Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • An unknown account was invited to the AWS organization Informational Cloud

    An unknown account was invited to your AWS organization. The target account was not seen in your tenant for the last 30 days.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation (T1098)
    Required data: AWS Audit Log
    Attacker's goals: Establish persistent access to the compromised cloud account.
    Investigative actions: Identify the invited account ID and ownership. Review additional actions performed by the identity and role.