Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0011 ✕ technique: T1572 ✕

Download CSV Show ATT&CK heatmap
  • Suspicious ICMP packet Low 1 variation

    An ICMP router advertisement was sent by a host.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Command and Control (TA0011)
    ATT&CK techniques: Protocol Tunneling (T1572)
    Required data: Palo Alto Networks Firewall EAL Logs XDR Agent
    Attacker's goals: Make the victim change his routing table.
    Investigative actions: Investigate why the source host sent an ICMP router advertisement and if it changed the destination target routing table.

    Variations

    Suspicious ICMP packet that resemble an ICMP redirect attack

    Informational overridden

    ICMP redirect was sent by a user. overridden