Rules: Threat Intel - Inbound Traffic Context

Description

This rule detects allowed inbound traffic from an IP address associated with a known malicious campaign as designated by threat intelligence.

Detail	Value
Type	Templated Match
Category	Threat Intelligence
Apply Risk to Entities	srcDevice_ip
Signal Name	Threat Intel - Inbound Traffic Context
Summary Expression	This rule detects inbound traffic from an IP address associated with a known malicious campaign as designated by threat intelligence.
Score/Severity	Static: 0
Enabled by Default	True
Prototype	False
Tags