Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾

Informational Low Medium High

Detection module ▾

Cloud Email Identity Analytics Identity Threat Module Identity Threat Module Email

Data source ▾

1 alert match the current filters. tactic: TA0003 ✕ technique: T1199 ✕

Show ATT&CK heatmap

AWS STS temporary credentials were generated Informational Cloud

AWS STS temporary credentials were generated for an AWS identity.

Activation:

14 Days

Training:

30 Days

Test:

N/A (single event)

Deduplication:

5 Days

ATT&CK tactics: Persistence (TA0003) Initial Access (TA0001) Credential Access (TA0006)

ATT&CK techniques: Valid Accounts: Cloud Accounts (T1078.004) Trusted Relationship (T1199) Forge Web Credentials (T1606)

Required data: AWS Audit Log

Attacker's goals: Gain access and persistence to AWS account.

Investigative actions: Check which operation executed with the new credentials.