Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. technique: T1588 ✕

Show ATT&CK heatmap
  • Untrusted process contacted LLM API Informational 1 variation

    An untrusted process contacted an LLM API.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    1 Day
    ATT&CK tactics: Resource Development (TA0042)
    ATT&CK techniques: Obtain Capabilities: Artificial Intelligence (T1588.007)
    Required data: XDR Agent
    Attacker's goals: Adversaries may use LLM APIs to create malicious payload dynamically. Each payload will be slightly different making detection more complex.
    Investigative actions: Investigate the process that contacted the LLM API. Check if this LLM API access is legitimate and expected. Analyze the data potentially sent to the LLM service.

    Variations

    Untrusted process contacted a rare LLM API

    Low overridden

    An untrusted process contacted a rare LLM API. overridden