Analytics Content Version: 2024.02.28 - Content Update Release Notes - Cortex XDR - Cortex

Release date: 18 March, 2024

Change type	Changes
Improved logic of a Low Analytics BIOC	Unusual cross projects activity
Improved logic of 2 Low Analytics Alerts	Abnormal sensitive RPC traffic to multiple hosts An identity dumped multiple secrets from a project
Improved logic of 15 Informational Analytics BIOCs	A cloud identity created or modified a security group A cloud identity executed an API call from an unusual country A cloud identity had escalated its permissions A cloud identity invoked IAM related persistence operations A cloud snapshot was created or modified A container registry was created or deleted Activity in a dormant region of a cloud project Cloud compute serial console access Cloud identity reached a throttling API rate Network sniffing detected in Cloud environment Unusual AWS systems manager activity Unusual Identity and Access Management (IAM) activity Unusual cloud identity impersonation Unusual resource modification by newly seen IAM user Unusual resource modification/creation
Improved logic of 8 Informational Analytics Alerts	An identity performed a suspicious download of multiple cloud storage objects Cloud infrastructure enumeration activity Deletion of multiple cloud resources IAM Enumeration sequence Impossible travel by a cloud identity Multi region enumeration activity Multiple failed logins from a single IP Storage enumeration activity
Increased the severity to Low for a BIOC	Out of band testing domain connection

Analytics Content Version: 2024.02.28 - Content Update Release Notes - Cortex XDR - Cortex - Cortex XDR