Analytics
Informational
✕
Increase in Job-Related Site Visits
A user has visited multiple job-related sites in the past day.
- Module:
- Identity Threat Detection (ITDR), SaaS Threat Detection
- Licensed by:
- Identity Threat Detection (ITDR)
- Data source:
- Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent
ATT&CK tactics: Reconnaissance (TA0043)
ATT&CK techniques: Search Open Websites/Domains (T1593)
Attacker's goals:
This may be an early indicator of an insider threat.
Investigative actions:
Investigate the domains accessed and how popular they are in the organization. Check how long the user has been part of the organization. Verify that the user is not part of a department that accesses job sites as part of daily operations.
- Test period:
- 1 Day
- Deduplication:
- 1 Day