Detections Migration Guide
As alerts migrate from Secure Cloud Analytics to Cisco XDR, some are renamed or split into separate detections. This guide summarizes these changes and explains where to configure these detections in Cisco XDR.
Renamed Cloud Detections
The following cloud alerts have been renamed in Cisco XDR:
|
Cloud Alert Name in Secure Cloud Analytics |
New Cloud Detection Name in Cisco XDR |
|---|---|
|
AWS Detector Modified |
AWS GuardDuty Detector Deleted or Disabled |
|
AWS EC2 Multiple SSH Keys Upload Anomaly |
AWS EC2 Multiple SSH Public Keys Uploaded |
|
AWS Anomalous Secrets Manager Batch Retrieval |
AWS Secrets Manager Batch Secret Retrieval |
|
AWS High Volume of GetPasswordData Failures |
AWS EC2 High Volume of GetPasswordData Failures |
|
AWS EC2 Startup Script Modified |
AWS EC2 Startup Script Modified on Stopped Instance |
|
AWS Lambda Layer from External Account Added |
AWS Lambda Layer Added from External Account |
|
AWS RDS Snapshot Sharing for Data Exfiltration |
AWS RDS Snapshot Shared with External Account |
|
AWS Snapshot Exfiltration |
AWS EC2 Snapshot Shared with External Account |
|
AWS IAM Role Creation Backdoor |
AWS IAM Role Created with External Account Trust |
|
AWS Amazon Machine Image Shared |
AWS EC2 Amazon Machine Image Shared |
|
AWS Session Manager Multiple Instances Utilized |
AWS Systems Manager Multiple Sessions Started |
|
AWS API Gateway Potential Persistence |
AWS API Gateway API Key Created |
|
AWS AppStream Image Shared |
AWS AppStream Image Shared |
|
AWS Repeated API Failures |
Cloud Account Repeated API Failures |
|
AWS GuardDuty Trusted IP List Created |
AWS GuardDuty Trusted IP List Created |
|
AWS IAM Anywhere Trust Anchor Created |
AWS IAM Anywhere Trust Anchor Created |
|
AWS Anomalous RDS Password Reset |
AWS RDS Master Password Modified |
|
AWS Anomalous IAM Role Policy Update |
AWS IAM Role Trust Policy Updated |
|
AWS Organization Exit Attempt |
AWS Organization Exit Attempted |
|
AWS S3 Bucket Lifecycle Configured |
AWS S3 Bucket Lifecycle Configured |
|
AWS S3 Bucket Policy Backdoor |
AWS S3 Bucket Policy Configured with External Principal |
|
AWS Lambda Invoke Permission Added AWS Lambda Backdoor Through Resource-Based Policy |
AWS Lambda Invoke Permission Granted to All or External Accounts |
|
AWS CloudTrail Logging Impaired AWS Logging Deleted |
AWS Route53 Resolver Query Log Config Deleted AWS Logging Impairment AWS VPC Flow Log Deleted |
|
AWS Glue Development Resource Created or Modified |
AWS Potential Privilege Escalation AWS Lambda Function Created or Modified |
|
Anomalous Azure Custom Script Extensions |
Azure Virtual Machine Custom Script Extension Deployed |
|
Azure Anomalous RunCommand |
Azure Virtual Machine Run Command Executed |
|
Azure Transfer Data to Cloud Account |
Azure Compute Snapshot Access Granted |
|
GCP Compute Engine Password Reset |
GCP Compute Engine Password Reset |
|
GCP Anomalous IAM Modification |
GCP IAM Policy Modified |
|
GCP Compute Engine Exfiltration |
GCP Compute Engine Resource IAM Policy Changed |
Configure Detections
To configure detections in Cisco XDR, choose Administration > Native Detections in the navigation menu to view the detection settings from Cisco XDR native sources. Click the Activity source drop-down list and check the check boxes to filter the detections displayed in the table. You can then enable or disable the detection from being included in incident correlation or from being automatically promoted as an incident. For more information, go to the Native Detections topic.
Note: Existing settings configured for alerts on the Alert Priorities page in Secure Cloud Analytics have been migrated to the Native Detections page.