Analytics High

Multiple risk indicators for a cloud identity

Multiple risk indicators detected for a cloud identity, combining unusual activity with activity from unusual geolocation or high-risk IP.

Module:
Cortex Cloud
Licensed by:
Cloud Runtime Security (CRS)
Data source:
AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078) Valid Accounts: Cloud Accounts (T1078.004)
Detector tags: OCI Analytics
Attacker's goals:

Compromise a cloud user account to gain access and perform malicious activities.

Investigative actions:

Review the user's recent activity for any unauthorized actions. Rotate the user's credentials immediately if confirmed compromised.

Test period:
1 Hour
Deduplication:
1 Day