Increase in Job-Related Site Visits

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

1 Day

Deduplication Period

1 Day

Required Data

  • Requires:
    • Palo Alto Networks Platform Logs

Detection Modules

Identity Threat Module

Detector Tags

ATT&CK Tactic

Reconnaissance (TA0043)

ATT&CK Technique

Search Open Websites/Domains (T1593)

Severity

Informational

Description

A user has visited multiple job-related sites in the past day.

Attacker's Goals

This may be an early indicator of an insider threat.

Investigative actions

  • Investigate the domains accessed and how popular they are in the organization.
  • Check how long the user has been part of the organization.
  • Verify that the user is not part of a department that accesses job sites as part of daily operations.