Analytics BIOC
Informational
✕
An Azure application reached a throttling API rate
An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- Azure Audit Log, Microsoft Graph Logs
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Cloud Service Discovery (T1526)
Detector tags: Microsoft Graph Activity Logs
Attacker's goals:
Enumerate cloud services in an Azure tenant.
Investigative actions:
Check the application's role designation in the organization. Look for any unusual behavior originated from the suspected application.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days
2 variations:
- An Azure application reached an unusual throttling API rate Informational
- An Azure application reached an unusual throttling API rate Low (parent: Informational)