Detection Quick Reference

This reference summarizes every detection family that MetaDefender NDR produces on MVP. The order is signature-driven, intelligence-driven, behavioral, and machine-learning. Analysts scan this table when they triage an unfamiliar alert. The Detection Name column matches the alert_type value on the wire. It also matches the Hunt sub-tab label in the user interface. The Primary Trigger Condition column summarizes the rule predicate in one line. The Severity Range column gives the native band before IOC auto-escalation. The Hunt Tab column names the Hunt page sub-tab under All Alerts. The Runbook column points at the investigation procedure in Investigation Runbooks.

First-use acronym expansions in this chapter:

C2: command-and-control.
TIDB: Threat Intelligence Database.
REPDB: Reputation Database.
AV: antivirus.
SID: Signature Identifier.
DGA: Domain Generation Algorithm.
DNS: Domain Name System.
TTL: Time To Live.
NXDOMAIN: Non-Existent Domain DNS response.
IOC: Indicator of Compromise.
RCF: Random Cut Forest.
ML: machine learning.
MVP: Minimum Viable Product.
MB: megabyte.
SHA-256: Secure Hash Algorithm 256-bit.
RFC-1918: IETF-reserved private IP ranges.
STDDEV: standard deviation.

How to read this table

Detection Name matches the alert_type field on the wire. Examples include c2, beaconing, and ml_rcf_anomaly. It also matches the Hunt page's per-type sub-tab under All Alerts. Italics identify the ndr-alerts rule that produces the alert.
Family is the detection engine group. Values are Signature (Suricata), IOC, File Scan, Behavioral, or ML.
Engine identifies the pipeline stage that produced the signal. Examples are the Suricata sensor process, a named enrichment service, the RisingWave streaming pipeline, and the RCF streaming pipeline.
Primary Trigger Condition is a one-line plain-English rendering of the when clause. The per-family chapters in Detections give the exact predicate.
Severity Range shows the native bands the rule assigns. The IOC auto-escalation rule applies to every row. If any entity on the event coincides with a C2, TIDB, or REPDB hit, the Manager promotes the alert. The alert becomes Critical severity at 0.99 confidence regardless of the native band.
Hunt Tab is the Hunt page sub-tab under All Alerts. Click a row in any sub-tab. The Hunt detail sidebar opens with the family-specific enrichment section expanded.
Runbook points at the investigation procedure analysts follow when the alert needs more than surface-level triage.

Quick reference

Detection name	Family	Engine	Primary trigger condition	Severity range	Hunt tab	Runbook
Suricata signature alert	Signature	Suricata IDS engine inside the sensor process	A shipped Proofpoint Emerging Threats Pro, OPSWAT local, or community rule matched packet content, protocol metadata, or flow shape. Rule-native severity 1-4 passes straight through.	Critical / High / Medium / Low (maps native 1-4 one-to-one)	Suricata Alert	Critical alert triage - Alert flow and PCAP pivoting
C2 Infrastructure (IP)	IOC	`ndr-enrichment-c2` against the OPSWAT Eyelet feed	The event's destination IP exactly matches an entry on the Eyelet C2 feed. An IP in a DNS answer can also match. `c2.matches[].type` is `ip` or `ip_from_dns`. `has_c2_match == true`.	Critical (always -- IOC)	C2 Infrastructure Alert	C2 beacon investigation
C2 Infrastructure (DNS)	IOC	`ndr-enrichment-c2` against the OPSWAT Eyelet feed	The event's queried DNS name exactly matches an entry on the Eyelet C2 feed (`c2.matches[].type` is `dns`, `has_c2_match == true`).	Critical (always -- IOC)	C2 Infrastructure Alert	C2 beacon investigation
InSights TIDB	IOC	`ndr-enrichment-insights` against the OPSWAT Threat Intelligence Database	An entity on the event matched the curated TIDB feed. The entity can be an IP, hostname, or parent-domain hierarchy across DNS, TLS, or HTTP. `insights.has_tidb_match == true`.	High (always -- IOC)	InSights Alert	Critical alert triage - C2 beacon investigation
InSights REPDB	IOC	`ndr-enrichment-insights` against the OPSWAT Reputation Database	An entity matched the REPDB feed (`insights.has_repdb_match == true`) and no entity on the event matched TIDB. The mutual-exclusion guard suppresses REPDB when TIDB fires on the same event.	Medium (always -- IOC)	InSights Alert	Critical alert triage - Alert flow and PCAP pivoting
MetaDefender High AV	File Scan	`ndr-enrichment-mdcore` against MetaDefender Cloud or Core	An extracted file returned `threat_found == true`. The maximum `positive_engines` across all files on the event is >= 6. This is broad multi-AV agreement on a malicious verdict.	High	MDCore Alert	Malicious file investigation
MetaDefender Medium AV	File Scan	`ndr-enrichment-mdcore` against MetaDefender Cloud or Core	An extracted file returned `threat_found == true`. The maximum `positive_engines` across all files on the event is 3, 4, or 5. This is the early-detection band before broad vendor agreement.	Medium	MDCore Alert	Malicious file investigation
MetaDefender Low AV	File Scan	`ndr-enrichment-mdcore` against MetaDefender Cloud or Core	An extracted file returned `threat_found == true`. The maximum `positive_engines` across all files on the event is 1 or 2. This can be a false positive. Before escalation, corroborate with source host, destination, and filename.	Low	MDCore Alert	Malicious file investigation - Alert flow and PCAP pivoting
Beaconing	Behavioral	RisingWave streaming SQL over merged events	The `(src_ip, dest_ip, dest_port)` tuple recorded >= 15 connections over a 4-hour hopping window (1-hour slide). It also recorded STDDEV(bytes) < 1,000 and `server_packets < connections x 5`. The pipeline excludes RFC-1918 destinations, broadcast/multicast, and DNS/DHCP/NTP ports.	Critical (>= 50 connections) / High (>= 30) / Medium (>= 20) / Low (>= 15)	Beaconing Detection Alert	C2 beacon investigation
Data Exfiltration	Behavioral	RisingWave streaming SQL over merged events	The `(src_ip, dest_ip, dest_port, app_proto)` tuple recorded an upload-to-download byte ratio >= 2:1. It recorded total upload >= 1 MB over a 15-minute hopping window (5-minute slide). `src_ip` is inside RFC-1918. `dest_ip` is outside RFC-1918.	Critical: ratio >= 10:1 AND upload >= 100 MB. High: ratio >= 5:1 AND upload >= 10 MB, or ratio >= 2:1 AND upload >= 100 MB. Medium: ratio >= 2:1 AND upload >= 10 MB. Low: ratio >= 2:1 AND upload >= 1 MB.	Data Exfiltration Detection Alert	Data exfiltration investigation
Long Duration Flow	Behavioral	RisingWave streaming SQL over merged events	A single flow record reported `flow.age >= 3,600 seconds` (1 hour). The alert re-emits at the 10-, 20-, and 24-hour thresholds. Analysts can watch the severity escalate without losing the original.	Critical (>= 24 hours -- RED) / High (>= 10 hours -- ORANGE) / Medium (>= 1 hour -- YELLOW)	Long Duration Flow Alert	C2 beacon investigation - Alert flow and PCAP pivoting
Port Scan	Behavioral	RisingWave streaming SQL over merged events	The `(src_ip, dest_ip)` pair touched >= 10 distinct destination ports over a 1-hour hopping window (15-minute slide). This is a vertical scan on one target.	Critical (>= 100 ports) / High (>= 50) / Medium (>= 20) / Low (>= 10)	Port Scan Detection Alert	Critical alert triage - Alert flow and PCAP pivoting
Connection Spray	Behavioral	RisingWave streaming SQL over merged events	One `src_ip` touched >= 20 distinct destination IPs over a 1-hour hopping window (15-minute slide). This is a horizontal scan across the network.	Critical (>= 200 destinations) / High (>= 100) / Medium (>= 50) / Low (>= 20)	Connection Spray Detection Alert	Critical alert triage
DNS Tunneling	Behavioral	RisingWave streaming SQL over merged events	A DNS query satisfied at least one of five suspicion indicators (`LENGTH(query_name) > 50`, > 3 subdomain levels, record type in `TXT`/`NULL`/`CNAME`, answer > 200 chars, first subdomain label > 25 chars). The `suspicion_score` is the count of satisfied indicators (0-5).	Critical (IOC) / High (score >= 3) / Medium (score = 2) / Low (score = 1)	DNS Tunneling Suspicious Alert	Tunneling investigation
DGA	Behavioral	RisingWave streaming SQL over merged events	One `src_ip` recorded an NXDOMAIN ratio >= 0.5 with >= 20 total queries over a 1-hour tumbling window. Alternatively, any query matched an IOC. The combined threshold separates DGA behavior from benign typos or misconfigurations.	Critical (IOC) / High (ratio >= 0.7 AND queries >= 50) / Medium (ratio >= 0.5 AND queries >= 20) / Low (above minimum)	DGA Detection Alert	C2 beacon investigation
Fast Flux	Behavioral	RisingWave streaming SQL over merged events	A queried domain resolved to >= 5 unique response IPs with average TTL < 600 seconds over a 1-hour tumbling window. Alternatively, any response matched an IOC. The TTL cutoff separates fast flux from legitimate content-delivery networks.	Critical (IOC) / High (unique IPs >= 10 AND avg TTL < 300) / Medium (unique IPs >= 5 AND avg TTL < 600) / Low (above minimum)	Fast Flux Detection Alert	C2 beacon investigation
ML Anomaly (RCF)	ML	RCF streaming pipeline over merged events	A per-event anomaly score crossed the per-event-type threshold after whitelist adjustment. Thresholds are DNS >= 3.0, HTTP >= 8.0, and Flow >= 20.0. Single pass-through rule matching `alert_type == "ml_rcf_anomaly"`.	Medium (always on MVP -- score magnitude drives confidence, not severity)	ML RCF Anomaly Event	ML anomaly investigation

Read the severity column

The Severity Range column lists the native bands each detection assigns before any cross-family escalation. Three patterns recur across the table.

Always-single-band. The IOC families and the ML anomaly family assign exactly one severity. The IOC families are C2 IP, C2 DNS, TIDB, and REPDB. The match is binary because it uses feed membership. The RCF pipeline does not differentiate by score on MVP. C2 is always Critical. TIDB is always High. REPDB is always Medium. ML is always Medium.
Threshold-tiered. Behavioral detections, MetaDefender Core file scan, and Suricata native severity use numeric thresholds to assign a band. A single detection can land in any of the four bands. The band depends on the magnitude of the evidence. For example, 15 beaconing connections raises Low. 50 beaconing connections raises Critical. The thresholds are not tunable at the alert level. The detection chapters document them. Thus, analysts know what drove an alert into a band.
IOC auto-escalation. Every family participates in the unified auto-escalation rule defined in unified security scale. If any entity on the alert coincides with a C2, TIDB, or REPDB hit, the Manager promotes the alert. The alert becomes Critical / 0.99 regardless of its native band. Analysts distinguish threshold-Critical from IOC-Critical by reading the sidebar. An IOC-Critical alert carries a companion C2 Enrichment or InSights Enrichment section with the matched indicator.

Read the runbook column

Every runbook has a specific investigative starting point. A given alert can route through multiple runbooks in sequence. The Runbook column names the first stop.

Critical alert triage is the first stop for any Critical-severity alert. It is also the first stop for the horizontal-scan family, Connection Spray and Port Scan. The priority is to decide whether the source host has authorization for scan behavior.
C2 beacon investigation covers the C2 IOC, Beaconing, Long Duration Flow, DGA, and Fast Flux families. These detections require callback destination identification and correlation with related session evidence.
Data exfiltration investigation covers the Data Exfiltration family. It identifies the source host, quantifies the uploaded volume, and decides whether the destination is attacker-controlled.
Malicious file investigation covers every MetaDefender Core tier. It reads the multi-AV verdict. It correlates the download session with its initiating host and user. It retrieves the archived file when storage is enabled. It decides whether the file reached a host that executed it.
ML anomaly investigation covers the ML Anomaly family. It reads the anomaly score and threshold together. It interprets whitelist adjustments. It pivots to the original event's protocol-specific sidebar section. It decides whether a cluster of ML alerts warrants escalation.
Tunneling investigation covers DNS Tunneling. It pivots from the flagged query to the full query stream for the source and parent domain. It cross-references C2 and InSights enrichments. It decides whether the source host needs isolation.
Alert flow and PCAP pivoting is the shared procedure. Use it to move from any alert back to the full session capture when raw-packet evidence is necessary.

Last updated on

Was this page helpful?