Detection rules › By event

AWS-wafv2

Event	Rules
DeleteIPSet	1
DeleteRuleGroup	2
DeleteWebACL	2
UpdateIPSet	1
CreateIPSet	1
DeleteLoggingConfiguration	1

DeleteIPSet

1 detection rules reference this event. View event page.

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002

DeleteRuleGroup

2 detection rules reference this event. View event page.

Elastic (1)

AWS WAF Rule or Rule Group Deletion severity medium T1685, T1686.001

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002

DeleteWebACL

2 detection rules reference this event. View event page.

Elastic (1)

AWS WAF Access Control List Deletion severity medium T1685, T1686.001

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002

UpdateIPSet

1 detection rules reference this event. View event page.

Panther (1)

AWS Trusted IPSet Modified severity high T1685

CreateIPSet

1 detection rules reference this event. View event page.

Panther (1)

AWS Trusted IPSet Modified severity high T1685

DeleteLoggingConfiguration

1 detection rules reference this event. View event page.

Splunk (1)

AWS Defense Evasion Impair Security Services severity medium T1685, T1685.002