Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0007 ✕ technique: T1654 ✕

Download CSV Show ATT&CK heatmap
  • Log enumeration via cloud native logging service Informational Cloud 1 variation

    An activity of log enumeration operations via cloud native logging service was detected.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    10 Minutes
    Deduplication:
    1 Day
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Log Enumeration (T1654)
    Required data: AWS Audit Log
    Attacker's goals: Gaining information about your environment as part of the discovery phase.
    Investigative actions: Check the identity which invoked the operations.

    Variations

    Log enumeration via cloud native logging service invoked by an identity for the first time

    Low overridden

    An activity of log enumeration operations via cloud native logging service was detected. overridden