Amazon Security Lake - CloudTrail - Successful API Operation "" by user . · api.response.error = null, api.operation = \.*

Description

Amazon Security Lake - CloudTrail - Successful API Operation "$(api.operation)" by user $(identity.user.name).

Query · wazuh

field api.response.error="null" AND field api.operation="\.*" AND field identity.user.name="null" AND field src_endpoint.ip="null"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 99000 Amazon Security Lake rules grouped. anchor level 0
    decoded_as=json AND field activity_id="\.+" AND field category_uid="\.+"
  2. 99001 Amazon Security Lake - CloudTrail rules grouped. anchor level 3
    field metadata.product.name="CloudTrail"
  3. 99025 Amazon Security Lake - CloudTrail - Successful API Operation "" by user . · api.response.error = null, api.operation = \.* anchor level 3 this rule
    field api.response.error="null" AND field api.operation="\.*" AND field identity.user.name="null" AND field src_endpoint.ip="null"

Rule dependencies

Depends on

Raw source Amazon Security Lake - CloudTrail - Successful API Operation "" by user . · api.response.error = null, api.operation = \.* · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="99025" level="3">
    <if_sid>99001</if_sid>
    <field name="api.response.error">null</field>
    <field name="api.operation">\.*</field>
    <field name="identity.user.name" negate="yes">null</field>
    <field name="src_endpoint.ip">null</field>
    <description>Amazon Security Lake - CloudTrail - Successful API Operation "$(api.operation)" by user $(identity.user.name).</description>
    <mitre>
      <id>T1098.003</id>
      <id>T1078.004</id>
    </mitre>
    <group>asl_api_operation,asl_cloudtrail,gdpr_IV_32.2,gdpr_IV_35.7.d,hipaa_164.312.b,nist_800_53_AC.7,nist_800_53_AU.14,nist_800_53_AU.6,pci_dss_10.2.4,pci_dss_10.2.5,pci_dss_10.6.1,tsc_CC6.1,tsc_CC6.8,tsc_CC7.2,tsc_CC7.3,</group>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.