detection.wiki

AWS Health

eventNameDescriptionSampleRule
anyCatch-all entry for AWS Health rules that match the service but not a specific eventName.NN
DescribeEventAggregatesReturns aggregated counts of AWS Health events matching the supplied filter.YY
DescribeAffectedAccountsForOrganizationReturns a list of accounts in the organization from Organizations that are affected by the provided event.NN
DescribeAffectedEntitiesReturns a list of entities that have been affected by the specified events, based on the specified filter criteria.YN
DescribeAffectedEntitiesForOrganizationReturns a list of entities that have been affected by one or more events for one or more accounts in your organization in Organizations, based on the filter criteria.NN
DescribeEntityAggregatesReturns the number of entities that are affected by each of the specified events.YN
DescribeEntityAggregatesForOrganizationReturns a list of entity aggregates for your Organizations that are affected by each of the specified events.NN
DescribeEventDetailsReturns detailed information about one or more specified events.YN
DescribeEventDetailsForOrganizationReturns detailed information about one or more specified events for one or more Amazon Web Services accounts in your organization.NN
DescribeEventsReturns information about events that meet the specified filter criteria.YN
DescribeEventsForOrganizationReturns information about events across your organization in Organizations.YN
DescribeEventTypesReturns the event types that meet the specified filter criteria.YN
DescribeHealthServiceStatusForOrganizationThis operation provides status information on enabling or disabling Health to work with your organization.YN
DisableHealthServiceAccessForOrganizationDisables Health from working with Organizations.NN
EnableHealthServiceAccessForOrganizationEnables Health to work with Organizations.NN

any: AWS Health (catch-all)

#
Service
health

Description

Catch-all entry for AWS Health rules that match the service but not a specific eventName.

DescribeEventAggregates

#
Service
health

Description

Returns aggregated counts of AWS Health events matching the supplied filter.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "21c87313-5709-46b6-9a83-c7096a761200",
  "eventName": "DescribeEventAggregates",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2023-07-10T11:42:38Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "7c17e742-76e2-4be7-8708-96a194a85e04",
  "requestParameters": {
    "aggregateField": "eventTypeCategory",
    "filter": {
      "eventStatusCodes": [
        "open",
        "upcoming"
      ],
      "startTimes": [
        {
          "from": "Jul 3, 2023, 11:42:38 AM"
        }
      ]
    }
  },
  "responseElements": null,
  "sessionCredentialFromConsole": "true",
  "sourceIPAddress": "health.amazonaws.com",
  "userAgent": "AWS Internal",
  "userIdentity": {
    "accessKeyId": "ASIATFQR7NSC47I74ISO",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/benjamin",
    "invokedBy": "health.amazonaws.com",
    "principalId": "AIDATFQR7NSC5U6Q3TMDR",
    "sessionContext": {
      "attributes": {
        "creationDate": "2023-07-10T11:42:31Z",
        "mfaAuthenticated": "true"
      },
      "sessionIssuer": {},
      "webIdFederationData": {}
    },
    "type": "IAMUser",
    "userName": "benjamin"
  }
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
distinct_ip_count (splunk rule field)gt12 rulessplunk

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Splunk #

  • ASL AWS Concurrent Sessions From Different Ips source: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute span. This detection leverages AWS CloudTrail logs, specifically the DescribeEventAggregates…T1185
  • AWS Concurrent Sessions From Different Ips source: The following analytic identifies an AWS IAM account with concurrent sessions originating from more than one unique IP address within a 5-minute window. It leverages AWS CloudTrail logs, specifically the DescribeEventAggregates event, to…T1185

References #

DescribeAffectedAccountsForOrganization

#
Service
health

Description

Returns a list of accounts in the organization from Organizations that are affected by the provided event.

DescribeAffectedEntities

#
Service
health

Description

Returns a list of entities that have been affected by the specified events, based on the specified filter criteria.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "3bd20cfd-02b6-4f27-9653-1f0b7a3f11a7",
  "eventName": "DescribeAffectedEntities",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2017-09-17T15:14:19Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "e68047-9bba-11e7-b8f9-750d309bc880",
  "requestParameters": {
    "filter": {
      "eventArns": [
        "arn:aws:health:us-east-1::event/ae103afc-4774-4373-ba9e-a2cdfe7463a6"
      ]
    },
    "maxResults": 25
  },
  "responseElements": null,
  "sourceIPAddress": "224.223.84.255",
  "userAgent": "signin.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAPJO9RF3QPMJRVLR6",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/piper",
    "invokedBy": "signin.amazonaws.com",
    "principalId": "AIDA7ZI0RCYCPBIR0OIC3",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-09-17T14:51:38Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "piper"
  }
}

References #

DescribeAffectedEntitiesForOrganization

#
Service
health

Description

Returns a list of entities that have been affected by one or more events for one or more accounts in your organization in Organizations, based on the filter criteria.

DescribeEntityAggregates

#
Service
health

Description

Returns the number of entities that are affected by each of the specified events.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "abeee80e-a76a-4a48-9dc4-063585c4f53c",
  "eventName": "DescribeEntityAggregates",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2017-09-17T15:13:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "ccc4a166-9bba-11e7-adc6-63c42f7bf2f5",
  "requestParameters": {
    "eventArns": [
      "arn:aws:health:us-east-1::event/ae103afc-4774-4373-ba9e-a2cdfe7463a6"
    ]
  },
  "responseElements": null,
  "sourceIPAddress": "224.223.84.255",
  "userAgent": "signin.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAPJO9RF3QPMJRVLR6",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/piper",
    "invokedBy": "signin.amazonaws.com",
    "principalId": "AIDA7ZI0RCYCPBIR0OIC3",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-09-17T14:51:38Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "piper"
  }
}

References #

DescribeEntityAggregatesForOrganization

#
Service
health

Description

Returns a list of entity aggregates for your Organizations that are affected by each of the specified events.

DescribeEventDetails

#
Service
health

Description

Returns detailed information about one or more specified events.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "f683409e7-e5ec-4544-9091-78e02c297f38",
  "eventName": "DescribeEventDetails",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2017-09-17T15:13:48Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "ce13372e-9bba-11e7-926a-3b080ddf5779",
  "requestParameters": {
    "eventArns": [
      "arn:aws:health:us-east-1::event/ae103afc-4774-4373-ba9e-a2cdfe7463a6"
    ],
    "locale": "en"
  },
  "responseElements": null,
  "sourceIPAddress": "224.223.84.255",
  "userAgent": "signin.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAPJO9RF3QPMJRVLR6",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/piper",
    "invokedBy": "signin.amazonaws.com",
    "principalId": "AIDA7ZI0RCYCPBIR0OIC3",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-09-17T14:51:38Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "piper"
  }
}

References #

DescribeEventDetailsForOrganization

#
Service
health

Description

Returns detailed information about one or more specified events for one or more Amazon Web Services accounts in your organization.

DescribeEvents

#
Service
health

Description

Returns information about events that meet the specified filter criteria.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventID": "67a4dda6-7943-4f31-a389-0a6a3fb9e425",
  "eventName": "DescribeEvents",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2017-09-17T15:13:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "cc8092e1-9bba-11e7-a67f-4d1cfba8b3d6",
  "requestParameters": {
    "filter": {
      "eventStatusCodes": [
        "open"
      ],
      "eventTypeCategories": [
        "issue"
      ],
      "startTimes": [
        {
          "from": "Sep 10, 2017 3:13:44 PM"
        }
      ]
    },
    "maxResults": 25
  },
  "responseElements": null,
  "sourceIPAddress": "224.223.84.255",
  "userAgent": "signin.amazonaws.com",
  "userIdentity": {
    "accessKeyId": "ASIAPJO9RF3QPMJRVLR6",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/piper",
    "invokedBy": "signin.amazonaws.com",
    "principalId": "AIDA7ZI0RCYCPBIR0OIC3",
    "sessionContext": {
      "attributes": {
        "creationDate": "2017-09-17T14:51:38Z",
        "mfaAuthenticated": "true"
      }
    },
    "type": "IAMUser",
    "userName": "piper"
  }
}

References #

DescribeEventsForOrganization

#
Service
health

Description

Returns information about events across your organization in Organizations.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: health:DescribeEventsForOrganization on resource: *",
  "eventID": "7ce22058-1f58-472a-8be7-29fd2f728661",
  "eventName": "DescribeEventsForOrganization",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2020-06-10T05:30:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "dd78682d-87e1-4428-8603-9bfe6aef0283",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

DescribeEventTypes

#
Service
health

Description

Returns the event types that meet the specified filter criteria.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: health:DescribeEventTypes on resource: *",
  "eventID": "caf18ae0-f5b6-4308-b608-1826ad85ede8",
  "eventName": "DescribeEventTypes",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2018-10-17T20:06:04Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "137b5c3e-d248-11e8-9efa-3f72d9f36bf3",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "9.245.1.85",
  "userAgent": "Botocore/1.12.25 Python/2.7.15 Linux/4.16.0-kali2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/Level6",
    "principalId": "AIDADO2GQD0K8TEF7KW1V",
    "type": "IAMUser",
    "userName": "Level6"
  }
}

References #

DescribeHealthServiceStatusForOrganization

#
Service
health

Description

This operation provides status information on enabling or disabling Health to work with your organization.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "errorCode": "AccessDenied",
  "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: health:DescribeHealthServiceStatusForOrganization on resource: *",
  "eventID": "762f4762-7ec6-42e9-a5d8-dd9839ab67a7",
  "eventName": "DescribeHealthServiceStatusForOrganization",
  "eventSource": "health.amazonaws.com",
  "eventTime": "2020-06-10T05:30:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.05",
  "recipientAccountId": "811596193553",
  "requestID": "12e96b58-63b1-4a21-be81-7d3c572023c",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "251.105.254.1",
  "userAgent": "Botocore/1.16.26 Python/2.7.18 Linux/5.4.0-2-amd64",
  "userIdentity": {
    "accessKeyId": "AKIA01U43UX3RBRDXF4Q",
    "accountId": "811596193553",
    "arn": "arn:aws:iam::811596193553:user/backup",
    "principalId": "AIDA9BO36HFBHKGJAO9C1",
    "type": "IAMUser",
    "userName": "backup"
  }
}

References #

DisableHealthServiceAccessForOrganization

#
Service
health

Description

Disables Health from working with Organizations.

EnableHealthServiceAccessForOrganization

#
Service
health

Description

Enables Health to work with Organizations.