name: Sustained RF noise-floor anomaly on the uplink and downlink waveform
details: |
  Detects sustained noise-floor anomalies on the telecommand uplink and downlink waveform that
  are consistent with intentional jamming rather than incidental atmospheric effects: a
  signal-to-noise drop, a bit-error-rate spike, or sustained out-of-band emission held for longer
  than an incidental event. Corroborating streams the analyst should pull on a hit, which are not
  the target of this rule: the tracking and telemetry service noise-floor stream and the link
  access-control authority failure-rate stream. Known benign causes: a solar storm or
  scintillation event, correlated against the space-weather feed, and an authorized RF
  interference test.
author: Kestrel Orbital SOC
severity: high
type: alert
class: behavioral
date: 2026-08-04
mitre-attack:
    - t1498
detection:
    language: splunk-spl-query
    body: index=ground_rf sourcetype=rf_metrics | eval jam=if(snr_delta_db<=-8 OR ber_factor>=10 OR oob_power_db>=6,1,0) | where jam=1 AND duration_seconds>=120 | stats count by band, station
logsource:
    product: ground-rf-telemetry
    service: rf-metrics
    audit:
        source: Ground receiver per-band SNR and BER telemetry
        enable: Stream per-band signal-to-noise, bit-error-rate and out-of-band power from every ground receiver, with a rolling environmental baseline per band.
correlation:
    timeframe: 2m
    functions: count(sample) by band
references:
    - AN:ATT:Attack Path:02
    - AN:THR:Threat:02
    - https://sparta.aerospace.org/technique/SPACE-T1429
tags: KO-DET-RF-NOISE-001, jamming, uplink, downlink, sparta-space-t1429
license: DRL 1.1
version: 1.0
uuid: c4a80b7e-53d2-4f91-a6c8-0e7b1d45f382
meteorstorm:
    pce: PCE:TE:Terrestrial:00
    seg: SEG:LI:Link:00
    svc: SVC:HY:Hybrid:01
    ast: AST:SI:Signal:00
    playbook: PB-02
    an:
        eten: AN:DET:Detection Signature:02
        tdm: AST:SI:Signal:00