Échangeons
← Sentinel Explorer
↳ Source GitHubSolution

Amazon Web Services

Voir sur GitHub ↗Fichier original ↗

Description

The Amazon Web Services solution for Microsoft Sentinel allows you to enable Security monitoring of AWS services by allowing ingestion of logs from the AWS CloudTrail platform, VPC Flow Logs, AWS GuardDuty and AWS CloudWatch.
Version
3.0.12
Auteur / éditeur déclaré
Microsoft - support@microsoft.com
Niveau de support
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Connecteurs

AWS

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques61
AWSCloudTrail - Amazon ECR image scanning disabledMediumAWSCloudTrail - AWS GuardDuty detector disabled or suspendedHighAWSCloudTrail - Changes to Amazon VPC settingsLowAWSCloudTrail - Changes to AWS Elastic Load Balancer security groupsLowAWSCloudTrail - Changes to AWS Security Group ingress and egress settingsLowAWSCloudTrail - Changes to internet facing AWS RDS Database instancesLowAWSCloudTrail - CloudFormation policy created then used for privilege escalationHighAWSCloudTrail - Created CRUD S3 policy and then privilege escalationMediumAWSCloudTrail - Creating keys with encrypt policy without MFAMediumAWSCloudTrail - Creation of Access Key for IAM UserMediumAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalationMediumAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of DataPipeline policy and then privilege escalationHighAWSCloudTrail - Creation of EC2 policy and then privilege escalationHighAWSCloudTrail - Creation of Glue policy and then privilege escalationMediumAWSCloudTrail - Creation of Lambda policy and then privilege escalationMediumAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalationMediumAWSCloudTrail - Creation of SSM policy and then privilege escalationMediumAWSCloudTrail - EC2 Startup Shell Script ChangedMediumAWSCloudTrail - ECR image scan findings high or criticalHighAWSCloudTrail - Failed Attempts to Change AWS CloudTrail LogsLowAWSCloudTrail - Full Admin policy created and then attached to Roles, Users or GroupsMediumAWSCloudTrail - Login to AWS Management Console without MFALowAWSCloudTrail - Monitor AWS Credential abuse or hijackingLowAWSCloudTrail - Network ACL with all the open ports to a specified CIDRHighAWSCloudTrail - NRT Login to AWS Management Console without MFALowAWSCloudTrail - Policy version set to defaultMediumAWSCloudTrail - Privilege escalation via CloudFormation policyMediumAWSCloudTrail - Privilege escalation via CRUD DynamoDB policyMediumAWSCloudTrail - Privilege escalation via CRUD IAM policyMediumAWSCloudTrail - Privilege escalation via CRUD KMS policyMediumAWSCloudTrail - Privilege escalation via CRUD Lambda policyMediumAWSCloudTrail - Privilege escalation via CRUD S3 policyMediumAWSCloudTrail - Privilege escalation via DataPipeline policyMediumAWSCloudTrail - Privilege escalation via EC2 policyMediumAWSCloudTrail - Privilege escalation via Glue policyMediumAWSCloudTrail - Privilege escalation via Lambda policyMediumAWSCloudTrail - Privilege escalation via SSM policyMediumAWSCloudTrail - Privilege escalation with admin managed policyMediumAWSCloudTrail - Privilege escalation with AdministratorAccess managed policyMediumAWSCloudTrail - Privilege escalation with FullAccess managed policyMediumAWSCloudTrail - RDS instance publicly exposedMediumAWSCloudTrail - S3 bucket access point publicly exposedMediumAWSCloudTrail - S3 bucket exposed via ACLMediumAWSCloudTrail - S3 bucket exposed via policyMediumAWSCloudTrail - S3 bucket suspicious ransomware activityHighAWSCloudTrail - S3 Object Exfiltration from Anonymous UserMediumAWSCloudTrail - S3 object publicly exposedMediumAWSCloudTrail - SAML update identity providerHighAWSCloudTrail - SSM document is publicly exposedMediumAWSCloudTrail - Successful API executed from a Tor exit nodeHighAWSCloudTrail - Successful brute force attack on S3 BucketHighAWSCloudTrail - Successful Tampering with AWS CloudTrail LogsHighAWSCloudTrail - Suspicious AWS CLI Command ExecutionMediumAWSCloudTrail - Suspicious AWS EC2 Compute Resource DeploymentsMediumAWSCloudTrail - Suspicious command sent to EC2HighAWSCloudTrail - Suspicious overly permissive KMS key policy createdHighAWSCloudTrail - Unauthorized EC2 Instance Setup AttemptMediumAWSCloudTrail - User IAM EnumerationMediumAWSGuardDuty - GuardDuty AlertMedium
Connecteurs3
Workbooks2

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
azure-sentinel-solution-amazonwebservices
Autres fichiers source 2Solutions/Amazon Web Services/Data/Solution_AmazonWebServices.jsonsolution-manifest ↗Solutions/Amazon Web Services/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.