Security Incident Response

eventName	Description	Sample	Rule
any	Catch-all entry for Security Incident Response rules that match the service but not a specific eventName.	N	N
BatchGetMemberAccountDetails	Provides information on whether the supplied account IDs are associated with a membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CancelMembership	Cancels an existing membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CloseCase	Closes an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateCase	Creates a new case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateCaseComment	Adds a comment to an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
CreateMembership	Creates a new membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetCase	Returns the attributes of a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetCaseAttachmentDownloadUrl	Returns a Pre-Signed URL for uploading attachments into a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetCaseAttachmentUploadUrl	Uploads an attachment to a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
GetMembership	Returns the attributes of a membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListCaseEdits	Views the case history for edits made to a designated case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListCases	Lists all cases the requester has access to. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListComments	Returns comments for a designated case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListInvestigations	Investigation performed by an agent for a security incident... Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListMemberships	Returns the memberships that the calling principal can access. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
ListTagsForResource	Returns currently configured tags on a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
SendFeedback	Send feedback based on response investigation action Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
TagResource	Adds a tag(s) to a designated resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UntagResource	Removes a tag(s) from a designate resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateCase	Updates an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateCaseComment	Updates an existing case comment. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateCaseStatus	Updates the state transitions for a designated cases. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateMembership	Updates membership configuration. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N
UpdateResolverType	Updates the resolver type for a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.	N	N

any: Security Incident Response (catch-all)

Service: security-ir

Description

Catch-all entry for Security Incident Response rules that match the service but not a specific eventName.

BatchGetMemberAccountDetails

Service: security-ir

Description

Provides information on whether the supplied account IDs are associated with a membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CancelMembership

Service: security-ir

Description

Cancels an existing membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CloseCase

Service: security-ir

Description

Closes an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateCase

Service: security-ir

Description

Creates a new case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateCaseComment

Service: security-ir

Description

Adds a comment to an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

CreateMembership

Service: security-ir

Description

Creates a new membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetCase

Service: security-ir

Description

Returns the attributes of a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetCaseAttachmentDownloadUrl

Service: security-ir

Description

Returns a Pre-Signed URL for uploading attachments into a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetCaseAttachmentUploadUrl

Service: security-ir

Description

Uploads an attachment to a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

GetMembership

Service: security-ir

Description

Returns the attributes of a membership. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListCaseEdits

Service: security-ir

Description

Views the case history for edits made to a designated case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListCases

Service: security-ir

Description

Lists all cases the requester has access to. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListComments

Service: security-ir

Description

Returns comments for a designated case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListInvestigations

Service: security-ir

Description

Investigation performed by an agent for a security incident... Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListMemberships

Service: security-ir

Description

Returns the memberships that the calling principal can access. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

ListTagsForResource

Service: security-ir

Description

Returns currently configured tags on a resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

SendFeedback

Service: security-ir

Description

Send feedback based on response investigation action Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

TagResource

Service: security-ir

Description

Adds a tag(s) to a designated resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UntagResource

Service: security-ir

Description

Removes a tag(s) from a designate resource. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateCase

Service: security-ir

Description

Updates an existing case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateCaseComment

Service: security-ir

Description

Updates an existing case comment. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateCaseStatus

Service: security-ir

Description

Updates the state transitions for a designated cases. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateMembership

Service: security-ir

Description

Updates membership configuration. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.

UpdateResolverType

Service: security-ir

Description

Updates the resolver type for a case. Model-derived from the AWS SDK operation catalog (botocore); the eventSource is inferred from the SDK endpoint prefix and no CloudTrail sample confirms it yet.