# SigmaHQ rules shipped DISABLED by default (an admin can enable them under Logs > Rules).
# One file name per line; # starts a comment. The rule files themselves stay unchanged (DRL 1.1).
#
# Cleartext protocols on the firewall: on an ordinary network this matches every allowed
# telnet/ftp/http flow and drowns the alert list (RESEARCH SELECTION.md, USER GO 2026-10-08).
net_firewall_cleartext_protocols.yml
