mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
9 lines
834 B
YAML
9 lines
834 B
YAML
name: ec2_modification_api_calls
|
|
id: 215e2d29-1045-4f35-96ce-cb084c11b2cf
|
|
version: 1
|
|
creation_date: '2019-10-16'
|
|
modification_date: '2026-05-13'
|
|
author: Splunk Threat Research Team
|
|
description: This is a list of AWS event names that have to do with modifying Amazon EC2 instances
|
|
definition: (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)
|