Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0006 ✕

Download CSV Show ATT&CK heatmap
  • Uncommon Azure Cosmos DB master key read by identity Low Cloud

    A cloud identity read master keys from an Azure Cosmos DB account, which is uncommon for this identity.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Credential Access (TA0006)
    ATT&CK techniques: Unsecured Credentials (T1552)
    Required data: Azure Audit Log
    Attacker's goals: Obtain Cosmos DB master keys to gain full access to the database, allowing data exfiltration, modification, or destruction.
    Investigative actions: Check the identity's actions before and after the key read operation. Verify whether the identity is authorized to access Cosmos DB master keys. Determine if the retrieved keys were used to access or modify data in the Cosmos DB account.