Analytics Alerts
Browse the Cortex analytics alert reference.
1 alert match the current filters. technique: T1030 ✕
Show ATT&CK heatmapRare Unix process divided files by size Informational
A file was divided into sub-files by size limit by a rare process.
- Activation:
- 14 Days
- Training:
- 30 Days
- Test:
- N/A (single event)
- Deduplication:
- 1 Day
ATT&CK tactics: Exfiltration (TA0010)ATT&CK techniques: Data Transfer Size Limits (T1030)Required data: XDR AgentAttacker's goals: This may assist an attacker to exfiltrate sensitive information.Investigative actions: Check if the user normally uses this capability. Check if this capability is used often on this endpoint.