Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0007 ✕ technique: T1069 ✕

Download CSV Show ATT&CK heatmap
  • Unusual IAM enumeration activity by a non-user Identity Informational Cloud

    An unusual command which may be related to an IAM recon enumeration was executed by a non-user identity.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    5 Days
    ATT&CK tactics: Discovery (TA0007)
    ATT&CK techniques: Account Discovery (T1087) Permission Groups Discovery (T1069) Cloud Service Discovery (T1526)
    Required data: Gcp Audit Log
    Attacker's goals: Collect information on the cloud environment, including IAM users, groups, roles, and policies.
    Investigative actions: Check if the API call was made by the identity. Check if there are additional unusual API calls from the identity.