Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
9 detectors match the current filters. tactic: TA0003 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | Authentication method was added to Azure account A new authentication method was added to an Azure AD user. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence |
| Analytics BIOC | Azure group creation/deletion A group in Azure was created or deleted. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence |
| Analytics BIOC | Azure Service principal/Application creation An Azure Service principal/Application was created. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence |
| Analytics BIOC | Azure user creation/deletion A user in Azure was created or deleted. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence |
| Analytics BIOC | Azure user password reset The password of an Azure AD user was reset. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence |
| Analytics BIOC | Credentials were added to Azure application Credentials were added to an Azure application. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence, Privilege Escalation |
| Analytics BIOC | External user invitation to Azure tenant An external user was invited to Azure tenant. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Persistence, Privilege Escalation |
| Analytics BIOC | Owner was added to Azure application An Owner was added to an Azure application. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Privilege Escalation, Persistence |
| Analytics BIOC | User installed an application in Microsoft Teams via Graph API A user who rarely uses the Graph API to install Microsoft Teams applications has installed one using it. | Informational | Identity Threat Detection (ITDR), SaaS Threat Detection | Microsoft Graph Logs | Persistence |