Cloud user performed multiple actions that were denied

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2026-06-15

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	5 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Account Discovery (T1087) Permission Groups Discovery (T1069)
Severity	Informational

An identity performed multiple actions that were denied, which may indicate it is being misused.

Execute various commands to explore the cloud environment.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

An identity performed multiple actions that were denied, which may indicate it is being misused.

Execute various commands to explore the cloud environment.

Check if the API calls were made by the identity.
Check if there are additional calls executed by the identity.