Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics BIOC 2

Severity ▾

Informational 2

Module / licence ▾

Email Security 2

Data source ▾

Analytics and correlation rules

Microsoft 365 Emails 2

Detector tag ▾

Analytics only

Employee Impersonation 1 Spear Phishing 1

2 detectors match the current filters. tactic: TA0001 ✕ technique: T1656 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	Potential spoofing of internal domain spotted An external sender is possibly impersonating an employee by spoofing the company's internal address.	Informational	Email Security	Microsoft 365 Emails	Initial Access, Defense Evasion
Analytics BIOC	X-Forefront-Antispam-Report has flagged this email as a potential threat This email has been categorized by X-Forefront-Antispam-Report as a threat, suggesting it is likely malicious in nature (e.g., spam, phishing, impersonation, etc.).	Informational	Email Security	Microsoft 365 Emails	Initial Access, Defense Evasion, Execution