Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics BIOC 2

Severity ▾

Informational 1 Medium 1

Module / licence (1) ▾

Cortex Cloud 13 Platform Analytics 2

Data source ▾

Analytics and correlation rules

XDR Agent 2

Detector tag ▾

Analytics only

Kubernetes - AGENT 2 Containers 1

2 detectors match the current filters. technique: T1610 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Kubernetes vulnerability scanner activity A Kubernetes cluster was scanned by a known vulnerability scanner.	Medium	Platform Analytics	XDR Agent	Execution, Discovery
Analytics BIOC	Suspicious container runtime connection from within a Kubernetes Pod A process from within a Kubernetes Pod communicated with the container runtime daemon using the runtime socket. This may indicate an adversary attempting to escape from the Kubernetes Pod to the host.	Informational	Platform Analytics	XDR Agent	Execution