[Dell] New CDFs

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Access Control List - Failed Logging for Egress.yaml

@@ -0,0 +1,15 @@
+title: Access Control List - Failed Logging for Egress
+description: Dell detection for ACL logging cannot be done in the egress ACL when the log action is enabled on a user created access list that is applied to an interface in the egress direction.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ACL_LOGGING_FOR_EGRESS_ACL*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Access Control List - Table Profile Modified.yml

@@ -0,0 +1,15 @@
+title: Access Control List - Table Profile Modified
+description: Dell detection for ACL table profile is modified to increase or decrease the size that is allocated to a particular application.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ACL_TABLE_PROFILE_MODIFIED*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Alarm Management - Account Event.yml

@@ -0,0 +1,15 @@
+title: Alarm Management - Account Event
+description: Dell detection for user login and accounting event was raised.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ALM_ACCNT_EVENT*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Alarm Management - Authentication Event.yml

@@ -0,0 +1,15 @@
+title: Alarm Management - Authentication Event
+description: Dell detection for user authentication was successful and authentication event was raised.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ALM_AUTH_EVENT*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Alarm Management - Clock Changed.yml

@@ -0,0 +1,15 @@
+title: Alarm Management - Clock Changed
+description: Dell detection for system clock changed event.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ALM_CLOCK_UPDATE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Alarm Management - History Purged.yml

@@ -0,0 +1,15 @@
+title: Alarm Management - History Purged
+description: Dell detection for older version of the alarm history will be purged.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*ALM_HISTORY_PURGED*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Bidirectional Forwarding Detection - State Change.yml

@@ -0,0 +1,15 @@
+title: Bidirectional Forwarding Detection - State Change
+description: Dell detection for BFD session state has changed.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*BFD_STATE_CHANGE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/User Management - Password Changed.yml

@@ -0,0 +1,15 @@
+title: User Management - Password Changed
+description: Dell detection for user password was changed.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*PASSWORD_CHANGE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/User Management - Password Expiration Warning.yml

@@ -0,0 +1,15 @@
+title: User Management - Password Expiration Warning
+description: Dell detection for  the user password is about to expire.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*WARN_CHANGE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/User Management - Role Changed.yml

@@ -0,0 +1,15 @@
+title: User Management - Role Changed
+description: Dell detection for user role was changed.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*USER_ROLE_CHANGE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1

tm-v1-sigma-rules/third_party_logs/Dell/PowerSwitch/Virtual Link Trunking - Port Channel Up.yml

@@ -0,0 +1,15 @@
+title: Virtual Link Trunking - Port Channel Up
+description: Dell detection for VLT LAG is operationally UP in one of the VLT peers.
+references:
+    - https://dl.dell.com/content/manual23434279-dell-smartfabric-os10-system-log-message-reference.pdf?language=en-us
+tags: []
+logsource:
+    category: THIRD_PARTY_LOG
+    product: Dell
+    definition: THIRDPARTY_THIRDPARTY
+detection:
+    string_condition_0:
+        eventName: '*BFD_STATE_CHANGE*'
+    condition: string_condition_0
+level: info
+taxonomy: tm-v1