AWS Security Service Enumeration

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	15 Minutes
Deduplication Period	5 Days
Required Data	Requires: AWS Audit Log
Detection Modules	Cloud
Detector Tags
ATT&CK Tactic	Discovery (TA0007)
ATT&CK Technique	Software Discovery (T1518) Software Discovery: Security Software Discovery (T1518.001) Cloud Infrastructure Discovery (T1580)
Severity	Informational

AWS security service enumeration activity, potentially indicating reconnaissance.

Reconnaissance of security defenses to assess and identify exploitable weaknesses.

ATT&CK Tactic

ATT&CK Technique

Severity

Informational

AWS security service enumeration activity, potentially indicating reconnaissance.

Reconnaissance of security defenses to assess and identify exploitable weaknesses.