Suspicious activity

List objects API call was made from malicious IP address

Risk Level

Hazardous (3)



Orca detected that an API call to list objects was made from a malicious IP address - {MaliciousIp.MaliciousIp}. This action may indicate of a presence of an unauthorized actor in the cloud environment, which might indicate of an asset reconnaissance attempt.
  • Recommended Mitigation

    It is recommended to review the permissions which were used to make this api call. In addition, review the actions of the affected user and remove the policy in if it is possible.