Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics 2 Analytics BIOC 30

Severity ▾

Informational 2

Module / licence ▾

Cortex Cloud 2

Data source ▾

Analytics and correlation rules

AWS Audit Log 2 Azure Audit Log 2 Gcp Audit Log 2

Detector tag ▾

Analytics only

Cloud Data Asset Exfiltration 2 Data Detection & Response 1

2 detectors match the current filters. technique: T1537 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	An identity initiated a download of multiple cloud objects An identity initiated a download of multiple cloud objects. This might be an indication for an adversary trying to exfiltrate data from cloud storage.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Collection, Exfiltration
Analytics	Multiple cloud snapshots export A cloud identity has downloaded multiple virtual machines or DB snapshots locally.	Informational	Cortex Cloud	AWS Audit Log, Azure Audit Log, Gcp Audit Log	Exfiltration