Analytics
High
✕
Multiple risk indicators for a cloud identity
Multiple risk indicators detected for a cloud identity, combining unusual activity with activity from unusual geolocation or high-risk IP.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log, Azure Audit Log, Gcp Audit Log
ATT&CK tactics: Initial Access (TA0001)
ATT&CK techniques: Valid Accounts (T1078) Valid Accounts: Cloud Accounts (T1078.004)
Detector tags: OCI Analytics
Attacker's goals:
Compromise a cloud user account to gain access and perform malicious activities.
Investigative actions:
Review the user's recent activity for any unauthorized actions. Rotate the user's credentials immediately if confirmed compromised.
- Test period:
- 1 Hour
- Deduplication:
- 1 Day