Get in touch
← Sentinel Explorer
↳ GitHub sourceSolution

Amazon Web Services

View on GitHub ↗Original file ↗

Description

The Amazon Web Services solution for Microsoft Sentinel allows you to enable Security monitoring of AWS services by allowing ingestion of logs from the AWS CloudTrail platform, VPC Flow Logs, AWS GuardDuty and AWS CloudWatch.
Version
3.0.12
Declared author / publisher
Microsoft - support@microsoft.com
Support tier
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AWS

Related content

Links established from declared identifiers and solution manifests.

Analytics rules61
AWSCloudTrail - Amazon ECR image scanning disabledMediumAWSCloudTrail - AWS GuardDuty detector disabled or suspendedHighAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - CloudFormation policy created then used for privilege escalationHighAWSCloudTrail - Created CRUD S3 policy and then privilege escalationMediumAWSCloudTrail - Creating keys with encrypt policy without MFAMediumAWSCloudTrail - Creation of Access Key for IAM UserMediumAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of DataPipeline policy and then privilege escalationHighAWSCloudTrail - Creation of EC2 policy and then privilege escalationHighAWSCloudTrail - Creation of Glue policy and then privilege escalationMediumAWSCloudTrail - Creation of Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalationMediumAWSCloudTrail - Creation of SSM policy and then privilege escalationMediumAWSCloudTrail - EC2 Startup Shell Script ChangedMediumAWSCloudTrail - ECR image scan findings high or criticalHighAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - Network ACL with all the open ports to a specified CIDRHighAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Policy version set to defaultMediumAWSCloudTrail - Privilege escalation via CloudFormation policyMediumAWSCloudTrail - Privilege escalation via CRUD DynamoDB policyMediumAWSCloudTrail - Privilege escalation via CRUD IAM policyMediumAWSCloudTrail - Privilege escalation via CRUD KMS policyMediumAWSCloudTrail - Privilege escalation via CRUD Lambda policyMediumAWSCloudTrail - Privilege escalation via CRUD S3 policyMediumAWSCloudTrail - Privilege escalation via DataPipeline policyMediumAWSCloudTrail - Privilege escalation via EC2 policyMediumAWSCloudTrail - Privilege escalation via Glue policyMediumAWSCloudTrail - Privilege escalation via Lambda policyMediumAWSCloudTrail - Privilege escalation via SSM policyMediumAWSCloudTrail - Privilege escalation with admin managed policyMediumAWSCloudTrail - Privilege escalation with AdministratorAccess managed policyMediumAWSCloudTrail - Privilege escalation with FullAccess managed policyMediumAWSCloudTrail - RDS instance publicly exposedMediumAWSCloudTrail - S3 bucket access point publicly exposedMediumAWSCloudTrail - S3 bucket exposed via ACLMediumAWSCloudTrail - S3 bucket exposed via policyMediumAWSCloudTrail - S3 bucket suspicious ransomware activityHighAWSCloudTrail - S3 Object Exfiltration from Anonymous UserMediumAWSCloudTrail - S3 object publicly exposedMediumAWSCloudTrail - SAML update identity providerHighAWSCloudTrail - SSM document is publicly exposedMediumAWSCloudTrail - Successful API executed from a Tor exit nodeHighAWSCloudTrail - Successful brute force attack on S3 BucketHighAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSCloudTrail - Suspicious AWS CLI Command ExecutionMediumAWSCloudTrail - Suspicious AWS EC2 Compute Resource DeploymentsMediumAWSCloudTrail - Suspicious command sent to EC2HighAWSCloudTrail - Suspicious overly permissive KMS key policy createdHighAWSCloudTrail - Unauthorized EC2 Instance Setup AttemptMediumAWSCloudTrail - User IAM EnumerationMediumAWSGuardDuty - GuardDuty AlertMedium
Connectors3
Workbooks2

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
azure-sentinel-solution-amazonwebservices
Additional source files 2Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-manifest ↗Solutions/Amazon Web Services/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.