DET-H16: Host and BMC disagree on firmware or boot state¶
The host's own view (efivars, DMI) and its BMC's Redfish view of the same box disagree on Secure Boot or the BIOS version. Neither view is attested, so one of them is wrong: a tampered OS or BMC, a host that is not the box the BMC manages, or a stale snapshot.
| Property | Value |
|---|---|
| Severity | high |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · in-band OS + Redfish (BMC) |
| Related | FW-HOST-01 |
Fires when¶
host-reported firmware/boot state disagrees with the BMC's Redfish view
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.