Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type ▾

Analytics 2

Severity ▾

Informational 2

Module / licence ▾

SaaS Threat Detection 2 Identity Threat Detection (ITDR) 2

Data source ▾

Analytics and correlation rules

Palo Alto Networks Firewall EAL Logs 2 Palo Alto Networks Firewall threat Logs 2 XDR Agent 2

2 detectors match the current filters. technique: T1593 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics	A user accessed multiple time-consuming websites A user was observed visiting multiple domains for personal reasons. Time theft happens when an employee is paid to work but did not actually work during that time. It might affect your business as it reduces the employee's efficiency.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance
Analytics	Increase in Job-Related Site Visits A user has visited multiple job-related sites in the past day.	Informational	Identity Threat Detection (ITDR), SaaS Threat Detection	Palo Alto Networks Firewall EAL Logs, Palo Alto Networks Firewall threat Logs, Palo Alto Networks Firewall EAL Logs, XDR Agent	Reconnaissance