Analytics BIOC
Informational
✕
Unusual AWS SageMaker notebook access
A cloud identity accessed an AWS SageMaker notebook for the first time. MITRE ATLAS Technique: AML.T0008 - Acquire Infrastructure: AI Development Workspaces.
- Module:
- Cortex Cloud
- Licensed by:
- Cloud Runtime Security (CRS)
- Data source:
- AWS Audit Log
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: Cloud API (T1059.009)
Detector tags: Cloud AI Infrastructure Analytics
Attacker's goals:
Gain access to AI/ML resources and services.
Investigative actions:
Examine which AWS SageMaker notebooks were accessed. Investigate any unusual activity originating from the suspected identity.
- Test period:
- N/A (single event)
- Deduplication:
- 5 Days