Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0007 ✕ technique: T1526 ✕

Download CSV Show ATT&CK heatmap
  • An Azure application reached a throttling API rate Informational Cloud 2 variations

    An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Cloud Service Discovery (T1526)
    Required data: Azure Audit Log Microsoft Graph Logs
    Detector tags: Microsoft Graph Activity Logs
    Attacker's goals: Enumerate cloud services in an Azure tenant.
    Investigative actions: Check the application's role designation in the organization. Look for any unusual behavior originated from the suspected application.

    Variations

    An Azure application reached an unusual throttling API rate

    Informational overridden

    An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error. overridden

    An Azure application reached an unusual throttling API rate

    Low overridden

    An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error. overridden