https://cortex-docs.paloaltonetworks.com/analytics-alerts 1 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name 1 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-backup-vault-policy-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-browser-extension-was-installed-or-loaded-in-an-uncommon-way 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-browser-was-opened-in-private-mode 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-db-instance-was-exported-to-an-unknown-destination 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-function-was-created-with-an-unusual-runtime 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-performed-multiple-unusual-activities 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-identity-started-a-cloud-shell-session 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-snapshot-of-aws-database-or-storage-was-modified-or-shared 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-storage-configuration-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-cloud-storage-object-was-copied-to-a-foreign-cloud-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-a-gcp-serverless-compute-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-command-line-interface-cli-command-was-executed-from-an-aws-serverless-compute-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-cloud-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-commonly-abused-process-connected-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compiled-html-help-file-wrote-a-script-file-to-the-disk 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compressed-file-was-exfiltrated-over-ssh 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-cloud-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compromised-process-accessed-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-compute-attached-identity-executed-api-calls-outside-the-instance-s-region 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-computer-account-was-promoted-to-dc 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-executable-from-a-mounted-share-initiated-a-suspicious-outbound-network-connection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-executable-was-executed-by-an-unusual-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-contained-process-attempted-to-escape-using-the-notify-on-release-feature 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-authenticate-via-sso 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-log-in-to-a-vpn 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-disabled-user-attempted-to-log-in 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-domain-was-added-to-the-trusted-domains-list 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-gcp-cloud-sql-db-instance-was-exported-from-a-production-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-gcp-service-account-was-delegated-domain-wide-authority-in-google-workspace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-created-assigned-or-modified-a-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-performed-an-unusual-admin-console-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-identity-used-the-security-investigation-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-role-privilege-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-service-was-configured-as-unrestricted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-user-was-added-to-a-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-google-workspace-user-was-removed-from-a-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-api-operation-was-successfully-invoked-by-an-anonymous-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-daemonset-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-dashboard-service-account-was-used-outside-the-cluster 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-deployment-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-node-service-account-activity-from-external-ip 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-created-with-a-sidecar-container 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-pod-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-replicaset-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-has-enumerated-its-permissions 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-kubernetes-statefulset-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-lolbin-was-copied-to-a-different-location 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-machine-certificate-was-issued-with-a-mismatch 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-mail-forwarding-rule-was-configured-in-google-workspace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-microsoft-teams-application-was-installed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-microsoft-teams-bot-was-added-to-a-team 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-azure-email-domain-verification-was-requested 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-machine-attempted-kerberos-delegation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-new-server-was-added-to-an-azure-active-directory-hybrid-health-adfs-environment 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-non-browser-process-accessed-a-website-ui 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-possible-crypto-miner-was-detected-on-a-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-possible-risky-login-to-azure 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-cloud-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-connected-to-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-is-masquerading-as-a-common-microsoft-product 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-modified-an-ssh-authorized-keys-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-queried-the-adfs-database-decryption-key-via-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-process-was-executed-with-a-command-line-obfuscated-by-unicode-character-substitution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-dll-signed-by-an-uncommon-vendor-was-hijacked-into-a-microsoft-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-file-path-was-added-to-the-appinit-dlls-registry-value 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-ftp-user-has-been-detected-on-an-existing-ftp-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-rare-local-administrator-login 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-remote-service-was-created-via-rpc-over-smb 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-principal-was-created-in-azure 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-principal-was-removed-from-azure 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-service-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-login-from-tor 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-sso-sign-in-from-tor 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-successful-vpn-connection-from-tor 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-direct-syscall-was-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-executable-with-multiple-file-extensions-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-process-enrolled-for-a-certificate 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-suspicious-process-queried-ad-cs-objects-via-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-tcp-stream-was-created-directly-in-a-shell 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-application-s-access-to-the-google-workspace-domain-s-resources-was-revoked 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-application-was-authorized-to-access-the-google-workspace-apis 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-third-party-utility-was-copied-to-a-different-location 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-torrent-client-was-detected-on-a-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-files-on-a-remote-shared-folder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-abnormal-number-of-remote-shared-folders 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-an-uncommon-appid 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-multiple-time-consuming-websites 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-multiple-unusual-resources-via-sso 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-accessed-okta-s-admin-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-account-was-modified-to-password-never-expires 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-added-a-windows-firewall-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-attempted-to-bypass-okta-mfa 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-authenticated-with-weak-ntlm-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-certificate-was-issued-with-a-mismatch 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-changed-the-windows-system-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-a-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-new-usb-storage-device-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-a-usb-storage-device-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-from-a-new-country 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-connected-to-a-vpn-from-a-new-country 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-created-a-pfx-file-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-created-an-abnormal-password-protected-archive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-enabled-a-default-local-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-established-an-smb-connection-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-at-an-unusual-time-via-sso 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-at-an-unusual-time-via-vpn 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-from-an-abnormal-country-or-asn 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-in-to-the-aws-console-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-logged-on-to-multiple-workstations-via-schannel 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-mfa-factor 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-network-zone 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-an-okta-policy-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-modified-the-ca-audit-policy 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-observed-and-reported-unusual-activity-in-okta 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-performed-suspiciously-massive-file-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-printed-an-unusual-number-of-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-queried-ad-cs-objects-via-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-received-multiple-weakly-encrypted-service-tickets 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-rejected-an-sso-request-from-an-unusual-country 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-requested-multiple-service-tickets 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-sent-multiple-tgt-requests-to-irregular-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-took-numerous-screenshots 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-uploaded-malware-to-sharepoint-or-onedrive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-user-was-added-to-a-windows-security-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/a-wmi-subscriber-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-communication-to-a-rare-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-communication-with-a-rare-combination-of-tls-and-http-user-agent 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-connections-to-a-dormant-host-from-a-newly-seen-endpoint 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-file-activity-in-sccmcontentlib-shared-folder-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-icmp-echo-ping-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-increase-in-network-related-alerts-on-the-same-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-network-communication-through-tor-using-an-uncommon-port 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-network-communication-with-a-rare-combination-of-http-user-agent-and-http-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-process-connection-to-default-meterpreter-port 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts-from-a-rarely-seen-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-connections-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rdp-session-to-a-remote-host-from-a-rarely-seen-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-recurring-communications-to-a-rare-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-rpc-traffic-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts-from-a-rarely-seen-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-sensitive-rpc-traffic-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-smb-activity-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-smb-scanning-activity-to-multiple-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/abnormal-user-login-to-domain-controller 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubelet-credentials-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubernetes-ca-certificate-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-kubernetes-configuration-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/access-to-sensitive-host-files-from-within-a-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/account-probing 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/adding-execution-privileges 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/adfs-dkm-key-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/admin-privileges-were-granted-to-a-google-workspace-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/administrator-groups-enumerated-via-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-actor-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-determined-combination-of-risky-alerts-under-the-same-causality 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-model-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-safeguards-deletion-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ai-safeguards-were-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-added-to-google-marketplace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-added-to-the-google-workspace-trusted-oauth-apps-list 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-app-was-removed-from-a-blocked-list-in-google-workspace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-database-service-master-user-password-was-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-containing-sensitive-data-was-exported 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-from-a-production-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ec2-instance-was-exported-into-an-unknown-s3-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-efs-file-share-mount-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-efs-file-share-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-eks-cluster-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-guardduty-ip-set-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-lambda-function-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-rds-global-cluster-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-rds-instance-was-created-from-a-snapshot 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-route-53-domain-was-transferred-to-another-aws-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-s3-bucket-configuration-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-saml-provider-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-aws-ses-identity-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-application-reached-a-throttling-api-rate 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-dns-zone-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-policy-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-rule-collection-group-was-modified-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-rule-group-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-firewall-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-identity-performed-multiple-actions-that-were-denied 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-key-vault-key-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-key-vault-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-cluster-was-created-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-binding-or-cluster-role-binding-was-modified-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-role-or-cluster-role-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-kubernetes-service-account-was-modified-or-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-network-security-group-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-point-to-site-vpn-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-sql-database-was-exported-from-a-production-subscription 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-suppression-rule-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-virtual-network-device-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-virtual-network-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated-for-export-from-a-production-subscription 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vm-snapshot-sas-url-was-generated 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-azure-vpn-connection-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-ebs-snapshot-block-was-downloaded 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-email-address-was-added-to-aws-ses 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-executable-was-written-and-executed-by-a-web-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-iam-group-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-a-backup-cloud-storage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-a-cloud-storage-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-accessed-azure-kubernetes-secrets 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-attached-an-administrative-policy-to-an-iam-user-or-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-created-or-updated-password-for-an-iam-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-disabled-bucket-logging 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-initiated-a-download-of-multiple-cloud-objects 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-started-an-aws-ssm-session 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-successfully-extracted-multiple-secrets-within-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-identity-was-granted-permissions-to-manage-user-access-to-azure-resources 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-internal-cloud-resource-performed-port-scan-on-external-networks 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-operation-was-performed-by-an-identity-from-a-domain-that-was-not-seen-in-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-containing-sensitive-data-was-exported 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-from-a-production-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-rds-snapshot-was-exported-to-an-unknown-s3-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-s3-replication-policy-to-an-unknown-bucket-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-executable-was-remotely-written-over-smb-to-an-uncommon-destination 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-file-added-to-startup-related-registry-keys 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-file-was-created-in-the-startup-folder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-lolbin-execution-by-scheduled-task 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-from-a-managed-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-rdp-session-was-established 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-uncommon-service-was-started 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unknown-account-was-invited-to-the-aws-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unpopular-process-accessed-the-microphone-on-the-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unsigned-process-created-scheduled-task-and-performed-an-injection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-archive-file-creation-by-a-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-cloud-identity-was-granted-permissions-to-a-bigquery-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-process-in-ingress-nginx-has-accessed-a-service-account-token-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/an-unusual-read-activity-of-cloud-object 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/analytics-enhanced-rare-internal-firewall-vulnerability-threat-alert 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-executed-a-shell-script 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-interpreter-dynamic-library-loaded-into-a-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/applescript-process-executed-with-a-rare-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/attempt-to-execute-a-command-on-a-remote-host-using-psexec-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/attempted-azure-application-access-from-unknown-tenant 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aurora-db-cluster-stopped 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-attempt-by-a-honey-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-attempt-from-a-dormant-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-method-added-to-an-azure-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/authentication-method-was-added-to-azure-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/autorun-inf-created-in-root-c-drive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-backup-recovery-point-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-backup-vault-was-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-bedrock-ai-infrastructure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-bedrock-model-invocation-logging-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudtrail-has-been-stopped 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudtrail-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudwatch-log-group-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-cloudwatch-log-stream-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-config-recorder-stopped 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-config-resource-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-console-login-without-mfa 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-data-asset-shared-public 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ebs-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ebs-snapshot-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ec2-infrastructure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ec2-instance-exported-into-s3 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-flow-logs-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-guard-duty-detector-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-resource-group-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-role-created-with-cross-account-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-iam-role-s-trusted-policy-modification-allows-cross-account-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-lambda-cross-account-sensitive-permissions-configured 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-lambda-infrastructure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-network-acl-rule-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-network-acl-rule-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-password-policy-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-principals-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-rds-cluster-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-resource-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-root-account-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-bucket-data-retention-policy-change-through-s3-lifecycle-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-bucket-was-exposed-to-public-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-s3-buckets-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-secrets-manager-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-security-group-remote-access-allowed-from-an-unknown-external-ip-address 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-security-service-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-securityhub-findings-were-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ses-account-sending-settings-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-association-created-with-inventory-collection-document 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-parameters-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-parameters-retrieval 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-ssm-send-command-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-storage-gateway-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-storage-gateway-file-share-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-sts-temporary-credentials-were-generated 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-support-case-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-systems-manager-hosts-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-transfer-family-server-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-user-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/aws-web-acl-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-account-creation-by-a-non-standard-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-account-deletion-by-a-non-standard-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-account-unlock-password-reset-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-alert-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-elevation-request 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-ad-pim-role-settings-change 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-consent 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-credentials-added 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-application-uri-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-runbook-creation-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-runbook-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-automation-webhook-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-blob-container-access-level-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-conditional-access-policy-creation-or-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-device-code-authentication-flow-used 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-diagnostic-configuration-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-domain-federation-settings-modification-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-enumeration-activity-using-microsoft-graph-api 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-event-hub-authorization-rule-creation-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-event-hub-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-group-creation-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-key-vault-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-key-vault-secrets-were-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-kubernetes-events-were-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-mailbox-rule-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-monitor-alert-rule-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-network-watcher-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-permission-delegation-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-privilege-escalation-using-an-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-resource-group-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-route-table-creation-or-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-service-principal-application-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-service-principal-assigned-app-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-blob-anonymous-access-is-enabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-cross-tenant-object-replication-was-enabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-key-generated 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-storage-account-was-publicly-shared 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-temporary-access-pass-tap-registered-to-an-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-user-creation-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-user-password-reset 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-virtual-machine-commands-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/azure-vm-extension-abuse-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bedrock-model-shared-with-a-foreign-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bigquery-table-or-query-results-exfiltrated-to-a-foreign-project 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/billing-admin-role-was-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bitlocker-key-retrieval 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bitsadmin-exe-persistence-using-command-line-callback 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/broker-collection-error 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bronze-bit-exploit 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/browser-bookmark-files-accessed-by-a-rare-non-browser-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/browser-extension-installed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/brute-force-attempt-on-a-local-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bucket-s-block-public-access-setting-turned-off 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/bucket-s-object-ownership-controls-were-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cached-credentials-discovery-with-cmdkey 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/certutil-pfx-parsing 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/change-of-sudo-caching-configuration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/chrome-extension-installed-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/chrome-os-remote-access-policy-was-modified-in-google-workspace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/clickfix-powershell-executed-through-the-run-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-access-key-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-activity-from-a-high-risk-ip-address 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-ai-agent-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-instance-user-data-script-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-compute-volume-creation-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-infrastructure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-sending-was-enabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-email-service-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-imds-access-followed-by-remote-token-usage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-impersonation-attempt-by-unusual-identity-type 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-infrastructure-discovery-across-multiple-regions 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-infrastructure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-instance-creation-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-instance-deletion-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-organizational-policy-was-created-or-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-penetration-testing-tool-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-resource-logging-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-snapshot-created-or-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-snapshot-of-a-database-or-storage-instance-was-publicly-shared 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-storage-automatic-backup-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-storage-delete-protection-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-user-performed-multiple-actions-that-were-denied 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloud-watch-alarm-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/cloudtrail-logging-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/collection-error 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-in-a-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-via-aws-ssm 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-execution-via-wmiexec 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/command-running-with-comspec-in-the-command-line-argument 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/common-third-party-software-name-masquerading 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-connects-to-an-external-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-autoit-script-drops-an-executable-file-to-disk 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/commonly-abused-process-launched-as-a-system-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/compressing-data-using-python 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/compute-activity-in-dormant-cloud-region 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/conditional-access-policy-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/conhost-exe-spawned-a-suspicious-cmd-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/contained-process-execution-with-a-rare-github-url 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/copy-a-process-memory-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/correlation-rule-error 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/creation-or-modification-of-the-default-command-executed-when-opening-an-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/credentials-were-added-to-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-encryption-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-exfiltration-from-cloud-database 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/data-sharing-between-gcp-and-google-workspace-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/delayed-deletion-of-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/deletion-of-ad-cs-certificate-database-entries 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/denied-api-call-by-a-kubernetes-service-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/device-registration-policy-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-aws-audit-logs-through-event-selectors 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-encryption-operations 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/disable-microsoft-defender-antivirus-via-registry 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-accounts-with-pre-authentication-disabled-via-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-host-users-via-wmic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/discovery-of-misconfigured-certificate-templates-using-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/display-text-url-differs-from-actual-url 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dlp-sensitive-data-exposed-to-external-users 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dns-tunneling 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/download-a-script-using-the-python-requests-module 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/download-pattern-that-resembles-peer-to-peer-traffic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/dsc-desired-state-configuration-lateral-movement-using-powershell 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-snapshots-were-created-from-an-ec2-instance 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-volume-attachment-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ebs-volume-detachment-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ec2-backdoor-created-with-newly-added-external-ssh-or-rdp-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ec2-instance-amazon-machine-image-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/elevation-to-system-via-services 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-s-with-potentially-malicious-mime-type 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-a-potentially-malicious-file-extension 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-multiple-extensions 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-attachment-with-right-to-left-override-unicode-character 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-containing-a-link-with-an-ip-address-convention-was-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-containing-a-redirected-link 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-contains-url-delivering-high-risk-file-type 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-marked-as-spam-and-bulk-based-on-spam-confidence-level-and-bulk-complaint-level-values 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-mimics-replies-or-forwards-without-an-actual-ongoing-conversation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-sent-using-an-automated-system-or-script-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-address-using-a-public-provider-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-was-received-from-an-unknown-sender-using-a-disposable-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-with-file-sharing-link-containing-auto-download-parameter 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/email-with-url-shortener-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/encoded-information-using-windows-certificate-management-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/error-in-event-forwarding 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/excessive-user-account-lockouts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-anti-phish-policy-disabled-or-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-audit-log-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-compliance-search-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-dkim-signing-configuration-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-email-hiding-inbox-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-email-hiding-transport-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-inbox-forwarding-rule-configured 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-audit-bypass 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-delegation-permissions-added 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-mailbox-folder-permission-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-malware-filter-policy-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-safe-attachment-policy-disabled-or-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-safe-link-policy-disabled-or-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-transport-forwarding-rule-configured 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/exchange-user-mailbox-forwarding 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-created-to-disk-by-lsass-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-moved-to-windows-system-folder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage-by-windows-system-binary 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-at-an-early-startup-stage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-an-uncommon-process-with-a-local-domain-user-sid-at-an-early-startup-stage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-command-from-within-a-kubernetes-pod-using-kubelet-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-dllhost-exe-with-an-empty-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-masqueraded-third-party-utility 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/execution-of-renamed-lolbin 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-email-display-name-impersonation-of-internal-personnel 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-email-with-a-single-internal-recipient-hidden-in-bcc 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-login-password-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-sharing-was-turned-on-for-google-drive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-added-a-link-to-a-microsoft-teams-chat 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-call-via-microsoft-teams 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-created-a-microsoft-teams-conversation-with-suspicious-operations 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-invitation-to-azure-tenant 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/external-user-started-a-microsoft-teams-conversation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/extracting-credentials-from-unix-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-connections 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-dns 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-login-for-a-long-username-with-special-characters 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/failed-login-for-locked-out-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/file-transfer-from-unusual-ip-using-known-tools 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-azure-ad-powershell-operation-for-a-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-connection-from-a-country-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-seen-email-from-mailbox-owner-to-external-recipient-s-address-in-the-last-30-days 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-access-from-asn-for-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-access-from-asn-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-sso-resource-access-in-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-time-attachment-exchange 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-time-directory-sync-of-an-on-premises-domain-user-to-an-existing-cloud-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-attempt-from-a-country-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-from-asn-for-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/first-vpn-access-from-asn-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/fodhelper-exe-uac-bypass 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/foreign-account-was-granted-permissions-to-s3-bucket-via-resource-based-policy 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ftp-connection-using-an-anonymous-login-or-default-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-administrative-role-granted-to-a-cloud-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-data-asset-shared-public 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-firewall-rule-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-firewall-rule-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-deny-policy-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-role-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-iam-service-account-key-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-bucket-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-sink-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-logging-sink-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-pub-sub-subscription-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-pub-sub-topic-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-cloud-run-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-compute-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-deployment-manager-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-functions-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-iam-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-role-granted-to-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-secret-manager-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-sensitive-storage-role-granted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-disable 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-impersonation-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-service-account-key-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-set-iam-policy-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-configuration-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-storage-bucket-permissions-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-cloud-vpc-network-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-virtual-private-network-route-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gcp-vpc-firewall-rule-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-module-was-loaded 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-image-load-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-injection-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-by-a-common-process-sha256 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-ip-address-connection-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-process-execution-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-by-a-common-process-sha256 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/globally-uncommon-root-domain-port-combination-from-a-signed-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gmail-delegation-was-turned-on-for-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/gmail-routing-settings-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-marketplace-restrictions-were-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-automation-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-organizational-unit-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-third-party-application-s-security-settings-were-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/google-workspace-user-authentication-information-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/granting-access-to-an-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/hidden-attribute-was-added-to-a-file-using-attrib-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/http-with-suspicious-characteristics 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/hydra-password-brute-force-tool-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-enumeration-sequence 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-inline-policy-was-added-to-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-associations-were-described 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-associated-with-ec2-instance 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-instance-profile-was-replaced-for-ec2-instance 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-default-version-was-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-version-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-policy-was-attached-to-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-attached-managed-policies-were-listed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-trust-policy-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-role-was-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iam-user-added-to-an-iam-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/identity-assigned-an-azure-ad-administrator-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/image-file-execution-options-ifeo-registry-key-set 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-travel-by-a-cloud-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-traveler-sso 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/impossible-traveler-vpn 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/increase-in-job-related-site-visits 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/indicator-blocking 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/indirect-command-execution-using-the-program-compatibility-assistant 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/initial-person-to-person-email-contact 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/injection-into-rundll32-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/installation-of-a-new-system-v-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/intense-sso-failures 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-at-exe-privilege-escalation-method 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-local-account-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-by-a-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-by-a-service-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/interactive-login-from-a-shared-user-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/internal-login-password-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/invalid-saml-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ip-rotation-pattern-in-sso-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/iptables-configuration-command-was-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-pre-auth-failures-by-user-and-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-traffic-from-non-standard-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kerberos-user-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/key-credential-attribute-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/keylogging-using-system-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/known-service-display-name-with-uncommon-image-path 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/known-service-name-with-an-uncommon-image-path 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubelet-server-communication-from-a-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-api-server-communication-from-within-a-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-environment-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-nsenter-container-escape 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-inter-process-communications-ipc-namespace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-host-process-id-pid-namespace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-created-with-sensitive-volume 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-creation-from-unknown-container-image-registry 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-pod-creation-with-host-network 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-privileged-pod-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-secret-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-secrets-enumeration-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-service-account-activity-outside-the-cluster 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-version-disclosure 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanner-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/kubernetes-vulnerability-scanning-tool-usage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-ftp 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-generic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-https 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-upload-smtp 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/large-volume-of-files-potentially-containing-credentials-accessed-in-google-drive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-ad-cs-enumeration-via-attack-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-search-query-from-an-unpopular-and-unsigned-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ldap-traffic-from-non-standard-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-local-user-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-network-share-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-process-execution-with-a-rare-github-url 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/linux-system-firewall-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-account-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-group-enumeration-via-rpc 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-group-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-account-creation-by-a-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/local-user-enumeration-via-samr 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/log-enumeration-via-cloud-native-logging-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/logging-was-impaired-via-external-encryption-key 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/login-attempt-by-a-honey-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/login-by-a-dormant-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/logs-were-not-collected-from-a-data-source-for-an-abnormally-long-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbas-executable-injects-into-another-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbin-created-a-psscriptpolicytest-powershell-script-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lolbin-process-executed-with-a-high-integrity-level 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/lsass-dump-file-written-to-disk 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/machine-account-ntlm-relay 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/machine-account-was-added-to-a-domain-admins-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mailbox-client-access-setting-cas-changed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mailbox-enumeration-activity-by-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/manipulation-of-netsh-helper-dlls-registry-keys 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/masquerading-as-a-default-local-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/masquerading-as-the-linux-crond-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-activity-abnormal-to-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-compression-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-box 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-dropbox 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-google-drive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-files-deletion-in-microsoft-sharepoint-or-onedrive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-upload-to-a-rare-storage-or-mail-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/massive-upload-to-saas-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/member-added-to-a-windows-local-security-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/memory-dumping-with-comsvcs-dll 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-device-was-removed-deactivated-from-an-iam-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-disabled-for-google-workspace 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-was-disabled-for-a-google-workspace-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mfa-was-disabled-for-an-azure-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-365-dlp-policy-disabled-or-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-365-storage-services-exfiltration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-configuration-manager-device-registration-and-policy-request 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-adds-a-value-to-autostart-registry-key 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-injects-code-into-a-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawning-a-suspicious-one-liner 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-a-commonly-abused-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-office-process-spawns-conhost-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-onedrive-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-onenote-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-sharepoint-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-application-setup-policy-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-external-communication-policy-was-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/microsoft-teams-messages-were-exported-from-conversation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mimikatz-command-line-arguments 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ml-artifacts-destruction 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-ntlm-restrictions-in-the-registry 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-pam 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-of-the-ad-fs-identityserver-configuration-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/modification-or-deletion-of-an-azure-application-gateway-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/moniker-link-detected-in-url-s 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mount-command-was-executed-from-within-a-kubernetes-pod-to-list-all-the-attached-filesystems 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mpcmdrun-exe-was-used-to-download-files-into-the-system 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mshta-exe-launched-with-suspicious-arguments 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/mshta-exe-spawns-from-a-browser-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/msi-accessed-a-web-page-running-a-server-side-script 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/msiexec-execution-of-an-executable-from-an-uncommon-remote-location 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multi-region-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-alerts-associated-with-a-single-rdp-connection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-alerts-of-different-mitre-tactics-were-seen 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-azure-ad-admin-role-removals 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-cloud-snapshots-export 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-linux-host-by-the-same-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands-on-a-windows-host-by-the-same-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-discovery-like-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-failed-aws-assume-role-attempts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-network-related-alerts-of-different-mitre-tactics-on-the-same-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-network-related-alerts-produced-by-different-detectors-on-the-same-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-okta-mfa-requests-sent-to-a-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-rare-lolbin-process-executions-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-rare-process-executions-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-risk-indicators-for-a-cloud-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-suspicious-ftp-login-attempts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-suspicious-user-accounts-were-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-tgt-requests-for-users-without-kerberos-pre-authentication 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-uncommon-ssh-servers-with-the-same-server-host-key 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-user-accounts-failed-login-due-to-account-lockouts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-user-accounts-were-deleted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-users-authenticated-with-weak-ntlm-to-a-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/multiple-weakly-encrypted-kerberos-tickets-received 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/near-empty-email-from-an-external-sender 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/netcat-makes-or-gets-connections 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-addition-to-windows-defender-exclusion-list 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-administrative-behavior 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-cloud-identity-created-with-administrative-policy 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-ftp-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-shared-user-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/new-teams-application-published-to-the-organization-catalog 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/non-browser-access-to-a-pastebin-like-site 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntds-dit-file-written-by-an-uncommon-executable 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force-on-a-service-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force-on-an-administrator-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-brute-force 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-hash-harvesting 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-password-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ntlm-relay 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/numerous-emails-sent-by-a-single-sender-to-multiple-internal-recipients 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/object-versioning-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/office-process-accessed-an-unusual-lnk-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/office-process-spawned-with-suspicious-command-line-arguments 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-reset-password-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-unlock-by-admin 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-account-unlock 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-admin-privilege-assignment 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-api-token-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-device-assignment 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-fastpass-reported-phishing-attack-suspected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-reported-attack-suspected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-reported-threat-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/okta-user-session-impersonation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-file-download 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-file-upload 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/onedrive-folder-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-contains-file-sharing-service-link-sent-to-external-recipient 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-includes-an-external-bcc-recipient-observed-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outbound-email-to-an-address-hosted-by-a-public-email-service-provider 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/outlook-files-accessed-by-an-unsigned-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/owner-added-to-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/owner-was-added-to-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/parsing-rule-error 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/penetration-testing-tool-activity-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/permission-groups-discovery-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/phantom-dll-loading 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/pim-privilege-member-removal 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ping-to-localhost-from-an-uncommon-unsigned-parent-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/pkinit-tgt-authentication-request 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/port-scan 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/port-sweep 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-as-rep-roasting-attack 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-authentication-coercion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-binary-padding-using-dd 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-on-sudo-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-brute-force-or-configuration-change-attempt-on-cytool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-code-downloading-from-a-remote-host-by-regsvr32 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-collection-of-screen-captures-with-windows-problem-steps-recorder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-compromised-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-consentfix-oauth-token-theft-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-data-exfiltration-over-a-usb-storage-device 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-data-obfuscation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dcsync-from-a-non-domain-controller 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-distributed-file-system-namespace-management-dfsnm-abuse 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dll-hijack-into-a-microsoft-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-dll-search-order-hijacking 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-email-collection-using-outlook-rpc 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-external-rdp-brute-force 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-gpo-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-impossible-travel-pattern-sso 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-insider-threat-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-internal-data-exfiltration-over-a-usb-storage-device 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ipfs-traffic-was-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberoasting-attack 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberoasting-without-spns 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberos-relay-attack 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-kerberos-user-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-by-unsigned-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-of-microsoft-configuration-manager 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-malicious-net-compilation-started-by-a-commonly-abused-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-multistage-attack-in-microsoft-teams 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-network-service-discovery-via-command-line-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-network-sniffing-attempt-via-tcpdump-or-tshark 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-new-dhcp-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-pass-the-hash 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-path-traversal-via-http-request 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-persistence-via-group-policy-registry-keys 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-phishing-attack-via-microsoft-teams 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-privilege-escalation-using-delegated-msa-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-rdp-session-hijacking-using-tscon-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-search-for-password-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-spn-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-tgt-reuse-from-different-hosts-pass-the-ticket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-use-of-a-networking-driver-for-network-sniffing 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-use-of-ipfs-was-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-creation-of-persistent-cloud-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-dcsync-by-an-unusual-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-denial-of-wallet-abusing-ai-services 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-manager 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-kubelet-impersonation-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-ntlm-relay-attack 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-okta-access-limit-breach 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-phishing-has-been-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-sccm-credential-harvesting-using-wmi-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/potential-spoofing-of-internal-domain-spotted 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-initiates-a-network-connection-to-github 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-pfx-certificate-extraction 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-runs-suspicious-base64-encoded-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-suspicious-flags 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-used-to-export-mailbox-contents 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/powershell-used-to-remove-mailbox-export-request-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/privileged-certificate-request-via-certificate-template 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/privileged-role-used-by-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/procdump-executed-from-an-atypical-directory 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/psexec-was-executed-with-a-suspicious-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/punycode-characters-detected-in-url-s 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/python-http-server-started 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/quarantined-email-released-to-recipients 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/random-looking-domain-names 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-appid-usage-to-a-rare-destination 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-cloud-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-binary-connected-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-communication-over-email-ports-to-external-email-server-by-unsigned-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocol 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-dcom-rpc-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-dlp-rule-match-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-file-transfer-over-smb-protocol 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ldap-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-lolbin-process-execution-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-machine-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ms-update-server-was-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ms-update-traffic-over-http 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ntlm-access-by-user-to-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ntlm-usage-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resource 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-created-an-ssh-session-to-an-uncommon-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-executed-by-an-applescript 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-execution-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-execution-in-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-spawned-by-srvany-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-process-with-vnc-server-capabilities-started 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-rdp-session-to-a-remote-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity-from-a-rarely-seen-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-security-product-signed-executable-executed-in-the-network 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-service-dll-was-added-to-the-registry 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-signature-signed-executable-executed-in-the-network 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-smb-session-to-a-remote-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-smtp-s-session 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-ssh-session 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unix-process-divided-files-by-size 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unsigned-process-execution-by-scheduled-task 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-unsigned-process-spawned-by-office-process-under-suspicious-directory 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-windows-remote-management-winrm-http-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rare-winrm-session 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rarely-seen-sender-address-in-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rarely-seen-sender-domain-in-the-organization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-connection-to-localhost 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-connections-enabled-remotely-via-registry 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rdp-from-an-unmanaged-endpoint-in-a-typically-managed-subnet 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/reading-bash-command-history-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-access-to-rare-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-access-to-rare-ip 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-rare-domain-access-from-an-unsigned-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/recurring-rare-domain-access-to-dynamic-dns-domain 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/registration-of-uncommon-net-services-and-or-assemblies 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-account-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-code-execution-into-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-command-execution-via-wmic-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-dcom-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-psexec-like-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-service-command-execution-from-an-uncommon-source 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-service-start-from-an-uncommon-source 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-app-engine-service-account-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-aws-service-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-managed-identity-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-an-azure-service-principal-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-aws-lambda-s-role 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-usage-of-vm-service-account-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/remote-wmi-process-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/removal-of-an-azure-owner-from-an-application-or-service-principal 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/retrieval-of-cloud-compute-ec2-instance-user-data 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/retrieval-of-kubelet-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/run-downloaded-script-using-pipe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-executes-a-rare-unsigned-module 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-running-with-no-command-line-arguments 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/rundll32-exe-spawns-conhost-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/s3-configuration-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/saas-email-was-reported-by-the-user-or-administrator-as-a-phishing-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/saas-suspicious-external-domain-user-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sccm-log-files-enumeration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scheduled-task-hidden-by-registry-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scrcons-exe-rare-child-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/screensaver-process-executed-from-users-or-temporary-folder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/script-file-added-to-startup-related-registry-keys 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/scripting-engine-connected-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/secureboot-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/security-object-deletion-in-google-workspace-admin-console 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/security-tools-detection-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sending-unusual-file-s-to-an-external-address 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-account-password-reset-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-browser-credential-files-accessed-by-a-rare-non-browser-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sensitive-exchange-mail-sent-to-external-users 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/serial-console-access-was-enabled-in-aws-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/service-execution-via-sc-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/service-ticket-request-with-a-spoofed-samaccountname 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ses-production-access-requested 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/setting-windows-auto-logon-by-uncommon-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/setuid-and-setgid-file-bit-manipulation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sharepoint-site-collection-admin-group-addition 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/short-lived-azure-ad-user-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/short-lived-user-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-creates-a-scheduled-task-via-file-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-dll-injection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/signed-process-performed-an-unpopular-injection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/single-account-excessively-locked-out 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/smb-traffic-from-non-standard-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/soft-delete-of-cloud-storage-configuration-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/space-after-filename 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/spam-bot-traffic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/spns-cleared-from-a-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/ssh-authentication-brute-force-attempts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-attempt-by-a-honey-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-by-a-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-authentication-by-a-service-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-brute-force 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-password-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-abnormal-operating-system 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-abnormal-user-agent 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sso-with-new-operating-system 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/storage-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/stored-credentials-exported-using-credwiz-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/subdomain-fuzzing 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/successful-unusual-guest-user-invitation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sudden-spike-in-outbound-email-volume 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/sudoedit-brute-force-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suid-guid-permission-discovery 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-of-the-system-management-container 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-cloud-credential-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-kubernetes-api-with-kubelet-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-access-to-shadow-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-account-attribute-modification-that-matches-that-of-another-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-active-setup-registered 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-activity-indicating-a-potential-abuse-of-a-cloud-native-email-service 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-activity-on-logging-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-dataset-download 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-dataset-label-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ai-model-usage-from-a-tor-exit-node 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-amsi-decode-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-api-call-from-a-tor-exit-node 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-authentication-package-registered 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-authentication-with-azure-password-hash-sync-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-aws-ssm-parameters-retrieval-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-azure-ad-interactive-sign-in-using-powershell 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-azure-enumeration-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-brand-affiliation-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certificate-template-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certutil-ad-cs-contact 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-certutil-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-cloud-compute-instance-ssh-keys-modification-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-cloud-user-data-modification-attempt-followed-by-vm-restart 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-orchestration-job 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-reconnaissance-activity-in-a-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-container-runtime-connection-from-within-a-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-curl-user-agent 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-data-encryption 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall-using-powershell-commands 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-disablement-of-the-windows-firewall 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dkim-result 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dmarc-result 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dns-traffic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dnshostname-attribute-change-to-dc-name 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-docker-image-download-from-an-unusual-repository 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-domain-user-account-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dotnet-log-file-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-dump-of-ntds-dit-using-shadow-copy-with-ntdsutil-vssadmin 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ebs-snapshots-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-encrypting-file-system-remote-call-efsrpc-to-domain-controller 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-external-rdp-login 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-failed-http-request-potential-spring4shell-exploit 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-hidden-user-created 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-http-parameters-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-icmp-packet 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-icmp-traffic-that-resembles-smurf-attack 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-identity-downloaded-multiple-objects-from-a-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-kerberos-pre-auth-failures-by-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-kubernetes-pod-token-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ldap-queries-followed-by-shared-folder-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ldap-search-query-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-mfa-request-reported-by-user-in-entra-id 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ml-model-download 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-modification-of-the-adminsdholder-s-acl 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-module-load-using-direct-syscall 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-net-process-loads-an-msbuild-dll 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-network-connection-originating-from-aws-ssm-agent 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ntlm-authentication-with-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-objects-encryption-in-an-aws-bucket 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powershell-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powershell-enumeration-of-running-processes 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-net-function-was-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-powersploit-s-recon-module-powerview-used-to-search-for-exposed-hosts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-print-processor-registered 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-print-system-remote-protocol-usage-by-a-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-accessed-a-site-masquerading-as-google 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-accessed-certificate-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-executed-with-a-high-integrity-level 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-execution-from-tmp-folder 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-execution-in-a-privileged-container 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-loads-a-known-powershell-module 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-modified-rc-script-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-adobe-reader 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-process-spawned-by-wininit-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-proxy-environment-variable-setting 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-reconnaissance-using-ldap 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-runonce-exe-parent-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-runonce-parent-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-saas-api-call-from-a-tor-exit-node 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-samaccountname-change 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-searchprotocolhost-exe-parent-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-secrets-dump-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sender-exhibiting-automated-sending-patterns 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sending-domain-with-sender-address-randomization 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-setspn-exe-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-smb-connection-from-domain-controller 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-spf-result 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-ssh-downgrade 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sshpass-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sso-access-from-asn 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-sso-authentication 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-successful-rdp-connection-to-localhost 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-systemd-timer-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-theme-and-sentiment-in-email 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-time-provider-registered 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-udev-driver-rule-execution-manipulation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-unicode-character-detected-in-email 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-usage-of-ec2-token 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-usage-of-file-server-remote-vss-protocol-fsrvp 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/suspicious-usage-of-microsoft-s-active-directory-powershell-module-remote-discovery-cmdlet 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/svchost-exe-loads-a-rare-unsigned-module 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-information-discovery-via-psinfo-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-profiling-wmi-query-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/system-shutdown-or-reboot 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tampering-with-internet-explorer-protected-mode-configuration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tampering-with-the-windows-user-account-controls-uac-configuration 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-event-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/tgt-request-with-a-spoofed-samaccountname-network 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/the-ca-policy-editflags-was-queried 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/the-linux-system-firewall-was-disabled 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/training-simulation-email-detected 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-cloud-platforms-sensitive-files-by-a-scripting-engine 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-etc-passwd 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-cookies-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-access-to-microsoft-teams-credential-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-obfuscation-technique-was-executed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-containing-a-potential-persistence-command-was-executed-via-the-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-credential-files-was-executed-via-the-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-cryptocurrency-wallet-data-was-executed-via-the-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-access-sensitive-application-data-was-executed-via-the-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-designed-to-capture-screen-or-clipboard-data-was-executed-via-the-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-potentially-utilizes-credential-grabbing-techniques-to-steal-user-passwords 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-applescript-was-executed-via-the-command-line-to-contact-an-external-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-arp-cache-listing-via-arp-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-at-task-job-creation-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-at-discovering-a-sensitive-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-at-grabbing-credentials-from-a-sensitive-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-attempt-to-clear-shell-history 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-azure-cosmos-db-master-key-read-by-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-browser-extension-loaded 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-cloud-cli-tool-usage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-communication-to-an-instant-messaging-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-creation-or-access-operation-of-sensitive-shadow-copy 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-dll-sideloading-from-a-logical-cd-rom-iso-device 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-dotnet-module-load-relationship 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-driver-loaded 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-execution-of-odbcconf 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-file-access-over-webdav 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-getclipboarddata-api-function-invocation-of-a-possible-information-stealer 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-increase-in-azure-microsoft-graph-api-request-sizes 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ip-configuration-listing-via-ipconfig-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-jsp-file-write-by-a-java-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-kernel-module-load 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-launch-agent-persistency-was-registered-or-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-launch-daemon-persistency-was-registered-or-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-process-communication-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-remote-shell-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-linux-shell-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-login-item-persistency-was-registered-or-modified 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-macos-process-communication-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-macos-shell-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-managed-object-format-mof-compiler-usage 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-msiexec-execution-of-an-arbitrary-file-from-a-remote-location 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-net-group-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-net-localgroup-command-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-network-tunnel-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ntwritevirtualmemoryremote-api-invocation-with-a-pe-header-buffer 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-powershell-commands-used-to-create-or-alter-scheduled-task-parameters 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-rdp-connection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-recurring-rare-external-host-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-monitoring-and-management-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-scheduled-task-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-remote-service-start-via-sc-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-reverse-ssh-tunnel-to-external-domain-ip 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-routing-table-listing-via-route-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-security-support-provider-ssp-registered-via-a-registry-key 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sensitive-filesystem-registry-hive-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sensitive-registry-hive-dump 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-service-create-config 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-service-stop-operation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-setwindowshookex-api-invocation-of-a-possible-keylogger 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-signed-process-execution-by-scheduled-task 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-sql-like-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-ssh-session-was-established 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-url-domain-s-in-your-organization-detected-in-email 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-user-management-via-net-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-vnc-server-communication 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/uncommon-wpad-queries 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unicode-rtl-override-character 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unique-client-computer-model-was-detected-via-ms-update-protocol 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unknown-dll-was-added-to-the-ad-fs-global-assembly-cache-path 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unpopular-rsync-process-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unprivileged-process-opened-a-registry-hive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unrecognized-internal-address-aad-mismatch 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-a-dll-injection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-and-unpopular-process-performed-an-injection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-dll-hijack-into-a-microsoft-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-dll-side-loading 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-process-creates-a-scheduled-task-via-file-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unsigned-process-injecting-into-a-windows-system-binary-with-no-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/untrusted-process-contacted-llm-api 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-microsoft-365-storage-services 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-the-ad-sync-credential-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-access-to-the-windows-internal-database-on-an-adfs-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-adconnect-database-file-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-adfs-remote-synchronization-network-connections-from-non-adfs-server 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-dataset-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-knowledge-base-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-model-invocation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ai-rag-knowledge-base-modification 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-attachment-volume-in-outbound-emails 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-bedrock-model-access-request 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-cli-sdk-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-credentials-creation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-s3-objects-deletion 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-sagemaker-notebook-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-systems-manager-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-aws-user-added-to-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-azure-ad-sync-module-load 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-certificate-management-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-certlog-remote-file-write 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cim-repository-file-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cloud-instance-metadata-service-imds-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-compressed-file-password-protection 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-conditional-access-operation-for-an-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-cross-projects-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-db-process-spawning-a-shell 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-display-name-in-from-header 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controller 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-exec-into-a-kubernetes-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-file-sharing-links-for-mailbox-owner 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-hostname-for-the-sending-mail-server-in-the-email-headers 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-iam-enumeration-activity-by-a-non-user-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-internal-access-to-network-device-management-interface 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-key-management-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-dashboard-communication-from-a-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-secret-access 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-kubernetes-service-account-file-read 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-lolbins-process-spawned-by-installutil-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-multi-region-aws-resource-explorer-searches 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-netsh-portproxy-rule 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-access-to-ld-so-preload-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-the-powershell-history-file 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-executed-by-aws-systems-manager 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-process-spawned-by-nginx-in-ingress-nginx-pod 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-resource-access-by-azure-application 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-secret-management-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-sender-ip-subnet 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ssh-activity-that-resembles-ssh-proxy 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-ssh-activity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-url-s-sent-by-a-brand-were-observed-in-the-email 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-use-of-a-sysinternals-tool 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-account-enablement 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-account-unlock 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-user-agent-for-a-cloud-identity 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unusual-weak-authentication-by-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/unverified-domain-added-to-azure-ad 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/upload-pattern-that-resembles-peer-to-peer-traffic 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-attachment-s-name 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email-s-from-header 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/usage-of-homograph-characters-detected-in-an-email 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-accessed-multiple-o365-aip-sensitive-files 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-accessed-saas-resource-via-anonymous-link 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-account-delegation-change 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-a-new-device-to-okta-verify-instance 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-sid-history-to-an-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-to-a-group-and-removed 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-added-to-the-sms-admins-local-group 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-and-group-enumeration-via-samr 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-collected-remote-shared-files-in-an-archive 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-discovery-via-wmi-query-execution 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-exported-multiple-messages-in-microsoft-teams-via-graph-api 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-installed-an-application-in-microsoft-teams-via-graph-api 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-moved-exchange-sent-messages-to-deleted-items 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-sent-messages-in-microsoft-teams-to-multiple-conversations-via-graph-api 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-set-insecure-ca-registry-setting-for-global-sans 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/user-signed-in-to-an-application-via-power-automate-for-the-first-time 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vm-detection-attempt-on-linux 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vm-detection-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-access-with-an-abnormal-operating-system 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-attempt-by-a-honey-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-brute-force-attempt 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-by-a-dormant-user 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-by-a-service-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-password-spray 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vpn-login-with-a-machine-account 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/vulnerable-certificate-template-loaded 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wbadmin-deleted-files-in-quiet-mode 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-tgt-response 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/weakly-encrypted-kerberos-ticket-requested 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/web-server-cgo-executed-a-process-following-a-potential-webshell-dropped 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/web-server-cgo-executed-an-uncommon-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/webdav-drive-mounted-from-net-exe-over-https 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/well-known-brand-in-sender-headers-with-header-inconsistencies 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-cgo-actor-and-action-processes-with-anomalous-characteristics 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-cgo-actor-process-and-action-module-with-anomalous-characteristics 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-event-log-was-cleared-using-wevtutil-exe 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-event-logs-were-cleared-with-powershell 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-installer-exploitation-for-local-privilege-escalation 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/windows-lolbin-executable-connected-to-a-rare-external-host 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wmiprvse-exe-rare-child-command-line 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wscript-cscript-loads-net-dlls 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/wsmprovhost-exe-rare-child-process 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-name/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threat 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source 1 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/aws-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azure-signin-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azuread-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/azuread 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/box-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/dropbox 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/duo 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/gcp-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/google-workspace-audit-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/google-workspace-authentication 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/health-monitoring-data 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/idira 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/kubernetes-audit-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-365-emails 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/microsoft-graph-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/office-365-audit 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/okta-audit-log 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/okta 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/onelogin 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-eal-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-threat-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-firewall-traffic-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-global-protect 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-platform-alerts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/palo-alto-networks-url-logs 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/pingone 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-alerts 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-firewalls 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/third-party-vpns 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/windows-event-collector 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent-with-extended-threat-hunting-xth 0.84 https://cortex-docs.paloaltonetworks.com/analytics-alerts/alerts-by-data-source/xdr-agent 0.84