Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics 1 Analytics BIOC 1

Severity ▾

Informational 2

Module / licence (1) ▾

SaaS Threat Detection 2 Identity Threat Detection (ITDR) 2 Email Security 1

Data source (1) ▾

Analytics and correlation rules

Office 365 Audit 2

Detector tag ▾

Analytics only

Microsoft Teams 1 O365 DLP Analytics 1

2 detectors match the current filters. technique: T1048 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Microsoft Teams external communication policy was modified Microsoft Teams external communication policy was modified.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Defense Evasion, Exfiltration
Analytics	Sensitive Exchange mail sent to external users A user sent sensitive email messages to external users.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection, Email Security	Office 365 Audit	Collection, Exfiltration