Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. tactic: TA0005 ✕
Download CSV Show ATT&CK heatmapAn AWS GuardDuty IP set was created Informational Cloud
An AWS GuardDuty IP set has been created.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- N/A (single event)
- Deduplication:
- 5 Days
ATT&CK tactics: Defense Evasion (TA0005)ATT&CK techniques: Impair Defenses (T1562)Required data: AWS Audit LogDetector tags: Cloud Log Tampering AnalyticsAttacker's goals: Evade detection.Investigative actions: Check which IP set has been modified and confirm the changes.