An RDS snapshot was exported to an unknown bucket

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2026-03-15

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags	Data Detection & Response, Cloud Data Asset Exfiltration
ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

An RDS snapshot was exported to an unknown S3 bucket.
The destination bucket has not been seen in your tenant in the last 30 days.

Exfiltrate data to an unknown bucket.

ATT&CK Tactic	Exfiltration (TA0010)
ATT&CK Technique	Transfer Data to Cloud Account (T1537)
Severity	Informational

A failed attempt to export an RDS snapshot to an unknown bucket.

Exfiltrate data to an unknown bucket.