Échangeons
← Sentinel Explorer
↳ Source GitHubConnecteur

Amazon Web Services

Voir sur GitHub ↗Fichier original ↗

Description

Follow these instructions to connect to AWS and stream your CloudTrail logs into Microsoft Sentinel. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/p/?linkid=2218883&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).
Statut déclaré
2
Auteur / éditeur déclaré
Amazon

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Types de données

AWSCloudTrail

Permissions déclarées

write permission.
Workspace
Workspace

Instructions du connecteur

Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.

Connect AWS cloud trail with Microsoft Sentinel​
The connection necessitates giving Microsoft permissions to access your AWS account. To enable this, follow the instructions under [Connect AWS to Microsoft Sentinel](https://aka.ms/AWSConnector) and use these parameters when prompted: > Data from all regions will be sent to and stored in the workspace's region. > It takes about 5 minutes until the connection streams data to your workspace.
Microsoft account ID
External ID (Workspace ID)
The integration is applicable for AWS public cloud accounts.

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques75
AWSCloudTrail - Amazon ECR image scanning disabledMediumAWSCloudTrail - AWS GuardDuty detector disabled or suspendedHighAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - CloudFormation policy created then used for privilege escalationHighAWSCloudTrail - Created CRUD S3 policy and then privilege escalationMediumAWSCloudTrail - Creating keys with encrypt policy without MFAMediumAWSCloudTrail - Creation of Access Key for IAM UserMediumAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of DataPipeline policy and then privilege escalationHighAWSCloudTrail - Creation of EC2 policy and then privilege escalationHighAWSCloudTrail - Creation of Glue policy and then privilege escalationMediumAWSCloudTrail - Creation of Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalationMediumAWSCloudTrail - Creation of SSM policy and then privilege escalationMediumAWSCloudTrail - EC2 Startup Shell Script ChangedMediumAWSCloudTrail - ECR image scan findings high or criticalHighAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - Network ACL with all the open ports to a specified CIDRHighAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Policy version set to defaultMediumAWSCloudTrail - Privilege escalation via CloudFormation policyMediumAWSCloudTrail - Privilege escalation via CRUD DynamoDB policyMediumAWSCloudTrail - Privilege escalation via CRUD IAM policyMediumAWSCloudTrail - Privilege escalation via CRUD KMS policyMediumAWSCloudTrail - Privilege escalation via CRUD Lambda policyMediumAWSCloudTrail - Privilege escalation via CRUD S3 policyMediumAWSCloudTrail - Privilege escalation via DataPipeline policyMediumAWSCloudTrail - Privilege escalation via EC2 policyMediumAWSCloudTrail - Privilege escalation via Glue policyMediumAWSCloudTrail - Privilege escalation via Lambda policyMediumAWSCloudTrail - Privilege escalation via SSM policyMediumAWSCloudTrail - Privilege escalation with admin managed policyMediumAWSCloudTrail - Privilege escalation with AdministratorAccess managed policyMediumAWSCloudTrail - Privilege escalation with FullAccess managed policyMediumAWSCloudTrail - RDS instance publicly exposedMediumAWSCloudTrail - S3 bucket access point publicly exposedMediumAWSCloudTrail - S3 bucket exposed via ACLMediumAWSCloudTrail - S3 bucket exposed via policyMediumAWSCloudTrail - S3 bucket suspicious ransomware activityHighAWSCloudTrail - S3 Object Exfiltration from Anonymous UserMediumAWSCloudTrail - S3 object publicly exposedMediumAWSCloudTrail - SAML update identity providerHighAWSCloudTrail - SSM document is publicly exposedMediumAWSCloudTrail - Successful API executed from a Tor exit nodeHighAWSCloudTrail - Successful brute force attack on S3 BucketHighAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSCloudTrail - Suspicious AWS CLI Command ExecutionMediumAWSCloudTrail - Suspicious AWS EC2 Compute Resource DeploymentsMediumAWSCloudTrail - Suspicious command sent to EC2HighAWSCloudTrail - Suspicious overly permissive KMS key policy createdHighAWSCloudTrail - Unauthorized EC2 Instance Setup AttemptMediumAWSCloudTrail - User IAM EnumerationMediumCross-Cloud Password Spray detectionMediumFailed AWS Console logons but success logon to AzureADMediumFailed AzureAD logons but success logon to AWS ConsoleMediumHigh-Risk Cross-Cloud User ImpersonationMediumLog4j vulnerability exploit aka Log4Shell IP IOCHighMalformed user agentMediumMulti-Factor Authentication Disabled for a UserMediumNew UserAgent observed in last 24 hoursLowSuccessful AWS Console Login from IP Address Observed Conducting Password SprayMediumSuspicious access of BEC related documents in AWS S3 bucketsMediumSuspicious AWS console logins by credential access alertsMediumTI Map IP entity to AWSCloudTrailMediumTI map IP entity to AWSCloudTrailMediumUser agent search for log4j exploitation attemptHighUser impersonation by Identity Protection alertsMedium
Solutions5
Workbooks2

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
AWS
Autres fichiers source 2Solutions/Amazon Web Services/Data Connectors/template_AWS.jsonsource ↗Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-membership ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.