Detectors connected to URL and File log types - Administrator Guide - Cortex XDR - Cortex

Detectors connected to URL and File log types - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product

Cortex XDR

License

Pro

Creation date

2024-02-26

Last date published

2024-04-21

Category

Administrator Guide

Abstract

A list of detectors connected to URL and File log types.

If you turn off URL and File log types collection, some detectors are unable to detect cyber attacks or provide full context, and correlation rules are unable to detect cyber events.

The following detectors are affected by URL logs:

A non-browser process accessed a website UI
Reverse SSH tunnel to external domain/IP
Uncommon network tunnel creation
Suspicious domain fronting behavior
Possible watering hole SMB credential theft
Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol
Uncommon JA3 SSL fingerprint communication to an instant messaging server
PowerShell Initiates a Network Connection to GitHub
Non-browser failed access to a pastebin-like site
Non-browser access to a pastebin-like site
C2 from contextual causality signal
Massive upload to a rare storage or mail domain
DNS Tunneling

The following detectors are affected by File logs:

Rare AppID usage to a rare destination
Abnormal network communication through TOR using an uncommon port
Recurring access to rare IP
Possible network connection to a TOR relay server
A user accessed an uncommon AppID
Large Upload (Generic)
Large Upload (FTP)
Large Upload (SMTP)
Possible network connection to a TOR relay server
A user accessed a resource for the first time via SSO - silent
Access to a domain that is categorized as malicious - silent
Recurring access to rare domain categorized as malicious - silent
Cloud Large Upload (Generic) - disabled