Detectors

Every Cortex detection rule the toolbox knows about — analytics alerts, BIOCs and correlation rules — in one filterable set.

Filters

Clear

Count variations separately Analytics variations become rows of their own

Detector type (1) ▾

Analytics BIOC 4

Severity ▾

Informational 3 Low 1

Module / licence ▾

Cortex Cloud 3 Identity Analytics 1

Data source ▾

Analytics and correlation rules

AWS Audit Log 3 Gcp Audit Log 1 Office 365 Audit 1

4 detectors match the current filters. technique: T1648 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A cloud function was created with an unusual runtime A cloud function was created with an unusual runtime.	Low	Cortex Cloud	AWS Audit Log, Gcp Audit Log	Execution
Analytics BIOC	An AWS Lambda Function was created An AWS Lambda Function was created.	Informational	Cortex Cloud	AWS Audit Log	Execution, Persistence
Analytics BIOC	An AWS Lambda function was modified An AWS Lambda function was modified.	Informational	Cortex Cloud	AWS Audit Log	Execution
Analytics BIOC	Penetration testing tool activity attempt A SaaS API was invoked by a penetration testing tool.	Informational	Identity Analytics	Office 365 Audit	Execution