> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/aws-audit-log.md). # AWS Audit Log Alerts related to data source "AWS Audit Log". | Alert | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [A Backup vault policy was modified](/analytics-alerts/alerts-by-name/a-backup-vault-policy-was-modified.md) | | [A cloud function was created with an unusual runtime](/analytics-alerts/alerts-by-name/a-cloud-function-was-created-with-an-unusual-runtime.md) | | [A cloud identity created or modified a security group](/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md) | | [A cloud identity executed an API call from an unusual country](/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md) | | [A cloud identity had escalated its permissions](/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md) | | [A cloud identity invoked IAM related persistence operations](/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md) | | [A cloud identity performed multiple unusual activities](/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities.md) | | [A cloud identity started a Cloud Shell session](/analytics-alerts/alerts-by-name/a-cloud-identity-started-a-cloud-shell-session.md) | | [A cloud instance was stopped](/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md) | | [A cloud snapshot of AWS database or storage was modified or shared](/analytics-alerts/alerts-by-name/a-cloud-snapshot-of-aws-database-or-storage-was-modified-or-shared.md) | | [A cloud storage configuration was modified](/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified.md) | | [A cloud storage object was copied to a foreign cloud account](/analytics-alerts/alerts-by-name/a-cloud-storage-object-was-copied-to-a-foreign-cloud-account.md) | | [A Command Line Interface (CLI) command was executed from an AWS serverless compute service](/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-an-aws-serverless-compute-service.md) | | [A compute-attached identity executed API calls outside the instance's region](/analytics-alerts/alerts-by-name/a-compute-attached-identity-executed-api-calls-outside-the-instance-s-region.md) | | [A container registry was created or deleted](/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md) | | [A Kubernetes API operation was successfully invoked by an anonymous user](/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user.md) | | [A Kubernetes cluster role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md) | | [A Kubernetes cluster role was created](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created.md) | | [A Kubernetes cluster was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md) | | [A Kubernetes ConfigMap was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md) | | [A Kubernetes Cronjob was created](/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md) | | [A Kubernetes DaemonSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created.md) | | [A Kubernetes dashboard service account was used outside the cluster](/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster.md) | | [A Kubernetes deployment was created](/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created.md) | | [A Kubernetes ephemeral container was created](/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md) | | [A Kubernetes namespace was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md) | | [A Kubernetes node service account activity from external IP](/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip.md) | | [A Kubernetes Pod was created with a sidecar container](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container.md) | | [A Kubernetes Pod was deleted](/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted.md) | | [A Kubernetes ReplicaSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created.md) | | [A Kubernetes role binding was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md) | | [A Kubernetes secret was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md) | | [A Kubernetes service account executed an unusual API call](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md) | | [A Kubernetes service account has enumerated its permissions](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions.md) | | [A Kubernetes service account was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md) | | [A Kubernetes service was created or deleted](/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md) | | [A Kubernetes StatefulSet was created](/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created.md) | | [A user logged in to the AWS console for the first time](/analytics-alerts/alerts-by-name/a-user-logged-in-to-the-aws-console-for-the-first-time.md) | | [Abnormal Allocation of compute resources in multiple regions](/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions.md) | | [AI model discovery](/analytics-alerts/alerts-by-name/ai-model-discovery.md) | | [AI safeguards deletion attempt](/analytics-alerts/alerts-by-name/ai-safeguards-deletion-attempt.md) | | [AI safeguards were modified](/analytics-alerts/alerts-by-name/ai-safeguards-were-modified.md) | | [Allocation of multiple cloud compute resources](/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources.md) | | [An AWS database service master user password was changed](/analytics-alerts/alerts-by-name/an-aws-database-service-master-user-password-was-changed.md) | | [An AWS EC2 instance containing sensitive data was exported](/analytics-alerts/alerts-by-name/an-aws-ec2-instance-containing-sensitive-data-was-exported.md) | | [An AWS EC2 instance was exported from a production account](/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-from-a-production-account.md) | | [An AWS EC2 instance was exported into an unknown S3 bucket](/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-into-an-unknown-s3-bucket.md) | | [An AWS EFS File-share mount was deleted](/analytics-alerts/alerts-by-name/an-aws-efs-file-share-mount-was-deleted.md) | | [An AWS EFS file-share was deleted](/analytics-alerts/alerts-by-name/an-aws-efs-file-share-was-deleted.md) | | [An AWS EKS cluster was created or deleted](/analytics-alerts/alerts-by-name/an-aws-eks-cluster-was-created-or-deleted.md) | | [An AWS GuardDuty IP set was created](/analytics-alerts/alerts-by-name/an-aws-guardduty-ip-set-was-created.md) | | [An AWS Lambda Function was created](/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-created.md) | | [An AWS Lambda function was modified](/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-modified.md) | | [An AWS RDS Global Cluster Deletion](/analytics-alerts/alerts-by-name/an-aws-rds-global-cluster-deletion.md) | | [An AWS RDS instance was created from a snapshot](/analytics-alerts/alerts-by-name/an-aws-rds-instance-was-created-from-a-snapshot.md) | | [An AWS Route 53 domain was transferred to another AWS account](/analytics-alerts/alerts-by-name/an-aws-route-53-domain-was-transferred-to-another-aws-account.md) | | [An AWS S3 bucket configuration was modified](/analytics-alerts/alerts-by-name/an-aws-s3-bucket-configuration-was-modified.md) | | [An AWS SAML provider was modified](/analytics-alerts/alerts-by-name/an-aws-saml-provider-was-modified.md) | | [An AWS SES identity was deleted](/analytics-alerts/alerts-by-name/an-aws-ses-identity-was-deleted.md) | | [An EBS snapshot block was downloaded](/analytics-alerts/alerts-by-name/an-ebs-snapshot-block-was-downloaded.md) | | [An Email address was added to AWS SES](/analytics-alerts/alerts-by-name/an-email-address-was-added-to-aws-ses.md) | | [An IAM group was created](/analytics-alerts/alerts-by-name/an-iam-group-was-created.md) | | [An identity accessed a backup cloud storage](/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage.md) | | [An identity accessed a cloud storage for the first time](/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time.md) | | [An identity attached an administrative policy to an IAM user or role](/analytics-alerts/alerts-by-name/an-identity-attached-an-administrative-policy-to-an-iam-user-or-role.md) | | [An identity created or updated password for an IAM user](/analytics-alerts/alerts-by-name/an-identity-created-or-updated-password-for-an-iam-user.md) | | [An identity disabled bucket logging](/analytics-alerts/alerts-by-name/an-identity-disabled-bucket-logging.md) | | [An identity initiated a download of multiple cloud objects](/analytics-alerts/alerts-by-name/an-identity-initiated-a-download-of-multiple-cloud-objects.md) | | [An identity performed a suspicious download of multiple cloud storage objects](/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects.md) | | [An identity started an AWS SSM session](/analytics-alerts/alerts-by-name/an-identity-started-an-aws-ssm-session.md) | | [An identity successfully extracted multiple secrets within the organization](/analytics-alerts/alerts-by-name/an-identity-successfully-extracted-multiple-secrets-within-the-organization.md) | | [An operation was performed by an identity from a domain that was not seen in the organization](/analytics-alerts/alerts-by-name/an-operation-was-performed-by-an-identity-from-a-domain-that-was-not-seen-in-the-organization.md) | | [An RDS snapshot containing sensitive data was exported](/analytics-alerts/alerts-by-name/an-rds-snapshot-containing-sensitive-data-was-exported.md) | | [An RDS snapshot was exported from a production account](/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-from-a-production-account.md) | | [An RDS snapshot was exported to an unknown bucket](/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-bucket.md) | | [An RDS snapshot was exported to an unknown S3 bucket](/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-s3-bucket.md) | | [An S3 replication policy to an unknown bucket was created](/analytics-alerts/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created.md) | | [An unknown account was invited to the AWS organization](/analytics-alerts/alerts-by-name/an-unknown-account-was-invited-to-the-aws-organization.md) | | [An unusual read activity of cloud object](/analytics-alerts/alerts-by-name/an-unusual-read-activity-of-cloud-object.md) | | [Aurora DB cluster stopped](/analytics-alerts/alerts-by-name/aurora-db-cluster-stopped.md) | | [AWS Backup recovery point deletion](/analytics-alerts/alerts-by-name/aws-backup-recovery-point-deletion.md) | | [AWS Backup vault was deleted](/analytics-alerts/alerts-by-name/aws-backup-vault-was-deleted.md) | | [AWS Bedrock AI infrastructure enumeration activity](/analytics-alerts/alerts-by-name/aws-bedrock-ai-infrastructure-enumeration-activity.md) | | [AWS Bedrock model invocation logging deletion](/analytics-alerts/alerts-by-name/aws-bedrock-model-invocation-logging-deletion.md) | | [AWS CloudTrail has been stopped](/analytics-alerts/alerts-by-name/aws-cloudtrail-has-been-stopped.md) | | [AWS CloudTrail modification](/analytics-alerts/alerts-by-name/aws-cloudtrail-modification.md) | | [AWS CloudWatch log group deletion](/analytics-alerts/alerts-by-name/aws-cloudwatch-log-group-deletion.md) | | [AWS CloudWatch log stream deletion](/analytics-alerts/alerts-by-name/aws-cloudwatch-log-stream-deletion.md) | | [AWS Config Recorder stopped](/analytics-alerts/alerts-by-name/aws-config-recorder-stopped.md) | | [AWS config resource deletion](/analytics-alerts/alerts-by-name/aws-config-resource-deletion.md) | | [AWS console login without MFA](/analytics-alerts/alerts-by-name/aws-console-login-without-mfa.md) | | [AWS data asset shared public](/analytics-alerts/alerts-by-name/aws-data-asset-shared-public.md) | | [AWS EBS enumeration activity](/analytics-alerts/alerts-by-name/aws-ebs-enumeration-activity.md) | | [AWS EBS snapshot deletion](/analytics-alerts/alerts-by-name/aws-ebs-snapshot-deletion.md) | | [AWS EC2 infrastructure enumeration activity](/analytics-alerts/alerts-by-name/aws-ec2-infrastructure-enumeration-activity.md) | | [AWS EC2 instance exported into S3](/analytics-alerts/alerts-by-name/aws-ec2-instance-exported-into-s3.md) | | [AWS Flow Logs deletion](/analytics-alerts/alerts-by-name/aws-flow-logs-deletion.md) | | [AWS Guard-Duty detector deletion](/analytics-alerts/alerts-by-name/aws-guard-duty-detector-deletion.md) | | [AWS IAM resource group deletion](/analytics-alerts/alerts-by-name/aws-iam-resource-group-deletion.md) | | [AWS IAM Role Created with Cross-Account Access](/analytics-alerts/alerts-by-name/aws-iam-role-created-with-cross-account-access.md) | | [AWS IAM Role's Trusted Policy Modification Allows Cross-Account Access](/analytics-alerts/alerts-by-name/aws-iam-role-s-trusted-policy-modification-allows-cross-account-access.md) | | [AWS Lambda Cross-Account sensitive permissions configured](/analytics-alerts/alerts-by-name/aws-lambda-cross-account-sensitive-permissions-configured.md) | | [AWS Lambda infrastructure enumeration activity](/analytics-alerts/alerts-by-name/aws-lambda-infrastructure-enumeration-activity.md) | | [AWS network ACL rule creation](/analytics-alerts/alerts-by-name/aws-network-acl-rule-creation.md) | | [AWS network ACL rule deletion](/analytics-alerts/alerts-by-name/aws-network-acl-rule-deletion.md) | | [AWS Password Policy Discovery](/analytics-alerts/alerts-by-name/aws-password-policy-discovery.md) | | [AWS principals discovery](/analytics-alerts/alerts-by-name/aws-principals-discovery.md) | | [AWS RDS cluster deletion](/analytics-alerts/alerts-by-name/aws-rds-cluster-deletion.md) | | [AWS resource discovery](/analytics-alerts/alerts-by-name/aws-resource-discovery.md) | | [AWS root account activity](/analytics-alerts/alerts-by-name/aws-root-account-activity.md) | | [AWS S3 bucket data retention policy change through S3 Lifecycle rule](/analytics-alerts/alerts-by-name/aws-s3-bucket-data-retention-policy-change-through-s3-lifecycle-rule.md) | | [AWS S3 bucket was exposed to public access](/analytics-alerts/alerts-by-name/aws-s3-bucket-was-exposed-to-public-access.md) | | [AWS S3 Buckets enumeration activity](/analytics-alerts/alerts-by-name/aws-s3-buckets-enumeration-activity.md) | | [AWS Secrets Manager discovery](/analytics-alerts/alerts-by-name/aws-secrets-manager-discovery.md) | | [AWS Security Group remote access allowed from an unknown external IP address](/analytics-alerts/alerts-by-name/aws-security-group-remote-access-allowed-from-an-unknown-external-ip-address.md) | | [AWS Security Service Enumeration](/analytics-alerts/alerts-by-name/aws-security-service-enumeration.md) | | [AWS SecurityHub findings were modified](/analytics-alerts/alerts-by-name/aws-securityhub-findings-were-modified.md) | | [AWS SES account sending settings modified](/analytics-alerts/alerts-by-name/aws-ses-account-sending-settings-modified.md) | | [AWS SSM association created with inventory collection document](/analytics-alerts/alerts-by-name/aws-ssm-association-created-with-inventory-collection-document.md) | | [AWS SSM parameters discovery](/analytics-alerts/alerts-by-name/aws-ssm-parameters-discovery.md) | | [AWS SSM parameters retrieval](/analytics-alerts/alerts-by-name/aws-ssm-parameters-retrieval.md) | | [AWS SSM send command attempt](/analytics-alerts/alerts-by-name/aws-ssm-send-command-attempt.md) | | [AWS Storage Gateway enumeration](/analytics-alerts/alerts-by-name/aws-storage-gateway-enumeration.md) | | [AWS Storage Gateway file share enumeration](/analytics-alerts/alerts-by-name/aws-storage-gateway-file-share-enumeration.md) | | [AWS STS temporary credentials were generated](/analytics-alerts/alerts-by-name/aws-sts-temporary-credentials-were-generated.md) | | [AWS support case creation](/analytics-alerts/alerts-by-name/aws-support-case-creation.md) | | [AWS Systems Manager hosts enumeration](/analytics-alerts/alerts-by-name/aws-systems-manager-hosts-enumeration.md) | | [AWS Transfer Family server created](/analytics-alerts/alerts-by-name/aws-transfer-family-server-created.md) | | [AWS user creation](/analytics-alerts/alerts-by-name/aws-user-creation.md) | | [AWS web ACL deletion](/analytics-alerts/alerts-by-name/aws-web-acl-deletion.md) | | [Bedrock model shared with a foreign account](/analytics-alerts/alerts-by-name/bedrock-model-shared-with-a-foreign-account.md) | | [Billing admin role was removed](/analytics-alerts/alerts-by-name/billing-admin-role-was-removed.md) | | [Bucket's block public access setting turned off](/analytics-alerts/alerts-by-name/bucket-s-block-public-access-setting-turned-off.md) | | [Bucket's object ownership controls were modified](/analytics-alerts/alerts-by-name/bucket-s-object-ownership-controls-were-modified.md) | | [Cloud access key creation](/analytics-alerts/alerts-by-name/cloud-access-key-creation.md) | | [Cloud activity from a high-risk IP address](/analytics-alerts/alerts-by-name/cloud-activity-from-a-high-risk-ip-address.md) | | [Cloud AI agent was modified](/analytics-alerts/alerts-by-name/cloud-ai-agent-was-modified.md) | | [Cloud compute instance user data script modification](/analytics-alerts/alerts-by-name/cloud-compute-instance-user-data-script-modification.md) | | [Cloud compute serial console access](/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md) | | [Cloud compute volume creation attempt](/analytics-alerts/alerts-by-name/cloud-compute-volume-creation-attempt.md) | | [Cloud email infrastructure enumeration activity](/analytics-alerts/alerts-by-name/cloud-email-infrastructure-enumeration-activity.md) | | [Cloud email sending was enabled](/analytics-alerts/alerts-by-name/cloud-email-sending-was-enabled.md) | | [Cloud email service activity](/analytics-alerts/alerts-by-name/cloud-email-service-activity.md) | | [Cloud identity reached a throttling API rate](/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate.md) | | [Cloud IMDS access followed by remote token usage](/analytics-alerts/alerts-by-name/cloud-imds-access-followed-by-remote-token-usage.md) | | [Cloud impersonation attempt by unusual identity type](/analytics-alerts/alerts-by-name/cloud-impersonation-attempt-by-unusual-identity-type.md) | | [Cloud infrastructure discovery across multiple regions](/analytics-alerts/alerts-by-name/cloud-infrastructure-discovery-across-multiple-regions.md) | | [Cloud infrastructure enumeration activity](/analytics-alerts/alerts-by-name/cloud-infrastructure-enumeration-activity.md) | | [Cloud instance creation attempt](/analytics-alerts/alerts-by-name/cloud-instance-creation-attempt.md) | | [Cloud instance deletion attempt](/analytics-alerts/alerts-by-name/cloud-instance-deletion-attempt.md) | | [Cloud penetration testing tool activity](/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity.md) | | [Cloud snapshot created or modified](/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified.md) | | [Cloud snapshot of a database or storage instance was publicly shared](/analytics-alerts/alerts-by-name/cloud-snapshot-of-a-database-or-storage-instance-was-publicly-shared.md) | | [Cloud storage automatic backup disabled](/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled.md) | | [Cloud storage delete protection disabled](/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled.md) | | [Cloud user performed multiple actions that were denied](/analytics-alerts/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied.md) | | [Cloud Watch alarm deletion](/analytics-alerts/alerts-by-name/cloud-watch-alarm-deletion.md) | | [CloudTrail logging deletion](/analytics-alerts/alerts-by-name/cloudtrail-logging-deletion.md) | | [Command execution via AWS SSM](/analytics-alerts/alerts-by-name/command-execution-via-aws-ssm.md) | | [Compute activity in dormant cloud region](/analytics-alerts/alerts-by-name/compute-activity-in-dormant-cloud-region.md) | | [Data encryption was disabled](/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md) | | [Deletion of multiple cloud resources](/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources.md) | | [Denied API call by a Kubernetes service account](/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account.md) | | [Disable AWS audit logs through Event Selectors](/analytics-alerts/alerts-by-name/disable-aws-audit-logs-through-event-selectors.md) | | [Disable encryption operations](/analytics-alerts/alerts-by-name/disable-encryption-operations.md) | | [EBS snapshots were created from an EC2 instance](/analytics-alerts/alerts-by-name/ebs-snapshots-were-created-from-an-ec2-instance.md) | | [EBS volume attachment attempt](/analytics-alerts/alerts-by-name/ebs-volume-attachment-attempt.md) | | [EBS volume detachment attempt](/analytics-alerts/alerts-by-name/ebs-volume-detachment-attempt.md) | | [EC2 backdoor created with newly added external SSH or RDP access](/analytics-alerts/alerts-by-name/ec2-backdoor-created-with-newly-added-external-ssh-or-rdp-access.md) | | [EC2 instance Amazon machine image was created](/analytics-alerts/alerts-by-name/ec2-instance-amazon-machine-image-was-created.md) | | [Foreign account was granted permissions to S3 bucket via resource-based policy](/analytics-alerts/alerts-by-name/foreign-account-was-granted-permissions-to-s3-bucket-via-resource-based-policy.md) | | [IAM Enumeration sequence](/analytics-alerts/alerts-by-name/iam-enumeration-sequence.md) | | [IAM inline policy was added to group](/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-group.md) | | [IAM inline policy was added to role](/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-role.md) | | [IAM inline policy was added to user](/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-user.md) | | [IAM instance profile associations were described](/analytics-alerts/alerts-by-name/iam-instance-profile-associations-were-described.md) | | [IAM instance profile was associated with EC2 instance](/analytics-alerts/alerts-by-name/iam-instance-profile-was-associated-with-ec2-instance.md) | | [IAM instance profile was created](/analytics-alerts/alerts-by-name/iam-instance-profile-was-created.md) | | [IAM instance profile was replaced for EC2 instance](/analytics-alerts/alerts-by-name/iam-instance-profile-was-replaced-for-ec2-instance.md) | | [IAM policy default version was changed](/analytics-alerts/alerts-by-name/iam-policy-default-version-was-changed.md) | | [IAM policy version was created](/analytics-alerts/alerts-by-name/iam-policy-version-was-created.md) | | [IAM policy was attached to group](/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-group.md) | | [IAM policy was attached to role](/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-role.md) | | [IAM role trust policy modification](/analytics-alerts/alerts-by-name/iam-role-trust-policy-modification.md) | | [IAM role was created](/analytics-alerts/alerts-by-name/iam-role-was-created.md) | | [IAM role-attached managed policies were listed](/analytics-alerts/alerts-by-name/iam-role-attached-managed-policies-were-listed.md) | | [IAM User added to an IAM group](/analytics-alerts/alerts-by-name/iam-user-added-to-an-iam-group.md) | | [Impossible travel by a cloud identity](/analytics-alerts/alerts-by-name/impossible-travel-by-a-cloud-identity.md) | | [Kubernetes admission controller activity](/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md) | | [Kubernetes cluster events deletion](/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md) | | [Kubernetes enumeration activity](/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md) | | [Kubernetes network policy modification](/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md) | | [Kubernetes Pod Created with host Inter Process Communications (IPC) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace.md) | | [Kubernetes Pod created with host process ID (PID) namespace](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace.md) | | [Kubernetes Pod Created With Sensitive Volume](/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume.md) | | [Kubernetes pod creation from unknown container image registry](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry.md) | | [Kubernetes pod creation with host network](/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network.md) | | [Kubernetes Privileged Pod Creation](/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation.md) | | [Kubernetes secrets enumeration for the first time](/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time.md) | | [Kubernetes service account activity outside the cluster](/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster.md) | | [Kubernetes vulnerability scanning tool usage](/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage.md) | | [Log enumeration via cloud native logging service](/analytics-alerts/alerts-by-name/log-enumeration-via-cloud-native-logging-service.md) | | [Logging was impaired via external encryption key](/analytics-alerts/alerts-by-name/logging-was-impaired-via-external-encryption-key.md) | | [MFA device was removed/deactivated from an IAM user](/analytics-alerts/alerts-by-name/mfa-device-was-removed-deactivated-from-an-iam-user.md) | | [ML artifacts destruction](/analytics-alerts/alerts-by-name/ml-artifacts-destruction.md) | | [Multi region enumeration activity](/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md) | | [Multiple cloud snapshots export](/analytics-alerts/alerts-by-name/multiple-cloud-snapshots-export.md) | | [Multiple failed AWS assume role attempts](/analytics-alerts/alerts-by-name/multiple-failed-aws-assume-role-attempts.md) | | [Multiple failed logins from a single IP](/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip.md) | | [Multiple risk indicators for a cloud identity](/analytics-alerts/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity.md) | | [Network sniffing detected in Cloud environment](/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment.md) | | [New cloud identity created with administrative policy](/analytics-alerts/alerts-by-name/new-cloud-identity-created-with-administrative-policy.md) | | [Object versioning was disabled](/analytics-alerts/alerts-by-name/object-versioning-was-disabled.md) | | [Potential creation of persistent cloud credentials](/analytics-alerts/alerts-by-name/potential-creation-of-persistent-cloud-credentials.md) | | [Potential denial of wallet abusing AI services](/analytics-alerts/alerts-by-name/potential-denial-of-wallet-abusing-ai-services.md) | | [Remote usage of an AWS service token](/analytics-alerts/alerts-by-name/remote-usage-of-an-aws-service-token.md) | | [Remote usage of AWS Lambda's role](/analytics-alerts/alerts-by-name/remote-usage-of-aws-lambda-s-role.md) | | [Retrieval of cloud compute EC2 instance user data](/analytics-alerts/alerts-by-name/retrieval-of-cloud-compute-ec2-instance-user-data.md) | | [S3 configuration deletion](/analytics-alerts/alerts-by-name/s3-configuration-deletion.md) | | [Serial console access was enabled in AWS account](/analytics-alerts/alerts-by-name/serial-console-access-was-enabled-in-aws-account.md) | | [SES Production Access Requested](/analytics-alerts/alerts-by-name/ses-production-access-requested.md) | | [Storage enumeration activity](/analytics-alerts/alerts-by-name/storage-enumeration-activity.md) | | [Suspicious activity indicating a potential abuse of a cloud-native email service](/analytics-alerts/alerts-by-name/suspicious-activity-indicating-a-potential-abuse-of-a-cloud-native-email-service.md) | | [Suspicious activity on logging bucket](/analytics-alerts/alerts-by-name/suspicious-activity-on-logging-bucket.md) | | [Suspicious AI Dataset Download](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-download.md) | | [Suspicious AI Dataset Label Modification](/analytics-alerts/alerts-by-name/suspicious-ai-dataset-label-modification.md) | | [Suspicious AI model usage from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-ai-model-usage-from-a-tor-exit-node.md) | | [Suspicious API call from a Tor exit node](/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node.md) | | [Suspicious AWS SSM parameters retrieval activity](/analytics-alerts/alerts-by-name/suspicious-aws-ssm-parameters-retrieval-activity.md) | | [Suspicious cloud compute instance SSH keys modification attempt](/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt.md) | | [Suspicious cloud user data modification attempt followed by VM restart](/analytics-alerts/alerts-by-name/suspicious-cloud-user-data-modification-attempt-followed-by-vm-restart.md) | | [Suspicious EBS snapshots deletion](/analytics-alerts/alerts-by-name/suspicious-ebs-snapshots-deletion.md) | | [Suspicious heavy allocation of compute resources - possible mining activity](/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity.md) | | [Suspicious identity downloaded multiple objects from a bucket](/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket.md) | | [Suspicious ML Model Download](/analytics-alerts/alerts-by-name/suspicious-ml-model-download.md) | | [Suspicious objects encryption in an AWS bucket](/analytics-alerts/alerts-by-name/suspicious-objects-encryption-in-an-aws-bucket.md) | | [Suspicious secrets dump activity](/analytics-alerts/alerts-by-name/suspicious-secrets-dump-activity.md) | | [Suspicious usage of EC2 token](/analytics-alerts/alerts-by-name/suspicious-usage-of-ec2-token.md) | | [Unusual AI dataset modification](/analytics-alerts/alerts-by-name/unusual-ai-dataset-modification.md) | | [Unusual AI Knowledge Base Modification](/analytics-alerts/alerts-by-name/unusual-ai-knowledge-base-modification.md) | | [Unusual AI model invocation](/analytics-alerts/alerts-by-name/unusual-ai-model-invocation.md) | | [Unusual AI RAG Knowledge Base Modification](/analytics-alerts/alerts-by-name/unusual-ai-rag-knowledge-base-modification.md) | | [Unusual AWS Bedrock model access request](/analytics-alerts/alerts-by-name/unusual-aws-bedrock-model-access-request.md) | | [Unusual AWS CLI/SDK activity](/analytics-alerts/alerts-by-name/unusual-aws-cli-sdk-activity.md) | | [Unusual AWS S3 objects deletion](/analytics-alerts/alerts-by-name/unusual-aws-s3-objects-deletion.md) | | [Unusual AWS SageMaker notebook access](/analytics-alerts/alerts-by-name/unusual-aws-sagemaker-notebook-access.md) | | [Unusual AWS systems manager activity](/analytics-alerts/alerts-by-name/unusual-aws-systems-manager-activity.md) | | [Unusual certificate management activity](/analytics-alerts/alerts-by-name/unusual-certificate-management-activity.md) | | [Unusual cloud identity impersonation](/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md) | | [Unusual cross projects activity](/analytics-alerts/alerts-by-name/unusual-cross-projects-activity.md) | | [Unusual exec into a Kubernetes Pod](/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod.md) | | [Unusual Identity and Access Management (IAM) activity](/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity.md) | | [Unusual key management activity](/analytics-alerts/alerts-by-name/unusual-key-management-activity.md) | | [Unusual Kubernetes secret access](/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access.md) | | [Unusual multi-region AWS Resource Explorer searches](/analytics-alerts/alerts-by-name/unusual-multi-region-aws-resource-explorer-searches.md) | | [Unusual resource modification by newly seen IAM user](/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md) | | [Unusual secret management activity](/analytics-alerts/alerts-by-name/unusual-secret-management-activity.md) | | [Unusual user-agent for a cloud identity](/analytics-alerts/alerts-by-name/unusual-user-agent-for-a-cloud-identity.md) | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/aws-audit-log.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.