Scope
Scope answers: is this host in scope - does it hold any of the incident's pivot points?
At a glance
Question | Is this host in scope? |
Reads | Nothing of its own: every record the other modules read, plus direct checks of file paths and registry keys. |
Needs | A profile with |
Rule prefix |
|
How it works
Scope rides along with the other modules: it is fed every record their sources produce and matches the profile's pivot points against what each record names. It never widens a read - it searches only what the run read anyway. Then it checks directly a full file path on disk and a registry key (pivot_check).
The full list of pivot types and what each is matched against is on Pivot points.
Signals it raises
1 rule: 1 critical. The full text of each is in the rule catalog.
ID | Severity | Title | Evidence | ATT&CK |
|---|---|---|---|---|
| critical | A predefined pivot point from the profile "{profile_name}" was found on this host | run facts | - |
How to read it
One signal per pivot found, its occurrences every record that held it, across evidence types.
The pivots table has a row for every pivot, found or not: where it was found, what its direct check found, which kinds of record were searched, and what a "not found" cannot rule out.
The context you gave each pivot travels with every hit, so a reader knows why it matters.
What it can't see
Next
Run Signal across many hosts: the command line.