The following article exclusively pertains to a Graylog Security feature or functionality. Graylog Security is a part of the Graylog centralized log management platform and requires a separate license. Contact the Graylog
Sales team for more information on this product.
This article contains a full list of all available detectors included in the Graylog Anomaly Detection tool.
For a complete index of all the common message fields populated in each event log message generated by Anomaly Detection, see the corresponding guide.
Detector Index
| Detector Name | Description | Indices | Requires | Anomaly-Specific Fields |
|---|---|---|---|---|
| Palo Alto - Data Exfiltration | This detection monitors Palo Alto logs for any unusual data transfers between hosts. Anomaly analysis is performed per host; events are aggregated by the fields source_ip and destination_ip. |
Palo Alto Logs (Index Prefix: gl_paloalto*) | Palo Alto devices running 9.1.x or greater sending logs to the Graylog Server. Illuminate 2.2.2 with the Palo Alto processing pack and the Anomaly Detection add-on pack enabled. | Monitored fields: source_bytes_sent Added fields: anomaly_total_source_bytes_sent |
| Fortigate - Unusual Data Transfer | This detection monitors the amount of traffic associated with Fortinet Fortigate firewalls. Anomaly analysis is performed per host; events are aggregated by the field source_ip. |
Fortinet Event Log Messages (Index Prefix: gl_forti*) | Fortinet Fortigate configured and sending logs to the Graylog Server. Illuminate 2.2.2 or greater installed with the Fortinet Fortigate technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: anomaly_total_network_bytes |
| Windows Security Event Log - File Deletion | This detection monitors for changes to file deletions in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit file deletion activity. | Categorical Fields: file_delete_count |
| Linux Auditbeat - Unusual Data Transfer | This detection monitors the amount of traffic associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field host_hostname. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server Beats input(s). Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: anomaly_total_network_bytes |
| Palo Alto - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Palo Alto GlobalProtect clients. Anomaly analysis is performed per user; events are aggregated by the field user_name. |
Palo Alto Logs (Index Prefix: gl_paloalto*) | Palo Alto devices running 9.1.x or greater sending logs to the Graylog Server. Illuminate 2.2.2 with the Palo Alto processing pack and the Anomaly Detection add-on pack enabled. | Monitored fields: anomdet_paloalto_logon_failed Added fields: total_logon_failure_count |
| Windows Security Event Log - Failed Authentication | This detection monitors failed authentication for Windows systems. This can include Windows Security Event ID 4625, Event ID 4771, or Event ID 4776 (Failure). Events are aggregated by the field user_name. |
Windows Security Event Log Messages (prefix: gl_windows_security*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit logon and authentication activity. | Categorical Fields: anomaly_total_windows_authentication_failures |
| Office 365 - Failed Authentication | This detection monitors failed authentication for Windows systems. This can include Windows Security Event ID 4625, Event ID 4771, or Event ID 4776 (Failure). Events are aggregated by the field user_name. |
Windows Security Event Log Messages (prefix: gl_windows_security*) | O365 service sending logs to the Graylog Server. Illuminate 2.2.2 with the O365 processing pack and the Anomaly Detection add-on pack enabled | Monitored Fields: anomdet_windows_auth_failure Categorical Fields: total_windows_authentication_failures |
| Windows Security Event Log - File Permissions Change | This detection monitors for changes to file permissions in your environment’s Windows hosts by monitoring Windows Event ID 4670. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit logon and authentication activity. | Added Fields: anomaly_file_perm_change_count |
| Linux Auditbeat - File Deletion | Linux Auditbeat - File DeletionThis detection monitors for changes to file deletions associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field host_reference. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_total_linux_auditbeat_logon_failed |
| Windows Security Event Log - File Write | This detection monitors for changes to file-write events in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the field user_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows systems configured to audit file write activity. | Categorical Fields: anomaly_file_write_count |
| Linux Auditbeat - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Linux hosts. Anomaly analysis is performed per host; events are aggregated by the field user_name. |
Linux Auditbeat Logs (Index Prefix: gl_linux_auditbeat*) | Linux Auditbeat configured with the System module (not part of Beats OSS) and Sockets Dataset enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Linux Auditbeat technology pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_files_deleted_count |
| Okta - Failed Authentication | This detection monitors the amount of authentication activity for failed logon attempts associated with Okta clients. Anomaly analysis is performed per user; events are aggregated by the field user_name. |
Okta Logs (Index Prefix: gl_okta*) | Okta service sending logs to the Graylog Server. Illuminate 2.2.2 with the Okta processing pack and the Anomaly Detection add-on pack enabled. | Added fields: anomaly_total_okta_logon_failed |
| Bluecoat Web Proxy - Data Exfiltration | This detection monitors Bluecoat ProxySG logs for any unusual data transfers between hosts. Anomaly analysis is performed per user; events are aggregated by the fields user_name and destination_ip. |
Symantec Event Log Messages (Index Prefix: gl_symantec*) | Bluecoat ProxySG sending logs to the Graylog Server. Illuminate 2.2.2 with the Symantec ProxySG technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: source_bytes_sent Added fields: anomaly_total_source_bytes_sent |
| Cisco ASA - Unusual Data Transfer | This detection monitors the amount of traffic reported by Cisco ASA devices. Anomaly analysis is performed per network connection; events are aggregated by the fields source_reference and destination_reference. |
Cisco Devices Event Log Messages (Index Prefix: gl_cisco*) | Cisco ASA devices configured and enabled and sending logs to the Graylog Server. Illuminate 2.2.2 or greater with the Cisco ASA technology pack and the Anomaly Detection add-on pack enabled. | Monitored fields: network_bytes Added fields: total_network_bytes |
| Windows Security Event Log - File Enumeration | This detection monitors for read events to files in your environment’s Windows hosts by monitoring Windows Event ID 4663. Events are aggregated by the fields user_name and process_name. |
Windows Event Log Messages (prefix: gl_windows*) | A supported agent configured and sending logs to Graylog. Winlogbeat sending logs to the Graylog Server Beats input(s). NXlog sending logs to the Graylog Server GELF input(s). Illuminate 2.2.2 or greater with the Windows technology pack and the Anomaly Detection add-on pack enabled. Windows system(s) configured to audit file deletion activity. | Categorical Fields: anomaly_file_read_count |
