Cloud penetration testing tool activity

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	7 Days
Required Data	Requires one of the following data sources: AWS Audit Log OR Azure Audit Log OR Gcp Audit Log OR Microsoft Graph Logs
Detection Modules	Cloud
Detector Tags	Microsoft Graph Activity Logs
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution (T1204)
Severity	High

A cloud API was successfully executed using a known cloud penetration testing tool.

Leverage known attack tools to enumerate resources, identify vulnerabilities, or exploit cloud configurations.

Confirm if authorized penetration testing activity is currently scheduled.
Review the API operations performed by the identity to determine the intent and scope of the activity.

A failed cloud API was executed using a known cloud penetration testing tool.

Leverage known attack tools to enumerate resources, identify vulnerabilities, or exploit cloud configurations.

Confirm if authorized penetration testing activity is currently scheduled.
Review the API operations performed by the identity to determine the intent and scope of the activity.

A cloud API was successfully executed using a known cloud security assessment tool.

Leverage known attack tools to enumerate resources, identify vulnerabilities, or exploit cloud configurations.

Confirm if authorized penetration testing activity is currently scheduled.
Review the API operations performed by the identity to determine the intent and scope of the activity.

A cloud API was successfully executed using a known cloud penetration testing tool by an Azure application.

Leverage known attack tools to enumerate resources, identify vulnerabilities, or exploit cloud configurations.

Confirm if authorized penetration testing activity is currently scheduled.
Review the API operations performed by the identity to determine the intent and scope of the activity.