{ "Name": "Amazon Web Services", "Author": "Microsoft - support@microsoft.com", "Logo": "", "Description": "The Amazon Web Services solution for Microsoft Sentinel allows you to enable Security monitoring of AWS services by allowing ingestion of logs from the AWS CloudTrail platform, VPC Flow Logs, AWS GuardDuty and AWS CloudWatch. ", "Data Connectors": [ "Data Connectors/template_AWS.JSON", "Data Connectors/template_AwsS3.JSON", "Data Connectors/AWS_WAF_CCP/AwsS3_WAF_DataConnectorDefinition.json" ], "Workbooks": [ "Workbooks/AmazonWebServicesNetworkActivities.json", "Workbooks/AmazonWebServicesUserActivities.json" ], "Analytic Rules": [ "Analytic Rules/AWS_ChangeToRDSDatabase.yaml", "Analytic Rules/AWS_ChangeToVPC.yaml", "Analytic Rules/AWS_ClearStopChangeTrailLogs.yaml", "Analytic Rules/AWS_ConsoleLogonWithoutMFA.yaml", "Analytic Rules/AWS_CredentialHijack.yaml", "Analytic Rules/AWS_FullAdminPolicyAttachedToRolesUsersGroups.yaml", "Analytic Rules/AWS_IngressEgressSecurityGroupChange.yaml", "Analytic Rules/AWS_LoadBalancerSecGroupChange.yaml", "Analytic Rules/NRT_AWS_ConsoleLogonWithoutMFA.yaml", "Analytic Rules/AWS_GuardDuty_template.yaml", "Analytic Rules/AWS_ECRContainerHigh.yaml", "Analytic Rules/AWS_SuspiciousCommandEC2.yaml", "Analytic Rules/AWS_APIfromTor.yaml", "Analytic Rules/AWS_GuardDutyDisabled.yaml", "Analytic Rules/AWS_CreatedCloudFormationPolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedCRUDDyanmoDBPolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedCRUDIAMtoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedCRUDKMSPolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedCRUDS3PolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedCRUDLambdaPolicytoPrivilegEscalation.yaml", "Analytic Rules/AWS_CreatedDataPipelinePolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedEC2PolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedGluePolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedLambdaPolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreatedSSMPolicytoPrivilegeEscalation.yaml", "Analytic Rules/AWS_CreationofEncryptKeysWithoutMFA.yaml", "Analytic Rules/AWS_EC2StartupShellScriptChanged.yaml", "Analytic Rules/AWS_S3ObjectExfiltrationByAnonymousUser.yaml", "Analytic Rules/AWS_ECRImageScanningDisabled.yaml", "Analytic Rules/AWS_LogTampering.yaml", "Analytic Rules/AWS_NetworkACLOpenToAllPorts.yaml", "Analytic Rules/AWS_OverlyPermessiveKMS.yaml", "Analytic Rules/AWS_PrivilegeEscalationAdministratorAccessManagedPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationAdminManagedPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationFullAccessManagedPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaCloudFormationPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationviaCRUDDynamoDB.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaCRUDIAMPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaCRUDKMSPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaCRUDLambdaPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaCRUDS3Policy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaDataPipeline.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaEC2Policy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaGluePolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaLambdaPolicy.yaml", "Analytic Rules/AWS_PrivilegeEscalationViaSSM.yaml", "Analytic Rules/AWS_RDSInstancePubliclyExposed.yaml", "Analytic Rules/AWS_S3BruteForce.yaml", "Analytic Rules/AWS_S3BucketAccessPointExposed.yaml", "Analytic Rules/AWS_S3BucketExposedviaACL.yaml", "Analytic Rules/AWS_S3BucketExposedviaPolicy.yaml", "Analytic Rules/AWS_S3ObjectPubliclyExposed.yaml", "Analytic Rules/AWS_S3Ransomware.yaml", "Analytic Rules/AWS_SAMLUpdateIdentity.yaml", "Analytic Rules/AWS_SetDefaulyPolicyVersion.yaml", "Analytic Rules/AWS_SSMPubliclyExposed.yaml", "Analytic Rules/SuspiciousAWSCLICommandExecution.yaml", "Analytic Rules/SuspiciousAWSEC2ComputeResourceDeployments.yaml", "Analytic Rules/AWS_UserAccessKeyCreated.yaml", "Analytic Rules/AWS_UserIAMEnumeration.yaml", "Analytic Rules/AWS_UnauthorizedInstanceSetUpAttempt.yaml" ], "Hunting Queries": [ "Hunting Queries/AWS_IAM_PolicyChange.yaml", "Hunting Queries/AWS_IAM_PrivilegeEscalationbyAttachment.yaml", "Hunting Queries/AWS_PrivilegedRoleAttachedToInstance.yaml", "Hunting Queries/AWS_SuspiciousCredentialTokenAccessOfValid_IAM_Roles.yaml", "Hunting Queries/AWS_Unused_UnsupportedCloudRegions.yaml", "Hunting Queries/AWS_EC2_WithoutKeyPair.yaml", "Hunting Queries/AWS_AssumeRoleBruteForce.yaml", "Hunting Queries/AWS_BucketVersioningSuspended.yaml", "Hunting Queries/AWS_CreateAccessKey.yaml", "Hunting Queries/AWS_CreateLoginProfile.yaml", "Hunting Queries/AWS_ECRContainerLow.yaml", "Hunting Queries/AWS_ECRContainerMedium.yaml", "Hunting Queries/AWS_ExcessiveExecutionofDiscoveryEvents.yaml", "Hunting Queries/AWS_FailedBruteForceS3Bucket.yaml", "Hunting Queries/AWS_FailedBruteForceWithoutMFA.yaml", "Hunting Queries/AWS_IAMAccsesDeniedDiscoveryEvents.yaml", "Hunting Queries/AWS_IAMUserGroupChanges.yaml", "Hunting Queries/AWS_LambdaFunctionThrottled.yaml", "Hunting Queries/AWS_LambdaLayerImportedExternalAccount.yaml", "Hunting Queries/AWS_LambdaUpdateFunctionCode.yaml", "Hunting Queries/AWS_LoginProfileUpdated.yaml", "Hunting Queries/AWS_ModificationofRouteTableAttributes.yaml", "Hunting Queries/AWS_ModificationofSubnetAttributes.yaml", "Hunting Queries/AWS_ModificationofVPCAttributes.yaml", "Hunting Queries/AWS_NetworkACLDeleted.yaml", "Hunting Queries/AWS_NewRootAccessKey.yaml", "Hunting Queries/AWS_PolicywithExcessivePermissions.yaml", "Hunting Queries/AWS_RDSMasterPasswordChanged.yaml", "Hunting Queries/AWS_RiskyRoleName.yaml", "Hunting Queries/AWS_S3BucketDeleted.yaml", "Hunting Queries/AWS_S3BucketEncryptionModified.yaml", "Hunting Queries/AWS_STStoEC2.yaml", "Hunting Queries/AWS_STStoECS.yaml", "Hunting Queries/AWS_STStoGlue.yaml", "Hunting Queries/AWS_STStoKWN.yaml", "Hunting Queries/AWS_STStoLambda.yaml" ], "BasePath": "C:\\One\\Azure\\Azure-Sentinel\\Solutions\\Amazon Web Services", "Version": "3.0.12", "Metadata": "SolutionMetadata.json", "TemplateSpec": true, "StaticDataConnectorIds": [ "AWS" ] }