The resource was newly discovered. AWS config - history: [ ] []: (). · aws.configurationItemStatus = ResourceDiscovered

Description

The resource was newly discovered. AWS config - history: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)).

Query · wazuh

field aws.configurationItemStatus="ResourceDiscovered"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 80200 AWS alert. anchor level 0
    decoded_as=json AND field integration="aws"
  2. 80450 AWS config alert. anchor level 0
    field aws.source="config"
  3. 80451 AWS config - history. anchor level 0
    field aws.log_info.log_file="\.+ConfigHistory"
  4. 80454 The resource was newly discovered. AWS config - history: [ ] []: (). · aws.configurationItemStatus = ResourceDiscovered refinement level 3 this rule
    field aws.configurationItemStatus="ResourceDiscovered"

Rule dependencies

Depends on

Raw source The resource was newly discovered. AWS config - history: [ ] []: (). · aws.configurationItemStatus = ResourceDiscovered · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="80454" level="3">
    <if_sid>80451</if_sid>
    <field name="aws.configurationItemStatus">ResourceDiscovered</field>
    <options>no_full_log</options>
    <description>The resource was newly discovered. AWS config - history:  [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)).</description>
    <group>aws_config,aws_config_history,</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.