Detection rules › By event

AWS-logs

Event	Rules
DeleteLogGroup	5
DeleteLogStream	2

DeleteLogGroup

5 detection rules reference this event. View event page.

Elastic (1)

AWS CloudWatch Log Group Deletion severity medium T1485, T1685, T1685.002

Splunk (2)

ASL AWS Defense Evasion Delete CloudWatch Log Group severity medium T1685, T1685.002
AWS Defense Evasion Delete CloudWatch Log Group severity medium T1685, T1685.002

Kusto (1)

AWSCloudTrail - Tampering to AWS CloudTrail logs severity high T1685, T1685.002

YARA-L (1)

AWS Delete CloudWatch Log Group severity high T1685, T1685.002

DeleteLogStream

2 detection rules reference this event. View event page.

Elastic (1)

AWS CloudWatch Log Stream Deletion severity medium T1485, T1685, T1685.002

Splunk (1)

ASL AWS Defense Evasion Impair Security Services T1685, T1685.002