Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics BIOC 4

Severity (1) ▾

Informational 4

Module / licence ▾

SaaS Threat Detection 4 Identity Threat Detection (ITDR) 4

Data source ▾

Analytics and correlation rules

Office 365 Audit 3 Microsoft Graph Logs 1

Detector tag ▾

Analytics only

Microsoft Teams 4

4 detectors match the current filters. technique: T1671 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A Microsoft Teams application was installed A Microsoft Teams application was installed.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Persistence
Analytics BIOC	A Microsoft Teams bot was added to a team A user added a bot to a team in Microsoft Teams.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Persistence
Analytics BIOC	Microsoft Teams application setup policy was modified Microsoft Teams the application setup policy, which is responsible for application management, was modified.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Office 365 Audit	Defense Evasion, Persistence
Analytics BIOC	User installed an application in Microsoft Teams via Graph API A user who rarely uses the Graph API to install Microsoft Teams applications has installed one using it.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Microsoft Graph Logs	Persistence