Detection rules › By event

AWS-events

Event	Rules
DeleteRule	1
DisableRule	2
DeleteEventBus	3

DeleteRule

1 detection rules reference this event. View event page.

Elastic (1)

AWS EventBridge Rule Disabled or Deleted severity low T1489, T1685

DisableRule

2 detection rules reference this event. View event page.

Elastic (1)

AWS EventBridge Rule Disabled or Deleted severity low T1489, T1685

Panther (1)

Account Security Configuration Changed severity medium T1685

DeleteEventBus

3 detection rules reference this event. View event page.

Kusto (3)

AWSCloudTrail - Changes made to AWS CloudTrail logs severity low T1070
AWSCloudTrail - Config Service Resource Deletion Attempts severity low T1685, T1685.002
AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002