Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics BIOC 5

Severity ▾

Informational 5

Module / licence (1) ▾

Cortex Cloud 5

Data source (1) ▾

Analytics and correlation rules

Gcp Audit Log 6 Azure Audit Log 5 AWS Audit Log 3 Kubernetes Audit Logs 2

Detector tag ▾

Analytics only

Kubernetes - API 2

5 detectors match the current filters. technique: T1498 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A Kubernetes service was created or deleted A Kubernetes service was created or deleted.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact
Analytics BIOC	An Azure virtual network Device was modified An Azure virtual network Device was modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	An Azure virtual network was modified An Azure virtual network has been modified or deleted.	Informational	Cortex Cloud	Azure Audit Log	Impact
Analytics BIOC	Cloud identity reached a throttling API rate A cloud identity has executed a high volume of API calls, causing a throttling error.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Impact
Analytics BIOC	Kubernetes network policy modification A change has been made to the network policies of a Kubernetes cluster.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log, Kubernetes Audit Logs	Impact