This repository currently contains rules for detecting access to specific domains of known generative AI tools and associated file activities across different SIEM platforms: Splunk, IBM QRadar, Microsoft Sentinel, and Elastic (ELK) Stack.
The repository is organized by platform, each containing the specific detection rule.
- Navigate to the folder corresponding to your SIEM platform.
- Copy and paste the rule into your SIEM.
- Make any changes required to match your file naming structure and data sources.
We welcome contributions to expand and improve these detection rules. Please open an issue or submit a pull request with your enhancements.
This repository is licensed under the MIT License.