Retrieves all rules in an organization’s inventory.

​
Example Output

[
	{
		"avl_author": "securityteam@anvilogic.com",
		"avl_community_efficacy": 75,
		"avl_community_rating": 4,
		"avl_custom_labels": [
			"text"
		],
		"avl_data_category": [
			"Powershell logs",
			"Process command-line parameters"
		],
		"avl_deployed": false,
		"avl_details": "Identify hosts using PowerShell commands containing s...",
		"avl_entities_of_interest": [
			"text"
		],
		"avl_exploits": [
			"text"
		],
		"avl_kill_chain_phase": [
			"Actions on Objectives"
		],
		"avl_last_deployed_hash": "text",
		"avl_mitre_ext_ids": [
			"T1059.001",
			"T1007"
		],
		"avl_mitre_tactic": [
			"Execution",
			"Discovery"
		],
		"avl_mitre_technique": [
			"System Service Discovery",
			"Command and Scripting Interpreter"
		],
		"avl_references": [
			"https://github.com/rasta-mouse/Sherlock/blob/master/Sherlock.ps1"
		],
		"avl_rule_confidence": "High",
		"avl_rule_creation_time": "text",
		"avl_rule_domain": [
			"Endpoint"
		],
		"avl_rule_id": "AVL_R1000",
		"avl_rule_link": "https://secure.anvilogic.com/rules?id=AVL_R1000",
		"avl_rule_mode": "Warn",
		"avl_rule_modified_time": "text",
		"avl_rule_name": "avl:ti:avl_r1000:sherlock_ps1_vulnerability_scanner",
		"avl_rule_severity": "Medium",
		"avl_rule_sub_domain": [
			"text"
		],
		"avl_running": false,
		"avl_scenario_info": [
			"text"
		],
		"avl_security_controls": [
			"text"
		],
		"avl_source": "avl:ti:avl_uc1000:sherlock_ps1_vulnerability_scanner",
		"avl_sourcetype": "avl:eoi:endpoint:windows",
		"avl_techniques_fqn": [
			"execution:command and scripting interpreter:powershell",
			"discovery"
		],
		"avl_threat_groups": [
			"text"
		],
		"avl_title": "Sherlock.ps1 Vulnerability Scanner (Powershell)",
		"avl_triage_steps": [
			"Verify that the activity is not expected",
			"Review the authentication..."
		],
		"avl_use_case_category": "Reconnaissance",
		"avl_use_case_description": "The Sherlock PowerShell script queries a...",
		"avl_use_case_id": "AVL_UC1000",
		"avl_use_case_impact": "Low",
		"avl_use_case_name": "avl:ti:avl_uc1000:sherlock_ps1_vulnerability_scanner",
		"avl_use_case_sub_category": "Signature",
		"avl_use_case_title": "Sherlock.ps1 Vulnerability Scanner",
		"avl_use_case_type": "Threat Identifier",
		"avl_victim_platform": [
			"Windows"
		],
		"avl_victim_product": [
			"Windows"
		],
		"avl_vulnerabilities": [
			"text"
		]
	}
]

​
Workflow Library Example

List Rules with Anvilogic and Send Results Via Email

Preview this Workflow on desktop

Was this page helpful?

Get EOI SummaryList Threat Identifiers