From b8eca56cc6afe640b2ce38121ed270602a7740bc Mon Sep 17 00:00:00 2001
From: Isai <59296946+imays11@users.noreply.github.com>
Date: Fri, 19 Dec 2025 13:28:27 -0500
Subject: [PATCH] [Rule Tuning] AWS EC2 EBS Snapshot Access Removed (#5499)

- fixed mistake in creation date
- excludes `backup.amazon.com` FP from telemetry

(cherry picked from commit 12d257ed56a49fc4111e3e23c2202db8e7c5beb1)
---
 .../aws/impact_ec2_ebs_snapshot_access_removed.toml          | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml b/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
index 42c3aa225..8d45fd949 100644
--- a/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
+++ b/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml
@@ -1,8 +1,8 @@
 [metadata]
-creation_date = "2024/06/02"
+creation_date = "2025/06/02"
 integration = ["aws"]
 maturity = "production"
-updated_date = "2025/10/24"
+updated_date = "2025/12/18"
 
 [rule]
 author = ["Elastic"]
@@ -107,6 +107,7 @@ info where event.dataset == "aws.cloudtrail"
   and event.outcome == "success"
   and stringContains (aws.cloudtrail.request_parameters, "attributeType=CREATE_VOLUME_PERMISSION")
   and stringContains (aws.cloudtrail.request_parameters, "remove=")
+  and not source.address == "backup.amazonaws.com"
 '''
 
 [[rule.threat]]