Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Cloud access key creation Informational Cloud 2 variations

    Cloud access key creation by a cloud identity.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Persistence (TA0003)
    ATT&CK techniques: Account Manipulation: Additional Cloud Credentials (T1098.001)
    Required data: AWS Audit Log Gcp Audit Log
    Attacker's goals: Persist in the environment.
    Investigative actions: investigate the identity who created the access keys. Check the access key activity in the organization.

    Variations

    Successful access key creation by an unusual identity type

    Informational overridden

    Cloud access key creation by a cloud identity. overridden

    Unusual successful cloud access key creation

    Informational overridden

    Cloud access key creation by a cloud identity. overridden