Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0040 ✕ technique: T1529 ✕
Download CSV Show ATT&CK heatmapA cloud instance was stopped Informational Cloud
A cloud compute instance was stopped.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- N/A (single event)
- Deduplication:
- 5 Days
ATT&CK tactics: Impact (TA0040)ATT&CK techniques: System Shutdown/Reboot (T1529)Required data: AWS Audit Log Azure Audit Log Gcp Audit LogAttacker's goals: Interrupt business services.Investigative actions: Review recent activity related to the identity and the affected cloud instance.