A cloud snapshot was created or modified

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Exfiltration (TA0010) Defense Evasion (TA0005)
ATT&CK Technique	Transfer Data to Cloud Account (T1537) Modify Cloud Compute Infrastructure (T1578)
Severity	Informational

A cloud identity has created or modified a cloud snapshot.

Exfiltrate sensitive data that resides on the snapshot.

Check if the identity intended to create or modify the snapshot.
Check if the identity performed additional malicious operations within the cloud environment.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A cloud identity has created or modified a cloud snapshot.

Exfiltrate sensitive data that resides on the snapshot.

Check if the identity intended to create or modify the snapshot.
Check if the identity performed additional malicious operations within the cloud environment.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

A cloud identity has created or modified a cloud snapshot.

Exfiltrate sensitive data that resides on the snapshot.

Check if the identity intended to create or modify the snapshot.
Check if the identity performed additional malicious operations within the cloud environment.
Check which AWS accounts the snapshot was shared with.