AWS Cloudtrail: - . Error: . · aws.errorCode = \.+

Description

AWS Cloudtrail: $(aws.eventSource) - $(aws.eventName). Error: $(aws.errorCode).

Query · wazuh

field aws.errorCode="\.+"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 80200 AWS alert. anchor level 0
    decoded_as=json AND field integration="aws"
  2. 80202 AWS Cloudtrail: - . · aws.source = cloudtrail anchor level 3
    field aws.source="cloudtrail" AND list aws.eventName lookup=match_key etc/lists/amazon/aws-eventnames
  3. 80203 AWS Cloudtrail: - . Error: . · aws.errorCode = \.+ anchor level 4 this rule
    field aws.errorCode="\.+"

Refined by

1 rule chains off this one, narrowing it further.

Rule dependencies

Depends on

Raw source AWS Cloudtrail: - . Error: . · aws.errorCode = \.+ · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="80203" level="4">
    <if_sid>80202</if_sid>
    <field name="aws.errorCode">\.+</field>
    <options>no_full_log</options>
    <description>AWS Cloudtrail: $(aws.eventSource) - $(aws.eventName). Error: $(aws.errorCode).</description>
    <group>amazon-error,aws_cloudtrail,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AU.6,pci_dss_10.6.1,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.