DET-H1: Launch measurement changed on a host¶
A host's verified launch measurement differs from its previous report: a new guest image or firmware is running.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · SEV-SNP report |
| Related check | SNP-MEAS-01: Launch measurement is in the fleet's expected set |
Fires when¶
verified SNP launch measurement != the host's previous verified measurement
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.