WorkDocs
| eventName | Description | Sample | Rule |
|---|---|---|---|
| any | Catch-all entry for WorkDocs rules that match the service but not a specific eventName. | N | N |
| Abort | Aborts the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload. | N | N |
| Activate | Activates the specified user. | N | N |
| Add | Creates a set of permissions for the specified folder or document. | N | N |
| Create | Adds a new comment to the specified document version. | N | N |
| Create | Adds one or more custom properties to the specified resource (a folder, document, or version). | N | N |
| Create | Creates a folder with the specified name and parent folder. | N | N |
| Create | Adds the specified list of labels to the given resource (a document or folder) | N | N |
| Create | Configure Amazon WorkDocs to use Amazon SNS notifications. | N | N |
| Create | Creates a user in a Simple AD or Microsoft AD directory. | N | Y |
| Deactivate | Deactivates the specified user, which revokes the user's access to Amazon WorkDocs. | N | N |
| Delete | Deletes the specified comment from the document version. | N | N |
| Delete | Deletes custom metadata from the specified resource. | N | N |
| Delete | Permanently deletes the specified document and its associated metadata. | N | N |
| Delete | Deletes a specific version of a document. | N | N |
| Delete | Permanently deletes the specified folder and its contents. | N | N |
| Delete | Deletes the contents of the specified folder. | N | N |
| Delete | Deletes the specified list of labels from a resource. | N | N |
| Delete | Deletes the specified subscription from the specified organization. | N | N |
| Delete | Deletes the specified user from a Simple AD or Microsoft AD directory. | N | Y |
| Describe | Describes the user activities in a specified time period. | N | N |
| Describe | List all the comments for the specified document version. | N | N |
| Describe | Retrieves the document versions for the specified document. | N | N |
| Describe | Describes the contents of the specified folder, including its documents and subfolders. | N | N |
| Describe | Describes the groups specified by the query. | N | N |
| Describe | Lists the specified notification subscriptions. | N | N |
| Describe | Describes the permissions of a specified resource. | N | N |
| Describe | Describes the current user's special folders; the RootFolder and the RecycleBin. | N | N |
| Describe | Describes the specified users. | N | N |
| Get | Retrieves details of the current user for whom the authentication token was generated. | N | N |
| Get | Retrieves details of a document. | N | N |
| Get | Retrieves the path information (the hierarchy from the root folder) for the requested document. | N | N |
| Get | Retrieves version metadata for the specified document. | N | N |
| Get | Retrieves the metadata of the specified folder. | N | N |
| Get | Retrieves the path information (the hierarchy from the root folder) for the specified folder. | N | N |
| Get | Retrieves a collection of resources, including folders and documents. | N | N |
| Initiate | Creates a new document object and version object. | N | N |
| Remove | Removes all the permissions from the specified resource. | N | N |
| Remove | Removes the permission for the specified principal from the specified resource. | N | N |
| Restore | Recovers a deleted version of an Amazon WorkDocs document. | N | N |
| Search | Searches metadata and the content of folders, documents, document versions, and comments. | N | N |
| Update | Updates the specified attributes of a document. | N | N |
| Update | Changes the status of the document version to ACTIVE. | N | N |
| Update | Updates the specified attributes of the specified folder. | N | N |
| Update | Updates the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site. | N | N |
any: WorkDocs (catch-all)
#Description
Catch-all entry for WorkDocs rules that match the service but not a specific eventName.
AbortDocumentVersionUpload
#Description
Aborts the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload.
ActivateUser
#Description
Activates the specified user.
AddResourcePermissions
#Description
Creates a set of permissions for the specified folder or document.
CreateComment
#Description
Adds a new comment to the specified document version.
CreateCustomMetadata
#Description
Adds one or more custom properties to the specified resource (a folder, document, or version).
CreateFolder
#Description
Creates a folder with the specified name and parent folder.
CreateLabels
#Description
Adds the specified list of labels to the given resource (a document or folder)
CreateNotificationSubscription
#Description
Configure Amazon WorkDocs to use Amazon SNS notifications.
CreateUser
#Description
Creates a user in a Simple AD or Microsoft AD directory.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1078, T1078.002, T1078.004, T1134↳ also matches DeleteUser
DeactivateUser
#Description
Deactivates the specified user, which revokes the user's access to Amazon WorkDocs.
DeleteComment
#Description
Deletes the specified comment from the document version.
DeleteCustomMetadata
#Description
Deletes custom metadata from the specified resource.
DeleteDocument
#Description
Permanently deletes the specified document and its associated metadata.
DeleteDocumentVersion
#Description
Deletes a specific version of a document.
DeleteFolder
#Description
Permanently deletes the specified folder and its contents.
DeleteFolderContents
#Description
Deletes the contents of the specified folder.
DeleteLabels
#Description
Deletes the specified list of labels from a resource.
DeleteNotificationSubscription
#Description
Deletes the specified subscription from the specified organization.
DeleteUser
#Description
Deletes the specified user from a Simple AD or Microsoft AD directory.
Detection Rules #
Full rule details for this event, including ATT&CK technique mappings and native queries →Kusto #
T1078, T1078.002, T1078.004, T1134↳ also matches CreateUser
DescribeActivities
#Description
Describes the user activities in a specified time period.
DescribeComments
#Description
List all the comments for the specified document version.
DescribeDocumentVersions
#Description
Retrieves the document versions for the specified document.
DescribeFolderContents
#Description
Describes the contents of the specified folder, including its documents and subfolders.
DescribeGroups
#Description
Describes the groups specified by the query.
DescribeNotificationSubscriptions
#Description
Lists the specified notification subscriptions.
DescribeResourcePermissions
#Description
Describes the permissions of a specified resource.
DescribeRootFolders
#Description
Describes the current user's special folders; the RootFolder and the RecycleBin.
DescribeUsers
#Description
Describes the specified users.
GetCurrentUser
#Description
Retrieves details of the current user for whom the authentication token was generated.
GetDocument
#Description
Retrieves details of a document.
GetDocumentPath
#Description
Retrieves the path information (the hierarchy from the root folder) for the requested document.
GetDocumentVersion
#Description
Retrieves version metadata for the specified document.
GetFolder
#Description
Retrieves the metadata of the specified folder.
GetFolderPath
#Description
Retrieves the path information (the hierarchy from the root folder) for the specified folder.
GetResources
#Description
Retrieves a collection of resources, including folders and documents.
InitiateDocumentVersionUpload
#Description
Creates a new document object and version object.
RemoveAllResourcePermissions
#Description
Removes all the permissions from the specified resource.
RemoveResourcePermission
#Description
Removes the permission for the specified principal from the specified resource.
RestoreDocumentVersions
#Description
Recovers a deleted version of an Amazon WorkDocs document.
SearchResources
#Description
Searches metadata and the content of folders, documents, document versions, and comments.
UpdateDocument
#Description
Updates the specified attributes of a document.
UpdateDocumentVersion
#Description
Changes the status of the document version to ACTIVE.
UpdateFolder
#Description
Updates the specified attributes of the specified folder.
UpdateUser
#Description
Updates the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site.