Detection rules › By catalog entry

AWS-eks

Catalog entry	Rules
AssociateAccessPolicy	2
CreateAccessEntry	2
CreateCluster	1
DeleteAccessEntry	2
DeleteCluster	1
DisassociateAccessPolicy	1
UpdateAccessEntry	1
UpdateClusterConfig	1

AssociateAccessPolicy

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

AWS EKS Access Entry Granted Cluster Admin Policy severity high T1098,T1098.006
AWS EKS Access Entry Modified severity medium T1098,T1098.006

CreateAccessEntry

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

AWS EKS Access Entry Created Then Deleted by Same Identity severity medium T1098,T1098.006
AWS EKS Access Entry Modified severity medium T1098,T1098.006

CreateCluster

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

AWS EKS Cluster Created or Deleted severity low T1485

DeleteAccessEntry

2 detection rules reference this catalog entry. View catalog entry.

Elastic (2)

AWS EKS Access Entry Created Then Deleted by Same Identity severity medium T1098,T1098.006
AWS EKS Access Entry Modified severity medium T1098,T1098.006

DeleteCluster

1 detection rules reference this catalog entry. View catalog entry.

Sigma (1)

AWS EKS Cluster Created or Deleted severity low T1485

DisassociateAccessPolicy

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098,T1098.006

UpdateAccessEntry

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098,T1098.006

UpdateClusterConfig

1 detection rules reference this catalog entry. View catalog entry.

Elastic (1)

AWS EKS Control Plane Logging Disabled severity high T1685,T1685.002

Back to all AWS-eks catalog entries