Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters.

Download CSV Show ATT&CK heatmap
  • Cloud email sending was enabled Informational Cloud 1 variation

    Cloud email sending was enabled for the cloud account.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Resource Development (TA0042)
    ATT&CK techniques: Compromise Accounts: Email Accounts (T1586.002)
    Required data: AWS Audit Log
    Attacker's goals: Use the existing account to send phishing or spread malware.
    Investigative actions: Check if the identity has performed any email-related operations in the past. Check if this account should be used for email sending.

    Variations

    Cloud email sending was enabled by an unusual identity

    Low overridden

    Cloud email sending was enabled for the cloud account. The identity was not seen performing any operations in SES in the last 30 days. overridden