detection.wiki

Detection rules › Panther

AWS CloudTrail 2-minute count

This is an enrichment or summary query that produces aggregate or lookup data for other rules to consume, not a standalone detection. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.

Source
github.com/panther-labs/panther-analysis

Rule body yaml

AnalysisType: scheduled_query
Enabled: false
Query: |-
  SELECT
    count(*) as num_logs, p_log_type
  FROM
    panther_logs.public.aws_cloudtrail
  WHERE
    p_occurs_since('5m')
  GROUP BY p_log_type
QueryName: "AWS CloudTrail 2-minute count"
Schedule:
  RateMinutes: 2
  TimeoutMinutes: 1

Detection logic

Stage 1: source

panther_logs.public.aws_cloudtrail

Stage 2: filter

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

FieldSource
num_logscount ( * )
p_log_type