Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
3 detectors match the current filters. technique: T1586 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | A user connected to a VPN from a new country A user connected to a VPN from an unusual country that the user has not connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |
| Analytics BIOC | First VPN access attempt from a country in organization A user attempted to connect from an unusual country that no one from this organization has connected from before. This may indicate the account was compromised. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |
| Analytics | VPN login Brute-Force attempt A user account failed to log in to a VPN service multiple times in a short time period. This may indicate a brute-force attack. | Informational | Identity Analytics | Palo Alto Networks Global Protect, Third-Party VPNs | Credential Access, Resource Development |