An Azure application reached a throttling API rate

Cortex XDR Analytics Alert Reference by data source

Product: Cortex XDR
Last date published: 2024-12-03
Category: Analytics Alert Reference
Order: data source

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: Azure Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Informational

Description

An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.

Attacker's Goals

Enumerate cloud services in an Azure tenant.

Investigative actions

Check the application's role designation in the organization.
Look for any unusual behavior originated from the suspected application.

Variations

An Azure application reached an unusual throttling API rate

Synopsis

ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Cloud Service Discovery (T1526)
Severity	Low

Description

An Azure application has executed a high volume of Microsoft Graph API calls, causing a throttling error.

Attacker's Goals

Enumerate cloud services in an Azure tenant.

Investigative actions

Check the application's role designation in the organization.
Look for any unusual behavior originated from the suspected application.