Detection rules › By event

AWS-bedrock

Event	Rules
AssociateAgentCollaborator	1
AssociateAgentKnowledgeBase	1
Converse	1
ConverseStream	1
CreateAgent	1
CreateAgentActionGroup	1
CreateAgentAlias	1
CreateCustomModelDeployment	1
CreateDataSource	1
CreateFoundationModelAgreement	2
CreateMarketplaceModelEndpoint	1
CreateModelImportJob	1
CreateProvisionedModelThroughput	1
DeleteAutomatedReasoningPolicy	1
DeleteDataSource	1
DeleteEnforcedGuardrailConfiguration	1
DeleteGuardrail	5
DeleteKnowledgeBase	2
DeleteKnowledgeBaseDocuments	1
DeleteModelInvocationLoggingConfiguration	4
DeleteProvisionedModelThroughput	2
DeleteResourcePolicy	2
IngestKnowledgeBaseDocuments	1
InvokeModel	2
InvokeModelWithResponseStream	1
ListFoundationModels	3
PrepareAgent	1
PutEnforcedGuardrailConfiguration	1
PutFoundationModelEntitlement	2
PutModelInvocationLoggingConfiguration	2
PutResourcePolicy	2
PutUseCaseForModelAccess	2
RegisterMarketplaceModelEndpoint	1
StartIngestionJob	1
UpdateAgent	1
UpdateAgentActionGroup	1
UpdateAgentAlias	1
UpdateAgentCollaborator	1
UpdateAgentKnowledgeBase	1
UpdateAutomatedReasoningPolicy	1
UpdateAutomatedReasoningPolicyAnnotations	1
UpdateDataSource	1
UpdateGuardrail	3
UpdateKnowledgeBase	1
UpdateProvisionedModelThroughput	1
DeleteCustomModel	1
DeleteImportedModel	1
DeleteMarketplaceModelEndpoint	1

AssociateAgentCollaborator

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

AssociateAgentKnowledgeBase

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Third-Party or External Knowledge Base Associated to Agent severity medium T1505

Converse

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock High-Frequency Single-Model Inference API Probing severity medium

ConverseStream

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock High-Frequency Single-Model Inference API Probing severity medium

CreateAgent

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent Created by IAM User or Root severity low T1505

CreateAgentActionGroup

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

CreateAgentAlias

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

CreateCustomModelDeployment

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered severity medium T1525

CreateDataSource

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

CreateFoundationModelAgreement

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Foundation Model Access Enabled or Entitlement Granted severity medium T1098
AWS Bedrock Unauthorized Foundation Model Access Attempt severity low T1098

CreateMarketplaceModelEndpoint

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered severity medium T1525

CreateModelImportJob

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered severity medium T1525

CreateProvisionedModelThroughput

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Provisioned Model Throughput Tampering severity medium T1496, T1496.004

DeleteAutomatedReasoningPolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Automated Reasoning Safety Policy Tampering severity medium T1685

DeleteDataSource

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

DeleteEnforcedGuardrailConfiguration

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Guardrail Deleted or Weakened severity medium T1685

DeleteGuardrail

5 detection rules reference this event. View event page.

Sigma (1)

AWS Bedrock Guardrail Deleted severity medium T1685

Elastic (2)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685
AWS Bedrock Guardrail Deleted or Weakened severity medium T1685

Splunk (1)

AWS Bedrock Delete GuardRails severity medium T1685, T1685.002

Panther (1)

AWS Bedrock Guardrail Updated or Deleted severity medium T1685

DeleteKnowledgeBase

2 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

Splunk (1)

AWS Bedrock Delete Knowledge Base severity medium T1485

DeleteKnowledgeBaseDocuments

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

DeleteModelInvocationLoggingConfiguration

4 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685
AWS Bedrock Model Invocation Logging Disabled or Modified severity high T1685, T1685.002

Splunk (1)

AWS Bedrock Delete Model Invocation Logging Configuration severity medium T1685, T1685.002

Panther (1)

AWS Bedrock Model Invocation Logging Configuration Deleted severity medium T1690

DeleteProvisionedModelThroughput

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685
AWS Bedrock Provisioned Model Throughput Tampering severity medium T1496, T1496.004

DeleteResourcePolicy

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Resource-Based Policy Modified or Deleted severity medium T1098
AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt severity low T1098

IngestKnowledgeBaseDocuments

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

InvokeModel

2 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock High-Frequency Single-Model Inference API Probing severity medium

Splunk (1)

AWS Bedrock Invoke Model Access Denied severity medium T1078, T1550

InvokeModelWithResponseStream

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock High-Frequency Single-Model Inference API Probing severity medium

ListFoundationModels

3 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Foundation Model Enumeration Followed by Invocation via Long-Term Key severity high T1078, T1078.004, T1526
AWS Discovery API Calls from VPN ASN for the First Time by Identity severity high T1526, T1580

Splunk (1)

AWS Bedrock High Number List Foundation Model Failures severity medium T1580

PrepareAgent

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

PutEnforcedGuardrailConfiguration

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Guardrail Deleted or Weakened severity medium T1685

PutFoundationModelEntitlement

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Foundation Model Access Enabled or Entitlement Granted severity medium T1098
AWS Bedrock Unauthorized Foundation Model Access Attempt severity low T1098

PutModelInvocationLoggingConfiguration

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685
AWS Bedrock Model Invocation Logging Disabled or Modified severity high T1685, T1685.002

PutResourcePolicy

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Resource-Based Policy Modified or Deleted severity medium T1098
AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt severity low T1098

PutUseCaseForModelAccess

2 detection rules reference this event. View event page.

Elastic (2)

AWS Bedrock Foundation Model Access Enabled or Entitlement Granted severity medium T1098
AWS Bedrock Unauthorized Foundation Model Access Attempt severity low T1098

RegisterMarketplaceModelEndpoint

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Untrusted Model Imported or Marketplace Endpoint Registered severity medium T1525

StartIngestionJob

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

UpdateAgent

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

UpdateAgentActionGroup

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

UpdateAgentAlias

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

UpdateAgentCollaborator

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Agent or Action Group Manipulation severity medium T1505

UpdateAgentKnowledgeBase

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Third-Party or External Knowledge Base Associated to Agent severity medium T1505

UpdateAutomatedReasoningPolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Automated Reasoning Safety Policy Tampering severity medium T1685

UpdateAutomatedReasoningPolicyAnnotations

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Automated Reasoning Safety Policy Tampering severity medium T1685

UpdateDataSource

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

UpdateGuardrail

3 detection rules reference this event. View event page.

Sigma (1)

AWS Bedrock Guardrail Updated severity medium T1685

Elastic (1)

AWS Bedrock Guardrail Deleted or Weakened severity medium T1685

Panther (1)

AWS Bedrock Guardrail Updated or Deleted severity medium T1685

UpdateKnowledgeBase

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Knowledge Base or RAG Data Source Tampering severity medium T1565, T1565.001

UpdateProvisionedModelThroughput

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock Provisioned Model Throughput Tampering severity medium T1496, T1496.004

DeleteCustomModel

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685

DeleteImportedModel

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685

DeleteMarketplaceModelEndpoint

1 detection rules reference this event. View event page.

Elastic (1)

AWS Bedrock API Key Used for Destructive or Anti-Recovery Action severity high T1485, T1685