Detection rules › By event

AWS-guardduty

Event	Rules
CreateIPSet	3
DeleteDetector	3
DeleteInvitations	1
DeleteMembers	1
DeletePublishingDestination	1
DeleteThreatIntelSet	1
DisassociateFromAdministratorAccount	1
DisassociateMembers	1
StopMonitoringMembers	1
UpdateDetector	5
UpdateThreatIntelSet	2
ArchiveFindings	1
CreateThreatIntelSet	1
DeleteIPSet	1
UpdateIPSet	2

CreateIPSet

3 detection rules reference this event. View event page.

Sigma (1)

AWS GuardDuty Important Change severity high T1685

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Panther (1)

AWS Trusted IPSet Modified severity high T1685

DeleteDetector

3 detection rules reference this event. View event page.

Sigma (1)

AWS GuardDuty Detector Deleted Or Updated severity high T1685, T1685.002

Elastic (1)

AWS GuardDuty Detector Deletion severity high T1685

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002

DeleteInvitations

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DeleteMembers

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DeletePublishingDestination

1 detection rules reference this event. View event page.

YARA-L (1)

AWS GuardDuty Publishing Destination Deleted severity high T1685

DeleteThreatIntelSet

1 detection rules reference this event. View event page.

YARA-L (1)

AWS GuardDuty Trusted Or Threat IP Lists Tampered severity high T1685

DisassociateFromAdministratorAccount

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

DisassociateMembers

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

StopMonitoringMembers

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Member Account Manipulation severity high T1685

UpdateDetector

5 detection rules reference this event. View event page.

Sigma (1)

AWS GuardDuty Detector Deleted Or Updated severity high T1685, T1685.002

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Kusto (1)

AWSCloudTrail - AWS GuardDuty detector disabled or suspended severity high T1685

YARA-L (1)

AWS GuardDuty Disabled severity high T1685

Panther (1)

Account Security Configuration Changed severity medium T1685

UpdateThreatIntelSet

2 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

YARA-L (1)

AWS GuardDuty Trusted Or Threat IP Lists Tampered severity high T1685

ArchiveFindings

1 detection rules reference this event. View event page.

Panther (1)

AWS Macie Disabled/Updated severity medium T1685

CreateThreatIntelSet

1 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

DeleteIPSet

1 detection rules reference this event. View event page.

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002

UpdateIPSet

2 detection rules reference this event. View event page.

Elastic (1)

AWS GuardDuty Detection Suppression severity high T1685

Panther (1)

AWS Trusted IPSet Modified severity high T1685