Detection rules › By event

AWS-config

Event	Rules
DeleteConfigRule	1
DeleteConfigurationAggregator	1
DeleteConfigurationRecorder	2
DeleteConformancePack	1
DeleteDeliveryChannel	5
DeleteOrganizationConfigRule	1
DeleteOrganizationConformancePack	1
DeleteRemediationConfiguration	1
DeleteRetentionConfiguration	1
PutConfigurationRecorder	2
PutDeliveryChannel	2
StopConfigurationRecorder	5
StartConfigurationRecorder	1

DeleteConfigRule

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteConfigurationAggregator

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteConfigurationRecorder

2 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

YARA-L (1)

AWS Config Service Modified severity high T1685, T1685.002

DeleteConformancePack

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteDeliveryChannel

5 detection rules reference this event. View event page.

Sigma (1)

AWS Config Disabling Channel/Recorder severity high T1685, T1685.002

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

YARA-L (1)

AWS Config Service Modified severity high T1685, T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
AWS Config Service Disabled severity medium T1685

DeleteOrganizationConfigRule

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteOrganizationConformancePack

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteRemediationConfiguration

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

DeleteRetentionConfiguration

1 detection rules reference this event. View event page.

Elastic (1)

AWS Config Resource Deletion severity medium T1685, T1685.002

PutConfigurationRecorder

2 detection rules reference this event. View event page.

YARA-L (1)

AWS Config Service Modified severity high T1685, T1685.002

Panther (1)

AWS Config Service Created severity informational T1526

PutDeliveryChannel

2 detection rules reference this event. View event page.

YARA-L (1)

AWS Config Service Modified severity high T1685, T1685.002

Panther (1)

AWS Config Service Created severity informational T1526

StopConfigurationRecorder

5 detection rules reference this event. View event page.

Sigma (1)

AWS Config Disabling Channel/Recorder severity high T1685, T1685.002

Elastic (1)

AWS Configuration Recorder Stopped severity high T1685, T1685.002

YARA-L (1)

AWS Config Service Modified severity high T1685, T1685.002

Panther (2)

Account Security Configuration Changed severity medium T1685
AWS Config Service Disabled severity medium T1685

StartConfigurationRecorder

1 detection rules reference this event. View event page.

Panther (1)

AWS Config Service Created severity informational T1526