Cisco Secure Email Threat Defense unusual spike found for the high severity verdict techniques

Documentos > Datadog Security > OOTB Rules > Cisco Secure Email Threat Defense unusual spike found for the high severity verdict techniques

This rule is part of a beta feature. To learn more, contact Support.

Classification:

attack

Tactic:

TA0001-initial-access

Technique:

T1566-phishing

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Goal

Detects emails when there are unusual spikes in high-severity verdict techniques that helps to analyze the techniques that cause the threats in email.

Strategy

This rule monitors emails to detect unusual spikes in high-severity verdict techniques.

Triage and response

Investigate high-severity technique - {{@verdict.techniques.type}} using which threat emails has been detected.
Assess the potential impact of these threat emails on systems, data, operations, and overall security posture.
Take prevention steps to reduce threats emails sent with similar techniques.