Analytics Content Version: 2025.02.05 - Content Update Release Notes - Cortex XDR - Cortex

Release date: February 25, 2025

Change type	Changes
Added a new Informational Analytics BIOC	Azure storage account cross-tenant object replication was enabled
Improved logic of a Medium Analytics BIOC	Cloud snapshot of a database or storage instance was publicly shared
Improved logic of 5 Low Analytics BIOCs	A GCP service account was delegated domain-wide authority in Google Workspace AWS Flow Logs deletion Azure account deletion by a non-standard account Cloud Trail logging deletion Unusual cross projects activity
Improved logic of a Low Analytics Alert	An identity dumped multiple secrets from a project
Improved logic of 37 Informational Analytics BIOCs	A Kubernetes ConfigMap was created or deleted A Kubernetes Cronjob was created A Kubernetes cluster role binding was created or deleted A Kubernetes cluster was created or deleted A Kubernetes ephemeral container was created A Kubernetes namespace was created or deleted A Kubernetes role binding was created or deleted A Kubernetes secret was created or deleted A Kubernetes service account was created or deleted A Kubernetes service was created or deleted A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud instance was stopped A cloud snapshot was created or modified A container registry was created or deleted Activity in a dormant region of a cloud project An identity attached an administrative policy to an IAM user/role Azure storage account blob anonymous access is enabled Azure storage account was publicly shared Cloud compute instance user data script modification Cloud compute serial console access Cloud identity reached a throttling API rate Data encryption was disabled GCP set IAM policy activity Kubernetes cluster events deletion Kubernetes network policy modification Network sniffing detected in Cloud environment SharePoint Site Collection admin group addition Suspicious cloud compute instance ssh keys modification attempt Unusual ADConnect database file access Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual resource modification by newly seen IAM user Unusual resource modification/creation
Improved logic of 10 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Cloud infrastructure enumeration activity Deletion of multiple cloud resources IAM Enumeration sequence Internal Login Password Spray Kubernetes enumeration activity Multi region enumeration activity Multiple failed logins from a single IP SSH authentication brute force attempts Storage enumeration activity
Decreased the severity to Low for an Analytics BIOC	Uncommon execution of ODBCConf
Removed an old Informational Analytics BIOC	Network traffic to a crypto miner related domain detected