| 3895 | Stompy (the session stomper) Vulnerability Scanner Detection | info |
| 3813 | Tivoli Network Services Auditor (NSA) Scanner Detection (deprecated) | medium |
| 3807 | Brutus Password Scanning Tool Detection | medium |
| 3805 | MetaSploit Server Detection | medium |
| 3791 | LogMeIn Listening Server Detection | info |
| 3790 | LogMeIn Listening Server Detection | info |
| 3765 | Sipsak VOIP Vulnerability Scanner Detection (deprecated) | info |
| 3761 | SiVus VOIP Vulnerability Scanner Detection (deprecated) | info |
| 3686 | WebInspect Detection | medium |
| 3685 | MetaSploit Shell Detection | medium |
| 3683 | MetaSploit Detection | medium |
| 3660 | GFI Languard Scanner Detection | info |
| 3644 | Dynamic DNS Dynamic Update Client (DUC) Detection | info |
| 3643 | 'The Bat' Mass Mailer Detection | info |
| 3562 | Simple Scanning Tool (SAT) Scanner Detection (deprecated) | medium |
| 3402 | Nmap Scanner Detection | info |
| 3401 | Nmap Scanner Detection | info |
| 3400 | Nmap Scanner Detection | info |
| 3399 | Nmap Scanner Detection | info |
| 3297 | HTTPrint Scanning Software Detection | info |
| 3310 | Absinthe SQL Injection Tool Detection | medium |
| 3298 | Acunetix Web Vulnerability Scanner Detection | info |
| 2841 | webcamXP Camera Detection | medium |
| 2718 | Looking Glass Network Tool Detection | medium |
| 2543 | Tor Tunnel Detection | low |
| 2469 | Retina REM Detection | low |
| 2442 | Visionael Scanner Detection (deprecated) | low |
| 2441 | Paros Web Proxy Detection | low |
| 9060 | BeyondTrust Retina Scanner Detection | info |
| 9059 | BeyondTrust Retina Scanner Detection | info |
| 710050 | Linux Software Detection Application Install (via Splunk): completed update | info |
| 710049 | Windows Assets Discovery Windows DHCP Renew (via Splunk) | info |
| 710048 | Windows Service Modification Service Stop (via Splunk): code 903 | info |
| 710047 | Windows Software Detection Application Install (via Splunk): code 7045 | info |
| 710046 | Windows Software Detection Application Removal (via Splunk): code 1034 | info |
| 710045 | Linux User Account Activity Create User (via Splunk): audit (USER_MGMT) | info |
| 710044 | Linux Service Modification Service Start (via Splunk): systemd (executable .service file) | info |
| 710043 | Linux Service Modification Service Start (via Splunk): systemd (Starting) | info |
| 710042 | Windows Service Modification Service Stop (via Splunk): code 7042 | info |
| 710041 | Windows Software Detection Application Install (via Splunk): code 11707 | info |
| 710040 | Linux Software Detection Application Install (via Splunk): in-progress install or update | info |
| 710039 | Linux User Account Activity Delete User (via Splunk): audit (DEL_USER, deleting user entries) | info |
| 710038 | Linux Service Modification Service Start (via Splunk): dbus | info |
| 710037 | Linux User Account Activity Create User (via Splunk): audit (ADD_USER) | info |
| 710036 | Windows Service Modification Service Start (via Splunk): code 902 | info |
| 710035 | Linux Software Detection Application Removal (via Splunk): yum | info |
| 710034 | Linux User Account Activity Delete User (via Splunk): audit (DEL_USER, not found) | info |
| 710033 | Linux User Account Activity Delete User (via Splunk): audit (DEL_USER, plain) | info |
| 710032 | Linux User Account Activity Change Password (via Splunk): audit (updating password) | info |
| 710031 | Linux User Account Activity Change Password (via Splunk): audit (changing password) | info |
