AWS inspector - network assessment []: []. · aws.severity = Low

Description

AWS inspector - network assessment [$(aws.createdAt)]: $(aws.title) [$(aws.severity)].

Query · wazuh

field aws.severity="Low"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 80200 AWS alert. anchor level 0
    decoded_as=json AND field integration="aws"
  2. 80495 AWS inspector - network assessment []: []. · aws.source = inspector anchor level 0
    field aws.source="inspector"
  3. 80498 AWS inspector - network assessment []: []. · aws.severity = Low refinement level 4 this rule
    field aws.severity="Low"

Rule dependencies

Depends on

Raw source AWS inspector - network assessment []: []. · aws.severity = Low · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="80498" level="4">
    <if_sid>80495</if_sid>
    <field name="aws.severity">Low</field>
    <options>no_full_log</options>
    <description>AWS inspector - network assessment [$(aws.createdAt)]: $(aws.title) [$(aws.severity)].</description>
    <group>aws_inspector,</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.