Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • An RDS snapshot was exported to an unknown S3 bucket Low Cloud 3 variations

    An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Exfiltration (TA0010)
    ATT&CK techniques: Transfer Data to Cloud Account (T1537)
    Required data: AWS Audit Log
    Detector tags: Data Detection & Response
    Attacker's goals: Exfiltrate data to an unknown bucket.
    Investigative actions: Check the legitimacy of the referenced destination bucket. Review further logs for the source snapshot ID. Review further actions performed by the identity and role.

    Variations

    An RDS snapshot was exported to an unknown S3 bucket by an admin identity

    Informational overridden

    An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days. The identity has an administrative behavior. overridden

    An RDS snapshot was exported to an unknown S3 bucket with suspicious indicators

    Medium overridden

    An RDS snapshot was exported to an S3 bucket. The destination S3 bucket was not seen in your organization in the last 30 days. overridden

    An RDS snapshot was exported to an unknown S3 bucket - denied attempt

    Informational overridden

    A denied attempt to export an RDS snapshot to an unknown S3 bucket. overridden