Untrusted process contacted LLM API

Cortex XSIAM Analytics Alert Reference by Alert name

Product

Cortex XSIAM

Last date published

2026-05-18

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Resource Development (TA0042)
ATT&CK Technique	Obtain Capabilities: Artificial Intelligence (T1588.007)
Severity	Informational

An untrusted process contacted an LLM API.

Adversaries may use LLM APIs to create malicious payload dynamically. Each payload will be slightly different making detection more complex.

ATT&CK Tactic	Resource Development (TA0042)
ATT&CK Technique	Obtain Capabilities: Artificial Intelligence (T1588.007)
Severity	Low

An untrusted process contacted a rare LLM API.

Adversaries may use LLM APIs to create malicious payload dynamically. Each payload will be slightly different making detection more complex.