Every published rule

This rule detects when a API Token is revoked.

This rule detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.

This rule detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files.

This rule detects when an attempt at deactivating or resetting MFA.