> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-02-26.md).

# 2025.02.26

**Release date: 17-March-2025**

| Change type                                          | Changes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Added 6 new Medium Analytics Alerts                  | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Multiple risk indicators detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potential brand impersonation in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potential evasion techniques detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potentially dangerous URL(s) in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potentially dangerous sender</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potentially malicious attachment(s) spotted in an email</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Added 11 new Low Analytics BIOCs                     | <ul><li><a href="/analytics-alerts/alerts-by-name/aws-data-asset-shared-public.md">AWS data asset shared public</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - An email was sent from a malicious domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing a link with an IP address convention was detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email contains URL(s) classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email mimics replies or forwards without an actual ongoing conversation</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email received from an unknown sender using a disposable email address</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was sent from a domain classified as inappropriate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - External email display name impersonation of internal personnel</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular domains detected in email URLs for a recipient</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unusual hostname for the sending mail server in the email headers</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Usage of homograph characters detected in an email's from header</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Added a new Low Analytics Alert                      | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Potential employee impersonation in email with financial or urgent context</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Added 30 new Informational Analytics BIOCs           | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Azure audit - MFA fraud reported</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - An email was received from a domain classified as risky</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email Punycode characters in URL</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment with a potentially malicious file extension</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment with multiple extensions</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email attachment(s) with potentially malicious MIME type</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing a redirected link</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing financial content was received from an external domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email containing urgency terms was received from an external domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email contains URL(s) classified as malicious</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email contains potentially malicious attachments that are not blocked by default</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email has a short body or subject and was sent from an external source</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email marked as spam and bulk based on Spam Confidence Level and Bulk Complaint Level values</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email message contains text hiding attributes</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email received from an unknown sender using a public provider email address</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email suspicious Moniker link detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was received from a newly registered domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email was received from an unknown sender address</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email with URL shortener detected</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Rarely seen URL(s) within a well-known domain detected in your organization's email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Suspicious Unicode character detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - URL(s) classified as risky have been detected within Email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular URL domain(s) in your organization detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular URL(s) detected in email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Unpopular domain(s) detected in an email's URL(s)</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Usage of homograph characters detected in an email</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Well-known brand impersonation within an email's from address domain</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - X-Forefront-Antispam-Report has flagged this email as a potential threat</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-driver-loaded.md">Uncommon driver loaded</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-user-account-enablement.md">Unusual user account enablement</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| Added 4 new Informational Analytics Alerts           | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Elevated alert triggered by combined alerts and severity</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Email identified as potential fraud attempt</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">EMAIL BETA - Suspicious theme and sentiment in email</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-environment-enumeration-activity.md">Kubernetes environment enumeration activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Improved logic of a High Analytics BIOC              | <ul><li><a href="/analytics-alerts/alerts-by-name/collection-error.md">Collection error</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Improved logic of a Medium Analytics BIOC            | <ul><li><a href="/analytics-alerts/alerts-by-name/cloud-snapshot-of-a-database-or-storage-instance-was-publicly-shared.md">Cloud snapshot of a database or storage instance was publicly shared</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| Improved logic of 11 Low Analytics BIOCs             | <ul><li><a href="/analytics-alerts/alerts-by-name/aws-flow-logs-deletion.md">AWS Flow Logs deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-event-hub-deletion.md">Azure Event Hub Deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/cloudtrail-logging-deletion.md">Cloud Trail logging deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-dcsync-from-a-non-domain-controller.md">Possible DCSync from a non domain controller</a></li><li><a href="/analytics-alerts/alerts-by-name/uncommon-local-scheduled-task-creation-via-schtasks-exe.md">Uncommon local scheduled task creation via schtasks.exe</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controller.md">Unusual Encrypting File System Remote call (EFSRPC) to domain controller</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cross-projects-activity.md">Unusual cross projects activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-ftp-client-credentials.md">Unusual process accessed FTP Client credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-crypto-wallet-s-files.md">Unusual process accessed a crypto wallet's files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-messaging-app-s-files.md">Unusual process accessed a messaging app's files</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-web-browser-history-file.md">Unusual process accessed a web browser history file</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Improved logic of 2 Low Analytics Alerts             | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">An identity dumped multiple secrets from a project</a></li><li><a href="/analytics-alerts/alerts-by-name/logs-were-not-collected-from-a-data-source-for-an-abnormally-long-time.md">Logs were not collected from a data source for an abnormally long time</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Improved logic of 54 Informational Analytics BIOCs   | <ul><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-configmap-was-created-or-deleted.md">A Kubernetes ConfigMap was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-cronjob-was-created.md">A Kubernetes Cronjob was created</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-cluster-role-binding-was-created-or-deleted.md">A Kubernetes cluster role binding was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-cluster-was-created-or-deleted.md">A Kubernetes cluster was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-ephemeral-container-was-created.md">A Kubernetes ephemeral container was created</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-namespace-was-created-or-deleted.md">A Kubernetes namespace was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-role-binding-was-created-or-deleted.md">A Kubernetes role binding was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-secret-was-created-or-deleted.md">A Kubernetes secret was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-service-account-executed-an-unusual-api-call.md">A Kubernetes service account executed an unusual API call</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-service-account-was-created-or-deleted.md">A Kubernetes service account was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-kubernetes-service-was-created-or-deleted.md">A Kubernetes service was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-created-or-modified-a-security-group.md">A cloud identity created or modified a security group</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-executed-an-api-call-from-an-unusual-country.md">A cloud identity executed an API call from an unusual country</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-had-escalated-its-permissions.md">A cloud identity had escalated its permissions</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-identity-invoked-iam-related-persistence-operations.md">A cloud identity invoked IAM related persistence operations</a></li><li><a href="/analytics-alerts/alerts-by-name/a-cloud-instance-was-stopped.md">A cloud instance was stopped</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">A cloud snapshot was created or modified</a></li><li><a href="/analytics-alerts/alerts-by-name/a-container-registry-was-created-or-deleted.md">A container registry was created or deleted</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-created-an-abnormal-password-protected-archive.md">A user created an abnormal password-protected archive</a></li><li><a href="/analytics-alerts/alerts-by-name/a-user-modified-an-okta-network-zone.md">A user modified an Okta network zone</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Activity in a dormant region of a cloud project</a></li><li><a href="/analytics-alerts/alerts-by-name/an-azure-application-reached-a-throttling-api-rate.md">An Azure application reached a throttling API rate</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">An identity attached an administrative policy to an IAM user/role</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-temporary-access-pass-tap-registered-to-an-account.md">Azure Temporary Access Pass (TAP) registered to an account</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-application-credentials-added.md">Azure application credentials added</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-storage-account-blob-anonymous-access-is-enabled.md">Azure storage account blob anonymous access is enabled</a></li><li><a href="/analytics-alerts/alerts-by-name/azure-storage-account-was-publicly-shared.md">Azure storage account was publicly shared</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-compute-instance-user-data-script-modification.md">Cloud compute instance user data script modification</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-compute-serial-console-access.md">Cloud compute serial console access</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-identity-reached-a-throttling-api-rate.md">Cloud identity reached a throttling API rate</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-impersonation-attempt-by-unusual-identity-type.md">Cloud impersonation attempt by unusual identity type</a></li><li><a href="/analytics-alerts/alerts-by-name/data-encryption-was-disabled.md">Data encryption was disabled</a></li><li><a href="/analytics-alerts/alerts-by-name/exchange-email-hiding-inbox-rule.md">Exchange email-hiding inbox rule</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-module-was-loaded.md">Globally uncommon high entropy module was loaded</a></li><li><a href="/analytics-alerts/alerts-by-name/globally-uncommon-high-entropy-process-was-executed.md">Globally uncommon high entropy process was executed</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-admission-controller-activity.md">Kubernetes admission controller activity</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-cluster-events-deletion.md">Kubernetes cluster events deletion</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-network-policy-modification.md">Kubernetes network policy modification</a></li><li><a href="/analytics-alerts/alerts-by-name/network-sniffing-detected-in-cloud-environment.md">Network sniffing detected in Cloud environment</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-ldap-enumeration-tool-usage.md">Possible LDAP Enumeration Tool Usage</a></li><li><a href="/analytics-alerts/alerts-by-name/potential-okta-access-limit-breach.md">Potential Okta access limit breach</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-remote-service-svcctl-rpc-activity.md">Rare Remote Service (SVCCTL) RPC activity</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-scheduled-task-rpc-activity.md">Rare Scheduled Task RPC activity</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-process-accessed-a-keychain-file.md">Rare process accessed a Keychain file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-aws-systems-manager-activity.md">Unusual AWS systems manager activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-identity-and-access-management-iam-activity.md">Unusual Identity and Access Management (IAM) activity</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-cloud-identity-impersonation.md">Unusual cloud identity impersonation</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-a-macos-notes-db-file.md">Unusual process accessed a macOS notes DB file</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-cookies.md">Unusual process accessed web browser cookies</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-process-accessed-web-browser-credentials.md">Unusual process accessed web browser credentials</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-resource-modification-by-newly-seen-iam-user.md">Unusual resource modification by newly seen IAM user</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Unusual resource modification/creation</a></li><li><a href="/analytics-alerts/alerts-by-name/unusual-user-account-unlock.md">Unusual user account unlock</a></li><li><a href="/analytics-alerts/alerts-by-name/user-attempted-to-connect-from-a-suspicious-country.md">User attempted to connect from a suspicious country</a></li></ul> |
| Improved logic of 15 Informational Analytics Alerts  | <ul><li><a href="/analytics-alerts/alerts-by-name/a-user-executed-multiple-ldap-enumeration-queries.md">A user executed multiple LDAP enumeration queries</a></li><li><a href="/analytics-alerts/alerts-by-name/an-identity-performed-a-suspicious-download-of-multiple-cloud-storage-objects.md">An identity performed a suspicious download of multiple cloud storage objects</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Azure uncommon increase in API request sizes</a></li><li><a href="/analytics-alerts/alerts-by-name/cloud-infrastructure-enumeration-activity.md">Cloud infrastructure enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/deletion-of-multiple-cloud-resources.md">Deletion of multiple cloud resources</a></li><li><a href="/analytics-alerts/alerts-by-name/external-saas-file-sharing-activity.md">External SaaS file-sharing activity</a></li><li><a href="/analytics-alerts/alerts-by-name/iam-enumeration-sequence.md">IAM Enumeration sequence</a></li><li><a href="/analytics-alerts/alerts-by-name/internal-login-password-spray.md">Internal Login Password Spray</a></li><li><a href="/analytics-alerts/alerts-by-name/kubernetes-enumeration-activity.md">Kubernetes enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/massive-file-downloads-from-saas-service.md">Massive file downloads from SaaS service</a></li><li><a href="/analytics-alerts/alerts-by-name/massive-upload-to-saas-service.md">Massive upload to SaaS service</a></li><li><a href="/analytics-alerts/alerts-by-name/multi-region-enumeration-activity.md">Multi region enumeration activity</a></li><li><a href="/analytics-alerts/alerts-by-name/multiple-failed-logins-from-a-single-ip.md">Multiple failed logins from a single IP</a></li><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">SSH brute force attempt</a></li><li><a href="/analytics-alerts/alerts-by-name/storage-enumeration-activity.md">Storage enumeration activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| Increased the severity to Low for 2 Analytics BIOCs  | <ul><li><a href="/analytics-alerts/alerts-by-name/executable-or-script-file-written-by-a-web-server-process.md">Executable or Script file written by a web server process</a></li><li><a href="/analytics-alerts/alerts-by-name/possible-webshell-file-written-by-a-web-server-process.md">Possible webshell file written by a web server process</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| Decreased the severity to Low for an Analytics BIOC  | <ul><li><a href="https://cortex-docs.paloaltonetworks.com/analytics-alerts/">Possible Microsoft process masquerading</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| Changed metadata of a Medium Analytics BIOC          | <ul><li><a href="/analytics-alerts/alerts-by-name/suspicious-heavy-allocation-of-compute-resources-possible-mining-activity.md">Suspicious heavy allocation of compute resources - possible mining activity</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| Changed metadata of a Low Analytics BIOC             | <ul><li><a href="/analytics-alerts/alerts-by-name/copy-a-user-s-gnupg-directory-with-rsync.md">Copy a user's GnuPG directory with rsync</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| Changed metadata of a Low Analytics Alert            | <ul><li><a href="/analytics-alerts/alerts-by-name/excessive-user-account-lockouts.md">Excessive user account lockouts</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of an Informational Analytics BIOC  | <ul><li><a href="/analytics-alerts/alerts-by-name/azure-diagnostic-configuration-deletion.md">Azure diagnostic configuration deletion</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
| Changed metadata of 3 Informational Analytics Alerts | <ul><li><a href="/analytics-alerts/alerts-by-name/abnormal-allocation-of-compute-resources-in-multiple-regions.md">Abnormal Allocation of compute resources in multiple regions</a></li><li><a href="/analytics-alerts/alerts-by-name/allocation-of-multiple-cloud-compute-resources.md">Allocation of multiple cloud compute resources</a></li><li><a href="/analytics-alerts/alerts-by-name/rare-access-to-known-advertising-domains.md">Rare access to known advertising domains</a></li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-analytics-content-releases/cortex-analytics-content-release-notes/2025-02-26.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.