detection.wiki

AWS coverage

927 AWS detection rules across 6 vendors. 559 resolve to one of 564 (eventSource, eventName) pairs; the rest are grouped below as behavioral detections or non-CloudTrail sources.

AWS API activity is recorded in CloudTrail, where every record carries an eventSource (the service endpoint that handled the call, such as iam.amazonaws.com) and an eventName (the specific API action, such as CreateUser). The (eventSource, eventName) pair is the unit a detection keys on, so this page groups the combined Sigma, Elastic, Sentinel, and Chronicle corpora by that pair. Each pair maps to a catalog entry under the AWS catalog.

Rules are split below by how precisely they attribute. A rule that names a specific eventName is grouped under that action; a rule that names only an eventSource (no specific API action) identifies the service but not the call, so it is grouped separately under its service catch-all. Rules that name no eventSource and no exact eventName do not key on a single API call: they pivot on CloudTrail envelope fields (the calling identity, the API outcome, the network origin), and a further class reads an AWS log source other than CloudTrail. Note that management events (control-plane API calls) are logged by default, while data events (object-level operations such as S3 GetObject) appear only when a trail is configured to capture them.

Attributed to a specific API action

539 rules that name one CloudTrail eventName, mapped to that action's catalog entry.

Access Analyzer 1 rule, 1 event name

DeleteAnalyzer 1 rule

Account 8 rules, 6 event names

DisableRegion 1 rule
EnableRegion 3 rules
GetAlternateContact 1 rule
GetContactInformation 1 rule
PutAlternateContact 1 rule
PutContactInformation 1 rule

API Gateway 2 rules, 2 event names

GetApiKey 1 rule
GetApiKeys 1 rule

Backup 5 rules, 5 event names

DeleteBackupPlan 1 rule
DeleteBackupSelection 1 rule
DeleteBackupVault 1 rule
DeleteBackupVaultLockConfiguration 1 rule
DeleteRecoveryPoint 1 rule

batch 1 rule, 1 event name

SubmitJob 1 rule

Bedrock 68 rules, 48 event names

AssociateAgentCollaborator 1 rule
AssociateAgentKnowledgeBase 1 rule
Converse 1 rule
ConverseStream 1 rule
CreateAgent 1 rule
CreateAgentActionGroup 1 rule
CreateAgentAlias 1 rule
CreateCustomModelDeployment 1 rule
CreateDataSource 1 rule
CreateFoundationModelAgreement 2 rules
CreateMarketplaceModelEndpoint 1 rule
CreateModelImportJob 1 rule
CreateProvisionedModelThroughput 1 rule
DeleteAutomatedReasoningPolicy 1 rule
DeleteCustomModel 1 rule
DeleteDataSource 1 rule
DeleteEnforcedGuardrailConfiguration 1 rule
DeleteGuardrail 5 rules
DeleteImportedModel 1 rule
DeleteKnowledgeBase 2 rules
DeleteKnowledgeBaseDocuments 1 rule
DeleteMarketplaceModelEndpoint 1 rule
DeleteModelInvocationLoggingConfiguration 4 rules
DeleteProvisionedModelThroughput 2 rules
DeleteResourcePolicy 2 rules
IngestKnowledgeBaseDocuments 1 rule
InvokeModel 2 rules
InvokeModelWithResponseStream 1 rule
ListFoundationModels 3 rules
PrepareAgent 1 rule
PutEnforcedGuardrailConfiguration 1 rule
PutFoundationModelEntitlement 2 rules
PutModelInvocationLoggingConfiguration 2 rules
PutResourcePolicy 2 rules
PutUseCaseForModelAccess 2 rules
RegisterMarketplaceModelEndpoint 1 rule
StartIngestionJob 1 rule
UpdateAgent 1 rule
UpdateAgentActionGroup 1 rule
UpdateAgentAlias 1 rule
UpdateAgentCollaborator 1 rule
UpdateAgentKnowledgeBase 1 rule
UpdateAutomatedReasoningPolicy 1 rule
UpdateAutomatedReasoningPolicyAnnotations 1 rule
UpdateDataSource 1 rule
UpdateGuardrail 3 rules
UpdateKnowledgeBase 1 rule
UpdateProvisionedModelThroughput 1 rule

CloudFormation 2 rules, 2 event names

CreateStack 1 rule
CreateStackInstances 1 rule

CloudShell 1 rule, 1 event name

CreateEnvironment 1 rule

CloudTrail 43 rules, 8 event names

CreateTrail 2 rules
DeleteTrail 12 rules
DescribeTrails 1 rule
LookupEvents 1 rule
PutEventSelectors 3 rules
StartLogging 1 rule
StopLogging 12 rules
UpdateTrail 11 rules

codebuild 1 rule, 1 event name

UpdateProjectVisibility 1 rule

cognito-identity 3 rules, 1 event name

GetCredentialsForIdentity 3 rules

Config 24 rules, 13 event names

DeleteConfigRule 1 rule
DeleteConfigurationAggregator 1 rule
DeleteConfigurationRecorder 2 rules
DeleteConformancePack 1 rule
DeleteDeliveryChannel 5 rules
DeleteOrganizationConfigRule 1 rule
DeleteOrganizationConformancePack 1 rule
DeleteRemediationConfiguration 1 rule
DeleteRetentionConfiguration 1 rule
PutConfigurationRecorder 2 rules
PutDeliveryChannel 2 rules
StartConfigurationRecorder 1 rule
StopConfigurationRecorder 5 rules

DataSync 1 rule, 1 event name

CreateTask 1 rule

DynamoDB 3 rules, 3 event names

ExportTableToPointInTime 1 rule
ListTables 1 rule
Scan 1 rule

EC2 Instance Connect 3 rules, 2 event names

SendSerialConsoleSSHPublicKey 1 rule
SendSSHPublicKey 2 rules

EC2 191 rules, 105 event names

AcceptVpcPeeringConnection 1 rule
AssociateIamInstanceProfile 2 rules
AssociateInstanceEventWindow 1 rule
AttachClassicLinkVpc 1 rule
AttachInternetGateway 1 rule
AuthorizeSecurityGroupEgress 5 rules
AuthorizeSecurityGroupIngress 8 rules
BundleInstance 1 rule
CancelSpotInstanceRequests 1 rule
ConfirmProductInstance 1 rule
CopyFpgaImage 1 rule
CopyImage 1 rule
CreateCustomerGateway 1 rule
CreateFpgaImage 1 rule
CreateImage 1 rule
CreateInstanceEventWindow 1 rule
CreateInstanceExportTask 3 rules
CreateInternetGateway 2 rules
CreateKeyPair 1 rule
CreateLaunchTemplate 1 rule
CreateNatGateway 1 rule
CreateNetworkAcl 2 rules
CreateNetworkAclEntry 8 rules
CreateRestoreImageTask 1 rule
CreateRoute 2 rules
CreateRouteTable 3 rules
CreateSecurityGroup 3 rules
CreateStoreImageTask 2 rules
CreateTrafficMirrorFilter 1 rule
CreateTrafficMirrorFilterRule 1 rule
CreateTrafficMirrorSession 2 rules
CreateTrafficMirrorTarget 1 rule
CreateVpc 1 rule
DeleteCustomerGateway 1 rule
DeleteFlowLogs 8 rules
DeleteInstanceEventWindow 1 rule
DeleteInternetGateway 1 rule
DeleteNetworkAcl 2 rules
DeleteNetworkAclEntry 4 rules
DeleteRoute 1 rule
DeleteRouteTable 2 rules
DeleteSecurityGroup 1 rule
DeleteTrafficMirrorFilter 1 rule
DeleteTrafficMirrorFilterRule 1 rule
DeleteTrafficMirrorSession 1 rule
DeleteTrafficMirrorTarget 1 rule
DeleteVpc 1 rule
DeregisterInstanceEventNotificationAttributes 1 rule
DescribeImages 1 rule
DescribeInstanceAttribute 1 rule
DescribeInstances 2 rules
DescribeRegions 1 rule
DescribeSecurityGroupReferences 1 rule
DescribeSecurityGroupRules 1 rule
DescribeSecurityGroups 2 rules
DescribeSnapshotAttribute 1 rule
DescribeSubnets 1 rule
DescribeVpcs 1 rule
DetachClassicLinkVpc 1 rule
DetachInternetGateway 1 rule
DisableEbsEncryptionByDefault 4 rules
DisableVpcClassicLink 1 rule
DisassociateIamInstanceProfile 1 rule
DisassociateInstanceEventWindow 1 rule
DisassociateRouteTable 2 rules
EnableSerialConsoleAccess 1 rule
EnableVpcClassicLink 1 rule
ExportImage 1 rule
GetPasswordData 6 rules
ImportImage 1 rule
ImportInstance 1 rule
ImportKeyPair 1 rule
ModifyImageAttribute 3 rules
ModifyInstanceAttribute 7 rules
ModifyInstanceCapacityReservationAttributes 1 rule
ModifyInstanceCreditSpecification 1 rule
ModifyInstanceEventStartTime 1 rule
ModifyInstanceEventWindow 1 rule
ModifyInstanceMaintenanceOptions 1 rule
ModifyInstanceMetadataOptions 1 rule
ModifyInstancePlacement 1 rule
ModifySecurityGroupRules 1 rule
ModifySnapshotAttribute 8 rules
ModifyTrafficMirrorFilterNetworkServices 1 rule
ModifyTrafficMirrorFilterRule 1 rule
ModifyTrafficMirrorSession 1 rule
ModifyVpcAttribute 1 rule
MonitorInstances 1 rule
RegisterInstanceEventNotificationAttributes 1 rule
RejectVpcPeeringConnection 1 rule
ReplaceNetworkAclAssociation 1 rule
ReplaceNetworkAclEntry 5 rules
ReplaceRoute 2 rules
ReplaceRouteTableAssociation 2 rules
ReportInstanceStatus 1 rule
RequestSpotInstances 1 rule
ResetInstanceAttribute 1 rule
RevokeSecurityGroupEgress 4 rules
RevokeSecurityGroupIngress 4 rules
RunInstances 4 rules
RunScheduledInstances 1 rule
StartInstances 2 rules
StopInstances 3 rules
TerminateInstances 1 rule
UnmonitorInstances 1 rule

ECR 23 rules, 17 event names

BatchCheckLayerAvailability 1 rule
BatchDeleteImage 1 rule
BatchGetImage 1 rule
CompleteLayerUpload 1 rule
CreateRepository 1 rule
DeleteRepository 1 rule
DeleteRepositoryPolicy 1 rule
DescribeImageScanFindings 4 rules
GetAuthorizationToken 1 rule
GetDownloadUrlForLayer 1 rule
GetRepositoryPolicy 1 rule
InitiateLayerUpload 1 rule
PutImage 3 rules
PutImageScanningConfiguration 1 rule
PutRegistryPolicy 1 rule
SetRepositoryPolicy 2 rules
UploadLayerPart 1 rule

ECS 7 rules, 5 event names

CreateService 1 rule
DescribeTaskDefinition 1 rule
RegisterTaskDefinition 2 rules
RunTask 2 rules
StartTask 1 rule

EKS 9 rules, 8 event names

AssociateAccessPolicy 2 rules
CreateAccessEntry 1 rule
CreateCluster 1 rule
DeleteAccessEntry 1 rule
DeleteCluster 1 rule
DisassociateAccessPolicy 1 rule
UpdateAccessEntry 1 rule
UpdateClusterConfig 1 rule

ElastiCache 4 rules, 4 event names

AuthorizeCacheSecurityGroupIngress 1 rule
CreateCacheSecurityGroup 1 rule
DeleteCacheSecurityGroup 1 rule
RevokeCacheSecurityGroupIngress 1 rule

EFS 3 rules, 2 event names

DeleteFileSystem 2 rules
DeleteMountTarget 1 rule

Elastic Load Balancing 5 rules, 3 event names

ApplySecurityGroupsToLoadBalancer 2 rules
ModifyListener 1 rule
SetSecurityGroups 2 rules

EventBridge 6 rules, 3 event names

DeleteEventBus 3 rules
DeleteRule 1 rule
DisableRule 2 rules

Glue 3 rules, 3 event names

CreateDevEndpoint 1 rule
DeleteDevEndpoint 1 rule
UpdateDevEndpoint 1 rule

GuardDuty 25 rules, 15 event names

ArchiveFindings 1 rule
CreateIPSet 3 rules
CreateThreatIntelSet 1 rule
DeleteDetector 3 rules
DeleteInvitations 1 rule
DeleteIPSet 1 rule
DeleteMembers 1 rule
DeletePublishingDestination 1 rule
DeleteThreatIntelSet 1 rule
DisassociateFromAdministratorAccount 1 rule
DisassociateMembers 1 rule
StopMonitoringMembers 1 rule
UpdateDetector 5 rules
UpdateIPSet 2 rules
UpdateThreatIntelSet 2 rules

health 2 rules, 1 event name

DescribeEventAggregates 2 rules

IAM 293 rules, 75 event names

AddRoleToInstanceProfile 2 rules
AddUserToGroup 3 rules
AttachGroupPolicy 24 rules
AttachRolePolicy 26 rules
AttachUserPolicy 26 rules
ChangePassword 1 rule
CreateAccessKey 20 rules
CreateGroup 2 rules
CreateInstanceProfile 2 rules
CreateLoginProfile 12 rules
CreateOpenIDConnectProvider 1 rule
CreatePolicyVersion 2 rules
CreateRole 6 rules
CreateSAMLProvider 3 rules
CreateServiceLinkedRole 1 rule
CreateServiceSpecificCredential 1 rule
CreateUser 7 rules
CreateVirtualMFADevice 5 rules
DeactivateMFADevice 5 rules
DeleteAccessKey 1 rule
DeleteAccountPasswordPolicy 3 rules
DeleteGroup 4 rules
DeleteGroupPolicy 2 rules
DeleteLoginProfile 3 rules
DeletePolicy 1 rule
DeleteRole 1 rule
DeleteRolePermissionsBoundary 1 rule
DeleteRolePolicy 1 rule
DeleteSAMLProvider 3 rules
DeleteServiceSpecificCredential 1 rule
DeleteUser 1 rule
DeleteUserPermissionsBoundary 1 rule
DeleteUserPolicy 1 rule
DeleteVirtualMFADevice 4 rules
DetachGroupPolicy 1 rule
DetachRolePolicy 1 rule
DetachUserPolicy 1 rule
EnableMFADevice 2 rules
GetAccountAuthorizationDetails 1 rule
GetAccountPasswordPolicy 2 rules
GetAccountSummary 2 rules
GetCredentialReport 1 rule
GetGroup 1 rule
GetGroupPolicy 1 rule
GetLoginProfile 1 rule
GetPolicy 1 rule
GetPolicyVersion 1 rule
GetRole 1 rule
GetRolePolicy 1 rule
GetUser 1 rule
GetUserPolicy 1 rule
ListAccessKeys 3 rules
ListAccountAliases 2 rules
ListAttachedGroupPolicies 1 rule
ListAttachedRolePolicies 2 rules
ListAttachedUserPolicies 2 rules
ListGroupPolicies 1 rule
ListGroups 3 rules
ListGroupsForUser 2 rules
ListMFADevices 1 rule
ListRoles 4 rules
ListUserPolicies 1 rule
ListUsers 3 rules
PutGroupPolicy 13 rules
PutRolePermissionsBoundary 1 rule
PutRolePolicy 14 rules
PutUserPermissionsBoundary 1 rule
PutUserPolicy 17 rules
RemoveUserFromGroup 1 rule
SetDefaultPolicyVersion 2 rules
UpdateAccountPasswordPolicy 3 rules
UpdateAssumeRolePolicy 2 rules
UpdateLoginProfile 9 rules
UpdateSAMLProvider 7 rules
UploadServerCertificate 1 rule

Identity Store 4 rules, 4 event names

CreateGroup 1 rule
CreateUser 1 rule
DeleteGroup 1 rule
DeleteUser 1 rule

KMS 16 rules, 7 event names

DeleteImportedKeyMaterial 2 rules
DisableKey 3 rules
ImportKeyMaterial 1 rule
ListAliases 1 rule
ListKeys 1 rule
PutKeyPolicy 5 rules
ScheduleKeyDeletion 3 rules

Lambda 21 rules, 16 event names

AddPermission 2 rules
CreateAlias 1 rule
CreateEventSourceMapping 1 rule
CreateFunction 1 rule
CreateFunctionUrlConfig 1 rule
DeleteAlias 1 rule
DeleteEventSourceMapping 1 rule
DeleteFunction 2 rules
ListAliases 1 rule
ListFunctions 1 rule
PublishVersion 1 rule
RemovePermission 1 rule
UpdateAlias 1 rule
UpdateEventSourceMapping 1 rule
UpdateFunctionCode 3 rules
UpdateFunctionConfiguration 2 rules

CloudWatch Logs 7 rules, 2 event names

DeleteLogGroup 5 rules
DeleteLogStream 2 rules

Macie 6 rules, 6 event names

CreateFindingsFilter 1 rule
DisableMacie 1 rule
UpdateClassificationJob 1 rule
UpdateFindingsFilter 1 rule
UpdateMacieSession 1 rule
UpdateMemberSession 1 rule

CloudWatch 2 rules, 1 event name

DeleteAlarms 2 rules

network-firewall 5 rules, 5 event names

DescribeFirewall 1 rule
DescribeFirewallPolicy 1 rule
DescribeRuleGroup 1 rule
ListFirewallPolicies 1 rule
ListFirewalls 1 rule

Organizations 15 rules, 13 event names

CloseAccount 1 rule
DescribeOrganization 1 rule
DescribeResourcePolicy 1 rule
LeaveOrganization 3 rules
ListAccounts 1 rule
ListAccountsForParent 1 rule
ListAWSServiceAccessForOrganization 1 rule
ListDelegatedAdministrators 1 rule
ListDelegatedServicesForAccount 1 rule
ListOrganizationalUnitsForParent 1 rule
ListPolicies 1 rule
ListRoots 1 rule
RemoveAccountFromOrganization 1 rule

RDS 70 rules, 36 event names

AddRoleToDBCluster 1 rule
AddRoleToDBInstance 1 rule
AuthorizeDBSecurityGroupIngress 3 rules
CopyDBClusterSnapshot 1 rule
CopyDBSnapshot 1 rule
CreateDBCluster 1 rule
CreateDBClusterSnapshot 1 rule
CreateDBInstance 1 rule
CreateDBSecurityGroup 2 rules
CreateDBSnapshot 2 rules
DeleteDBCluster 3 rules
DeleteDBClusterAutomatedBackup 1 rule
DeleteDBClusterSnapshot 2 rules
DeleteDBInstance 2 rules
DeleteDBInstanceAutomatedBackup 1 rule
DeleteDBSecurityGroup 2 rules
DeleteDBSnapshot 2 rules
DeleteGlobalCluster 1 rule
DescribeDBClusterSnapshots 1 rule
DescribeDBInstances 1 rule
DescribeDBSnapshots 2 rules
DownloadDBLogFilePortion 1 rule
FailoverDBCluster 1 rule
FailoverGlobalCluster 1 rule
ModifyDBCluster 6 rules
ModifyDBClusterSnapshotAttribute 3 rules
ModifyDBInstance 11 rules
ModifyDBSnapshotAttribute 3 rules
RebootDBCluster 1 rule
RebootDBInstance 1 rule
RebootDBShardGroup 1 rule
RestoreDBInstanceFromDBSnapshot 3 rules
RestoreDBInstanceFromS3 1 rule
RevokeDBSecurityGroupIngress 2 rules
StartExportTask 2 rules
StopActivityStream 1 rule

Roles Anywhere 2 rules, 2 event names

CreateProfile 1 rule
CreateTrustAnchor 1 rule

Route 53 1 rule, 1 event name

AssociateVPCWithHostedZone 1 rule

Route 53 Domains 4 rules, 2 event names

DisableDomainTransferLock 2 rules
TransferDomainToAnotherAwsAccount 2 rules

Route 53 Resolver 2 rules, 1 event name

DeleteResolverQueryLogConfig 2 rules

S3 94 rules, 38 event names

CopyObject 6 rules
DeleteAccountPublicAccessBlock 2 rules
DeleteBucketCors 2 rules
DeleteBucketEncryption 2 rules
DeleteBucketLifecycle 2 rules
DeleteBucketPolicy 2 rules
DeleteBucketPublicAccessBlock 2 rules
DeleteBucketReplication 3 rules
DeleteObject 2 rules
DeleteObjects 2 rules
GetBucketAcl 1 rule
GetBucketPolicy 1 rule
GetBucketPolicyStatus 1 rule
GetBucketPublicAccessBlock 1 rule
GetBucketVersioning 1 rule
GetObject 10 rules
GetObjectAcl 1 rule
ListBucket 1 rule
ListBuckets 2 rules
ListObjects 1 rule
PutAccessPointPolicy 1 rule
PutAccountPublicAccessBlock 1 rule
PutBucketAcl 6 rules
PutBucketCors 1 rule
PutBucketLifecycle 5 rules
PutBucketLogging 4 rules
PutBucketPolicy 4 rules
PutBucketPublicAccessBlock 1 rule
PutBucketReplication 3 rules
PutBucketVersioning 7 rules
PutBucketWebsite 1 rule
PutEncryptionConfiguration 1 rule
PutLifecycleConfiguration 1 rule
PutObject 8 rules
PutObjectAcl 2 rules
PutReplicationConfiguration 1 rule
ReplicateObject 1 rule
RestoreObject 1 rule

SageMaker 7 rules, 7 event names

CreateAutoMLJob 1 rule
CreateNotebookInstance 1 rule
CreateNotebookInstanceLifecycleConfig 1 rule
CreatePipeline 1 rule
CreateProcessingJob 1 rule
CreateTrainingJob 1 rule
UpdateNotebookInstanceLifecycleConfig 1 rule

Secrets Manager 7 rules, 2 event names

BatchGetSecretValue 3 rules
GetSecretValue 4 rules

Security Hub 11 rules, 7 event names

BatchUpdateFindings 2 rules
DeleteInsight 2 rules
DescribeProducts 1 rule
DescribeStandards 1 rule
DescribeStandardsControls 1 rule
UpdateFindings 2 rules
UpdateInsight 2 rules

Service Quotas 1 rule, 1 event name

GetServiceQuota 1 rule

SES 13 rules, 13 event names

CreateEmailIdentity 1 rule
DeleteEmailIdentity 1 rule
DeleteIdentity 1 rule
GetAccountSendingEnabled 1 rule
GetIdentityVerificationAttributes 1 rule
GetSendQuota 1 rule
PutAccountSendingAttributes 1 rule
PutConfigurationSetSendingOptions 1 rule
UpdateAccountSendingEnabled 1 rule
UpdateConfigurationSetSendingEnabled 1 rule
VerifyDomainDkim 1 rule
VerifyDomainIdentity 1 rule
VerifyEmailIdentity 1 rule

Sign-In 46 rules, 3 event names

ConsoleLogin 39 rules
GetSigninToken 6 rules
PasswordRecoveryRequested 1 rule

SNS 4 rules, 4 event names

CreateTopic 1 rule
Publish 1 rule
SetTopicAttributes 1 rule
Subscribe 1 rule

SQS 1 rule, 1 event name

PurgeQueue 1 rule

Systems Manager 21 rules, 14 event names

CreateAssociation 2 rules
CreateDocument 1 rule
DescribeInstanceInformation 1 rule
DescribeInstancePatches 1 rule
GetInventory 1 rule
GetInventorySchema 1 rule
GetParameter 2 rules
GetParameters 2 rules
ListCommands 1 rule
ListInventoryEntries 1 rule
ModifyDocumentPermission 1 rule
RegisterManagedInstance 1 rule
SendCommand 5 rules
StartSession 1 rule

IAM Identity Center Directory 2 rules, 2 event names

DisableExternalIdPConfigurationForDirectory 1 rule
EnableExternalIdPConfigurationForDirectory 1 rule

IAM Identity Center 5 rules, 5 event names

AssociateDirectory 1 rule
Authenticate 1 rule
CreateToken 1 rule
DisassociateDirectory 1 rule
ListApplications 1 rule

STS 29 rules, 7 event names

AssumeRole 8 rules
AssumeRoleWithSAML 2 rules
AssumeRoleWithWebIdentity 2 rules
AssumeRoot 1 rule
GetCallerIdentity 7 rules
GetFederationToken 2 rules
GetSessionToken 7 rules

WAF Regional 3 rules, 3 event names

DeleteRule 1 rule
DeleteRuleGroup 1 rule
DeleteWebACL 1 rule

WAF 8 rules, 5 event names

DeleteIPSet 1 rule
DeleteLoggingConfiguration 1 rule
DeleteRule 2 rules
DeleteRuleGroup 2 rules
DeleteWebACL 2 rules

WAFv2 8 rules, 6 event names

CreateIPSet 1 rule
DeleteIPSet 1 rule
DeleteLoggingConfiguration 1 rule
DeleteRuleGroup 2 rules
DeleteWebACL 2 rules
UpdateIPSet 1 rule

workdocs 2 rules, 2 event names

CreateUser 1 rule
DeleteUser 1 rule

workmail 7 rules, 7 event names

CreateGroup 1 rule
CreateOrganization 1 rule
CreateUser 1 rule
DeleteGroup 1 rule
DeleteUser 1 rule
RegisterToWorkMail 1 rule
ResetPassword 1 rule

Attributed to a service, not a specific action

20 rules that name only an eventSource (no specific API action), mapped to that service's catch-all entry.

EC2 2 rules, 1 event name

(any event) 2 rules

ECR 1 rule, 1 event name

(any event) 1 rule

IAM 3 rules, 1 event name

(any event) 3 rules

Lambda 13 rules, 1 event name

(any event) 13 rules

S3 1 rule, 1 event name

(any event) 1 rule

Not attributed to a CloudTrail (eventSource, eventName) pair

AWS sources beyond CloudTrail 31 rules

These rules read an AWS log source other than CloudTrail, so they cannot map to a CloudTrail (eventSource, eventName) pair. They are grouped by the source they read.

Security Hub findings 8 rules
WAF 8 rules
EKS audit (Kubernetes audit via AWS) 15 rules

Behavioral detections 301 rules

These rules name no eventSource and no exact eventName. Rather than a single API call, they pivot on CloudTrail envelope fields shared by every record. They are grouped by the dominant pivot field.

Identity and principal 8 rules
API errors and outcome 35 rules
Network origin 9 rules
Other behavioral 249 rules

Unclassified 36 rules

These rules name an eventSource or eventName that does not resolve to a single catalog pair (for example a rule spanning several services, or an action not yet in the catalog map).

Unclassified 36 rules