Detection rules › By event

AWS-eks

Event	Rules
AssociateAccessPolicy	2
CreateAccessEntry	1
CreateCluster	1
DeleteAccessEntry	1
DeleteCluster	1
DisassociateAccessPolicy	1
UpdateAccessEntry	1
UpdateClusterConfig	1

AssociateAccessPolicy

2 detection rules reference this event. View event page.

Elastic (2)

AWS EKS Access Entry Granted Cluster Admin Policy severity high T1098, T1098.006
AWS EKS Access Entry Modified severity medium T1098, T1098.006

CreateAccessEntry

1 detection rules reference this event. View event page.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098, T1098.006

CreateCluster

1 detection rules reference this event. View event page.

Sigma (1)

AWS EKS Cluster Created or Deleted severity low T1485

DeleteAccessEntry

1 detection rules reference this event. View event page.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098, T1098.006

DeleteCluster

1 detection rules reference this event. View event page.

Sigma (1)

AWS EKS Cluster Created or Deleted severity low T1485

DisassociateAccessPolicy

1 detection rules reference this event. View event page.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098, T1098.006

UpdateAccessEntry

1 detection rules reference this event. View event page.

Elastic (1)

AWS EKS Access Entry Modified severity medium T1098, T1098.006

UpdateClusterConfig

1 detection rules reference this event. View event page.

Elastic (1)

AWS EKS Control Plane Logging Disabled severity high T1685, T1685.002