Analytics Rules - Cortex XSIAM

Scheduled Tasks Analytics

This new suite identifies malicious persistence by tracking the installation and execution of scheduled tasks, providing deep context and generating high-fidelity alerts.

All licenses

NDR Insights Analytics

Our new network detection suite automatically correlates between low-fidelity network signals and existing alerts, transforming them into high-confidence security incidents.

All licenses

Active Directory Federation Services Analytics

This new suite identifies suspicious and irregular behavior within your Active Directory Federation Services.

All licenses

Google Workspace Analytics

This advanced suite detects attack attempts within Google Workspace, including through brute force, phishing, account manipulation, unauthorized policy modification, suspicious browser extension installations, credentials harvesting, and data collection.

All licenses

Linux Discovery Analytics

This novel suite, tailored to the Linux domain, identifies reconnaissance and host environment mapping activities. The suite detects adversaries and malicious scripts seeking to gather system-level intelligence, discover user credentials, and uncover pathways for lateral movement during the discovery phase of an attack.

All licenses

Kubernetes Credentials Analytics

This detection suite analyzes Kubernetes activity to identify credential harvesting techniques, including host file access from containers, kubelet credential file retrieval, and kubelet impersonation.

All licenses