> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infrawatch.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Example rules
> Copyable detections for common internet-exposure patterns
These examples compile against the current `infrawatch` module. Copy one,
change the condition, then choose its classification, categories, and tags in
the rule editor.
## Redis without authentication
```yara theme={null}
import "infrawatch"
rule Exposed_Redis_Without_Authentication {
meta:
description = "Redis accepted a probe without requiring authentication"
condition:
defined infrawatch.scan.redis.authentication_required and
infrawatch.scan.port == 6379 and
not infrawatch.scan.redis.authentication_required
}
```
Suggested category: `exposure`
## Anonymous MQTT system topics
```yara theme={null}
import "infrawatch"
rule Anonymous_MQTT_System_Topics {
meta:
description = "MQTT accepted an anonymous connection and exposed system topics"
condition:
defined infrawatch.scan.mqtt.anonymous_connect_allowed and
infrawatch.scan.mqtt.anonymous_connect_allowed and
infrawatch.scan.mqtt.sys_subscribe_allowed
}
```
Suggested category: `exposure`
## Public HTTP administration surface
```yara theme={null}
import "infrawatch"
rule Public_HTTP_Admin_Panel {
meta:
description = "A successful HTTP response identifies an administration surface"
condition:
defined infrawatch.scan.http.response.status_code and
infrawatch.scan.http.response.status_code == 200 and
infrawatch.scan.http.response.body.html.title icontains "admin"
}
```
Suggested category: `exposure/admin-panel`
A title alone is a weak signal. Add a favicon, body hash, header, certificate,
or product-specific field before classifying a production match as malicious.
Understand source, metadata, categories, and classifications.
Browse typed HTTP, TLS, Redis, MQTT, SSH, and other protocol results.