DET-H22: Hardware moved between fleets¶
Verified evidence for hardware another fleet recorded was filed by this fleet's collector, so the hardware moved. It starts afresh in the new fleet (its attestation, BMC and TPM baselines stay with the old one), so a change carried across the move is compared with nothing. Raised once per move to each fleet's readers, each side naming only its own fleet: the old fleet sees the hardware moved out (no destination), the new one sees it moved in (its collector, no source).
| Property | Value |
|---|---|
| Severity | medium |
| Platform | Hardware fleets |
| Group | hardware |
| Log source | Collector · verified report |
| Related | Fleet membership |
Fires when¶
a hardware asset's stored fleet != the fleet whose collector filed this report (once per move)
How it runs¶
The hosted service evaluates this rule on what enrolled collectors report and on key-release decisions. There is nothing to run; see Enroll a collector.
A match appears in the console as a detection with this rule's ID and triggers your alerts; see Runtime detections.