AWS Secrets Manager discovery

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-01-04

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Credential Access (TA0006) Discovery (TA0007)
ATT&CK Technique	Credentials from Password Stores: Cloud Secrets Management Stores (T1555.006) Cloud Service Discovery (T1526)
Severity	Informational

An attempt was made to list secrets from AWS Secrets Manager.

Exfiltrate sensitive secrets stored in AWS Secrets Manager.

Check if the secrets manager activity aligns with known workflows or automation, or if it indicates abnormal activity.
Follow further actions done by the identity.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

An attempt was made to list secrets from AWS Secrets Manager.

Exfiltrate sensitive secrets stored in AWS Secrets Manager.

Check if the secrets manager activity aligns with known workflows or automation, or if it indicates abnormal activity.
Follow further actions done by the identity.