Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

4 detectors match the current filters. technique: T1078 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Azure group creation/deletion A group in Azure was created or deleted.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Persistence
Analytics BIOC	Azure user creation/deletion A user in Azure was created or deleted.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Persistence
Analytics BIOC	Azure user password reset The password of an Azure AD user was reset.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Persistence
Analytics BIOC	Owner was added to Azure application An Owner was added to an Azure application.	Informational	Cortex Cloud	Azure Audit Log, Microsoft Graph Logs	Privilege Escalation, Persistence