Data exfiltration from cloud database

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Hour
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Azure Audit Log OR Gcp Audit Log
Detection Modules	Cloud
Detector Tags	Cloud Data Asset Exfiltration, Data Detection & Response
ATT&CK Tactic	Exfiltration (TA0010) Collection (TA0009)
ATT&CK Technique	Data from Cloud Storage (T1530) Automated Exfiltration (T1020)
Severity	Low

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Exfiltrate data from the cloud environment.

Check the identity which invoked the operation.

ATT&CK Tactic

ATT&CK Technique

Severity

High

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Exfiltrate data from the cloud environment.

Check the identity which invoked the operation.

ATT&CK Tactic

ATT&CK Technique

Severity

High

An identity tries to exfiltrate data from cloud database, as indicated by multiple signals.

Exfiltrate data from the cloud environment.

Check the identity which invoked the operation.