Detectors
Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.
10 detectors match the current filters. technique: T1526 ✕
Download CSV| Type | Name | Severity | Module | Data source / event | ATT&CK |
|---|---|---|---|---|---|
| Analytics BIOC | An Azure application reached a throttling API rate An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Discovery |
| Analytics BIOC | AWS Secrets Manager discovery An attempt was made to list secrets from AWS Secrets Manager. | Informational | Cortex Cloud | AWS Audit Log | Credential Access, Discovery |
| Analytics BIOC | AWS SSM parameters discovery An attempt was made to list parameters stored in AWS SSM. | Informational | Cortex Cloud | AWS Audit Log | Credential Access, Discovery |
| Analytics BIOC | AWS Storage Gateway enumeration An AWS Storage Gateway was enumerated. | Informational | Cortex Cloud | AWS Audit Log | Discovery |
| Analytics BIOC | AWS Storage Gateway file share enumeration AWS Storage Gateway file shares were enumerated. | Informational | Cortex Cloud | AWS Audit Log | Discovery |
| Analytics BIOC | First SSO Resource Access in the Organization A resource was accessed for the first time via SSO. | Informational | Identity Analytics | AzureAD, Azure SignIn Log, Idira, Duo, Okta, OneLogin, PingOne | Initial Access, Discovery |
| Analytics BIOC | Unusual access to Microsoft 365 storage services Unusual access was detected to a Microsoft 365 storage service. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Discovery |
| Analytics BIOC | Unusual AWS systems manager activity A cloud identity performed an SSM operation for the first time. | Informational | Cortex Cloud | AWS Audit Log | Discovery, Lateral Movement |
| Analytics BIOC | Unusual IAM enumeration activity by a non-user Identity An unusual command which may be related to an IAM recon enumeration was executed by a non-user identity. | Informational | Cortex Cloud | Gcp Audit Log | Discovery |
| Analytics BIOC | Unusual resource access by Azure application An Azure application had interacted with an unusual resource using the Microsoft Graph API. | Informational | Cortex Cloud | Azure Audit Log, Microsoft Graph Logs | Discovery |