Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1087 ✕

Download CSV Show ATT&CK heatmap
  • A New Server was Added to an Azure Active Directory Hybrid Health ADFS Environment Informational Cloud

    A new server has been added to an Azure Active Directory Hybrid Health AD FS Environment.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087)
    Required data: Azure Audit Log
    Attacker's goals: Gain access to sensitive data stored in the new server.* Gain access to other servers in the Azure Active Directory Hybrid Health AD FS Environment.* Gain access to user accounts in the Azure Active Directory Hybrid Health AD FS Environment.
    Investigative actions: Check the Azure Active Directory Hybrid Health Monitor to identify the new server.* Verify that the new server is correctly configured for ADFS.* Check the logs for any errors related to the new server.