auth event in the preceding 5 minutes — the shape of CVE-2026-0257. Uses windowed leftouter, not range-predicate leftanti.
-
Cost & Ingest / Cost By Table
Top 10 Common Security Logs By Reason With Cost Enhanced
Top `CommonSecurityLog` rows by `Reason` and `LogSeverity` (90d), ranked by event count, with an emoji cost-tier column. Filters out empty/`N/A` reasons.
-
Cost & Ingest / Cost By Table
Top 10 Common Security Logs By Severity With Cost
Top `CommonSecurityLog` groupings by `DeviceVendor`, `DeviceProduct`, and `LogSeverity` (30d), with numeric `CostUSD`.
-
Cost & Ingest / Ingest Trends
30 60 90 Day Common Security Log Ingest Trends
Compare `CommonSecurityLog` volume by `DeviceAction` across 30-, 60-, and 90-day periods to spot which actions are driving growth.
-
Hunting
Hunt Cloud Metadata Ssrf Normalized Forms
Cloud instance-metadata SSRF across every string-form the attacker can write — dotted, dotless, octal, hex, IPv6, dashed hostnames, encoded slashes. Normalizes before matching.
-
Hunting
Hunt Cloud Storage Bucket Lookalike References
References to cloud storage buckets whose names are lookalikes of your real ones — homoglyphs, dashes-for-underscores, plausibly-typosquatted variants.
-
Hunting / Web Tier
Hunt Spring Boot Heapdump Exfiltration Commonsecuritylog
Non-ASIM (`CommonSecurityLog`) variant of the heap-dump hunt. Uses correct CEF field names (`ReceivedBytes` / `SentBytes`) and carries both byte directions because CEF doesn't tell you which side is the response.
-
Posture
Inventory Exposed Spring Boot Actuator Endpoints
Inventory of Spring Boot Actuator endpoints that answer 200 anywhere in your estate — flips the entity from "who scanned us" (infinite) to "which of my services answer" (finite and fixable). Recovers the real management base path from traffic.