Analytics Informational
✕

Log enumeration via cloud native logging service

An activity of log enumeration operations via cloud native logging service was detected.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: Log Enumeration (T1654)
Attacker's goals:

Gaining information about your environment as part of the discovery phase.

Investigative actions:

Check the identity which invoked the operations.

Test period:
10 Minutes
Deduplication:
1 Day
1 variation:
  • Log enumeration via cloud native logging service invoked by an identity for the first time Low (parent: Informational)