Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics 11 Analytics BIOC 5

Severity ▾

Informational 5

Module / licence ▾

Cortex Cloud 5

Data source ▾

Analytics and correlation rules

AWS Audit Log 5

Detector tag ▾

Analytics only

SSM Remote Management Analytics 1

5 detectors match the current filters. technique: T1580 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	AWS Storage Gateway enumeration An AWS Storage Gateway was enumerated.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics BIOC	AWS Storage Gateway file share enumeration AWS Storage Gateway file shares were enumerated.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics BIOC	AWS support case creation A cloud identity has created a new case in AWS support.	Informational	Cortex Cloud	AWS Audit Log	Discovery, Privilege Escalation
Analytics BIOC	AWS Systems Manager hosts enumeration A cloud identity enumerated hosts managed by AWS Systems Manager. Adversaries may use this API to discover SSM managed instances as a precursor to lateral movement or remote code execution.	Informational	Cortex Cloud	AWS Audit Log	Discovery
Analytics BIOC	IAM instance profile associations were described AWS IAM instance profile associations were described.	Informational	Cortex Cloud	AWS Audit Log	Discovery