admin/elastic-detection-rules
1
0
Fork 0
mirror of https://github.com/elastic/detection-rules synced 2026-06-08 14:00:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

[Rule Tuning] AWS EC2 EBS Snapshot Access Removed (#5499)

Browse Source 
- fixed mistake in creation date
- excludes `backup.amazon.com` FP from telemetry

(cherry picked from commit 12d257ed56)
This commit is contained in:
Isai
2025-12-19 13:28:27 -05:00
committed by tradebot-elastic
parent a37a2d255c
commit b8eca56cc6
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
+3 -2
View File
@@ -1,8 +1,8 @@
[metadata]
creation_date = "2024/06/02"
creation_date = "2025/06/02"
integration = ["aws"]
maturity = "production"
updated_date = "2025/10/24"
updated_date = "2025/12/18"
[rule]
author = ["Elastic"]
@@ -107,6 +107,7 @@ info where event.dataset == "aws.cloudtrail"
and event.outcome == "success"
and stringContains (aws.cloudtrail.request_parameters, "attributeType=CREATE_VOLUME_PERMISSION")
and stringContains (aws.cloudtrail.request_parameters, "remove=")
and not source.address == "backup.amazonaws.com"
'''
[[rule.threat]]