Overview
Attackers who gain access to a SaaS application rarely need malware. They sign in with stolen credentials or sessions, set up ways to keep their access, and quietly move data out. Each of these steps leaves a record in the application's audit log.
SaaS alerts are detections that Cato runs on the audit logs collected by App Activities connectors. They identify activity associated with techniques used in real attacks, so you can respond while an attack is in progress. Each alert includes the application, the user or account involved, the activity that triggered it, and its severity.
You can also bring in security alerts that other vendors generate, with SaaS alert connectors. For more information, see Understanding Vendor Alerts below.
SaaS alerts require an App Activities connector for each application. For more information, see App Activities Connectors.
A CASB license is required for SaaS alerts. For more about purchasing a CASB license, please contact your Cato representative.
Understanding SaaS Alerts
SaaS alerts cover these types of activity. The examples are alerts for Microsoft 365.
Type | What it detects | Examples |
|---|---|---|
Persistence | Ways for an attacker to keep access, even after the user's password is reset | Entra ID Service Principal Credentials Added, Entra ID Domain Federation Configured |
Consent phishing | OAuth apps that are granted broad access to organization data | Entra ID High-Privilege Admin Consent Granted |
Privilege escalation | Accounts that gain administrator rights to sites and their content | SharePoint Site Collection Admin Added |
Data exfiltration | Email or data that is sent outside the organization | Outlook External Inbox Forward Rule Created, Outlook Transport Rule Created with External Recipient |
Defense evasion | Activity that hides an attack from the user or the security team | Outlook Email Hiding Inbox Rule Created |
Malware | Malicious files stored in the application | SharePoint Malware File Detected |
Configuration changes that weaken a secure setting, such as disabling MFA or assigning an administrator role, are shown as posture drift. For more information, see Detecting and Remediating Posture Drift.
Viewing SaaS Alerts
You can view SaaS alerts from these places in the CMA:
Cloud Apps Dashboard: The High Severity SaaS Alerts tile in the highlights bar, and the Alerts to Review widget in the SaaS Events section. Click the tile to open the Events page filtered to high-severity SaaS alerts. For more information, see Using the Cloud Apps Dashboard.
The Events Page: Alerts generate an event visible on the Events page.
Investigating a SaaS Alert
Review the activity associated with a SaaS alert to determine whether it is authorized and identify related signs of compromise.
To investigate a SaaS alert:
Navigate to Security > Cloud Apps and open the alert from the High Severity SaaS Alerts widget or filter the Events page for SaaS alerts.
Review the app, the user who performed the activity, the target account or object, and the activity time.
Confirm whether the activity is expected. For example, ask the application owner whether the change is part of an approved change window.
Review other activity performed by the account. On the Events page, filter App Activities for the same user and application during the hours before and after the alert. Look for related sign-ins, changes to administrative settings, and downloads.
Check for related SaaS alerts involving the same account or application. Multiple alerts in a short period are a strong indication of compromise. For example, look for an external forwarding rule followed by new application credentials.
Check whether the account also weakened a security setting, resulting in posture drift. For more information, see Detecting and Remediating Posture Drift. For more information, see Detecting and Remediating Posture Drift.
If the activity is unauthorized, perform the applicable response actions in the SaaS application:
Disable the account
Revoke its sessions and tokens
Remove inbox rules, application credentials, and permissions added by the attacker
Revert the changed settings
Investigate how the attacker gained access.
Understanding Vendor Alerts
In addition to Cato's SaaS alerts, you can bring security alerts from other vendors into Cato:
SaaS alert connectors import security alerts from supported vendors, such as Synk. For more information, see Synk: Configuring the SaaS Anomalies Connector
Sign-in anomalies from Microsoft Entra ID Protection, such as impossible travel or password spray, appear in the SSO Sign Ins section of the Activities tab. For more information, see Configuring the Microsoft Entra ID Protection Connector for Sign-In Anomaly Data
Vendor alerts use the vendor's own detection logic and severity. Cato's SaaS alerts use detection logic defined by Cato's research team.