AWS Console Login

Query · python

def rule(event):
    return event.get("eventName") == "ConsoleLogin"


def alert_context(event):
    context = {}
    context["ip_and_username"] = event.get(
        "sourceIPAddress", "<MISSING_SOURCE_IP>"
    ) + event.deep_get("userIdentity", "userName", default="<MISSING_USER_NAME>")
    return context
Raw source AWS Console Login · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_console_login.py
RuleID: "AWS.Console.Login"
DisplayName: "AWS Console Login"
Enabled: true
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
CreateAlert: false


# ------ paired body: aws_console_login.py ------

def rule(event):
    return event.get("eventName") == "ConsoleLogin"


def alert_context(event):
    context = {}
    context["ip_and_username"] = event.get(
        "sourceIPAddress", "<MISSING_SOURCE_IP>"
    ) + event.deep_get("userIdentity", "userName", default="<MISSING_USER_NAME>")
    return context

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.