SIGNAL - AWS Console SSO Sign-In

Query · python

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com" and event.get("eventName") == "Authenticate"
    )
Raw source SIGNAL - AWS Console SSO Sign-In · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Filename: aws_console_signin.py
RuleID: "AWS.Console.Sign-In"
DisplayName: "SIGNAL - AWS Console SSO Sign-In"
Enabled: true
CreateAlert: false
LogTypes:
    - AWS.CloudTrail
Severity: Info
DedupPeriodMinutes: 60
Threshold: 1
Tests:
    - Name: Test-94439c
      ExpectedResult: true
      Log:
        awsRegion: us-east-1
        eventCategory: Management
        eventID: 8cb05708-9764-4774-a048-59a4c8e1684d
        eventName: Authenticate
        eventSource: sso.amazonaws.com
        eventTime: "2024-06-03 15:23:22.000000000"
        eventType: AwsServiceEvent
        eventVersion: "1.08"
        managementEvent: true


# ------ paired body: aws_console_signin.py ------

def rule(event):
    return (
        event.get("eventSource") == "sso.amazonaws.com" and event.get("eventName") == "Authenticate"
    )

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.