Cloud resource logging was disabled

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2025-10-27

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Data Asset Disaster Recovery Risks, Cloud Data Asset Protection Tampering, Data Detection & Response
ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Cloud Logs (T1562.008)
Severity	Informational

Cloud resource logging was disabled.

Avoiding detection of their activities by limiting the amount of data collected.
This action may be preliminary to resource deletion or data exhilaration from the resource.
Setting the stage for further attacks, like a Ransomware Attack.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Cloud Logs (T1562.008)
Severity	Informational

A failed attempt to disable cloud resource logging.

Avoiding detection of their activities by limiting the amount of data collected.
This action may be preliminary to resource deletion or data exhilaration from the resource.
Setting the stage for further attacks, like a Ransomware Attack.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Cloud Logs (T1562.008)
Severity	Informational

Cloud resource logging was disabled on a DB/storage resource.

Avoiding detection of their activities by limiting the amount of data collected.
This action may be preliminary to resource deletion or data exhilaration from the resource.
Setting the stage for further attacks, like a Ransomware Attack.

ATT&CK Tactic	Defense Evasion (TA0005)
ATT&CK Technique	Impair Defenses: Disable or Modify Cloud Logs (T1562.008)
Severity	Low

Cloud resource logging was disabled on a DB/storage resource.

Avoiding detection of their activities by limiting the amount of data collected.
This action may be preliminary to resource deletion or data exhilaration from the resource.
Setting the stage for further attacks, like a Ransomware Attack.