Increase in Job-Related Site Visits

Cortex XSIAM Analytics Alert Reference by Alert name

Product: Cortex XSIAM
Last date published: 2026-05-18
Category: Analytics Alert Reference
Index by: Alert name

Synopsis

Activation Period	14 Days
Training Period	30 Days
Test Period	1 Day
Deduplication Period	1 Day
Required Data	Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR Palo Alto Networks Firewall threat Logs Requires one of the following data sources: Palo Alto Networks Firewall EAL Logs OR XDR Agent
Detection Modules	Identity Threat Module
Detector Tags
ATT&CK Tactic	Reconnaissance (TA0043)
ATT&CK Technique	Search Open Websites/Domains (T1593)
Severity	Informational

Description

A user has visited multiple job-related sites in the past day.

Attacker's Goals

This may be an early indicator of an insider threat.

Investigative actions

Investigate the domains accessed and how popular they are in the organization.
Check how long the user has been part of the organization.
Verify that the user is not part of a department that accesses job sites as part of daily operations.