Skip to content

Commit aa3187d

Browse files
pyth0n1cpyth0n1c
authored
Merge branch 'develop' into remove_v5.4.0
2 parents 5fb9234 + a62ab6a commit aa3187d

11 files changed

+945
-0
lines changed

‎data_sources/aws_cloudtrail_deleteguardrail.yml‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: AWS CloudTrail DeleteGuardrail
2+
id: 2f6e9d7a-1c53-48b1-be57-33a91e0f8c42
3+
version: 1
4+
date: '2023-10-15'
5+
author: Bhavin Patel, Splunk
6+
description: Logs an event when a guardrail is deleted within the AWS CloudTrail.
7+
mitre_components:
8+
- Cloud Service Modification
9+
source: aws_cloudtrail
10+
sourcetype: aws:cloudtrail
11+
separator: eventName
12+
separator_value: DeleteGuardrail
13+
supported_TA:
14+
- name: Splunk Add-on for AWS
15+
url: https://splunkbase.splunk.com/app/1876
16+
version: 7.9.1
17+
fields:
18+
- _time
19+
- action
20+
- app
21+
- awsRegion
22+
- aws_account_id
23+
- change_type
24+
- command
25+
- date_hour
26+
- date_mday
27+
- date_minute
28+
- date_month
29+
- date_second
30+
- date_wday
31+
- date_year
32+
- date_zone
33+
- direction
34+
- dvc
35+
- errorCode
36+
- eventCategory
37+
- eventID
38+
- eventName
39+
- eventSource
40+
- eventTime
41+
- eventType
42+
- eventVersion
43+
- eventtype
44+
- host
45+
- index
46+
- linecount
47+
- managementEvent
48+
- msg
49+
- object_category
50+
- product
51+
- protocol
52+
- protocol_code
53+
- punct
54+
- readOnly
55+
- recipientAccountId
56+
- region
57+
- requestID
58+
- requestParameters.guardrailId
59+
- responseElements.requestId
60+
- signature
61+
- source
62+
- sourceIPAddress
63+
- sourcetype
64+
- splunk_server
65+
- src
66+
- src_ip
67+
- src_ip_range
68+
- start_time
69+
- status
70+
- tag
71+
- tag::eventtype
72+
- timeendpos
73+
- timestartpos
74+
- user
75+
- userAgent
76+
- userIdentity.accessKeyId
77+
- userIdentity.accountId
78+
- userIdentity.arn
79+
- userIdentity.principalId
80+
- userIdentity.sessionContext.attributes.creationDate
81+
- userIdentity.sessionContext.attributes.mfaAuthenticated
82+
- userIdentity.sessionContext.sessionIssuer.accountId
83+
- userIdentity.sessionContext.sessionIssuer.arn
84+
- userIdentity.sessionContext.sessionIssuer.principalId
85+
- userIdentity.sessionContext.sessionIssuer.type
86+
- userIdentity.sessionContext.sessionIssuer.userName
87+
- userIdentity.type
88+
- userName
89+
- user_access_key
90+
- user_agent
91+
- user_arn
92+
- user_group_id
93+
- user_id
94+
- user_name
95+
- user_type
96+
- vendor
97+
- vendor_account
98+
- vendor_product
99+
- vendor_region
100+
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId":
101+
"AROAIJIESMXKGCJRCTPR6:[email protected]", "arn": "arn:aws:sts::111111111111:assumed-role/admin_role/[email protected]",
102+
"accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLXXXXXXXX", "sessionContext":
103+
{"sessionIssuer": {"type": "Role", "principalId": "AROAIJIESMXKGCJRCTPR6", "arn":
104+
"arn:aws:iam::111111111111:role/admin_role", "accountId": "111111111111", "userName":
105+
"admin_role"}, "webIdFederationData": {}, "attributes": {"mfaAuthenticated":
106+
"false", "creationDate": "2023-10-15T08:36:15Z"}}}, "eventTime": "2023-10-15T08:49:49Z",
107+
"eventSource": "bedrock.amazonaws.com", "eventName": "DeleteGuardrail", "awsRegion":
108+
"us-east-1", "sourceIPAddress": "192.0.2.1", "userAgent": "aws-cli/2.9.15",
109+
"requestParameters": {"guardrailId": "grail-12345abcdef"},
110+
"responseElements": {"requestId": "97b40da9-9291-4a92-8e9e-892b6887ffc9"},
111+
"requestID": "97b40da9-9291-4a92-8e9e-892b6887ffc9", "eventID":
112+
"46fe04b8-d007-4933-8bb8-c8b65c1121fa", "readOnly": false, "eventType": "AwsApiCall",
113+
"managementEvent": true, "eventCategory": "Management", "recipientAccountId": "111111111111"}'
114+
output_fields:
115+
- dest
116+
- user
117+
- user_agent
118+
- src
119+
- vendor_account
120+
- vendor_region
121+
- vendor_product

‎data_sources/aws_cloudtrail_deleteknowledgebase.yml‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
name: AWS CloudTrail DeleteKnowledgeBase
2+
id: a8c47f25-5693-4d1a-9f8b-6e94d15ac2d9
3+
version: 1
4+
date: '2023-10-15'
5+
author: Bhavin Patel, Splunk
6+
description: Logs an event when a knowledge base is deleted within the AWS CloudTrail.
7+
mitre_components:
8+
- Cloud Service Modification
9+
source: aws_cloudtrail
10+
sourcetype: aws:cloudtrail
11+
separator: eventName
12+
separator_value: DeleteKnowledgeBase
13+
supported_TA:
14+
- name: Splunk Add-on for AWS
15+
url: https://splunkbase.splunk.com/app/1876
16+
version: 7.9.1
17+
fields:
18+
- _time
19+
- action
20+
- app
21+
- awsRegion
22+
- aws_account_id
23+
- change_type
24+
- command
25+
- date_hour
26+
- date_mday
27+
- date_minute
28+
- date_month
29+
- date_second
30+
- date_wday
31+
- date_year
32+
- date_zone
33+
- direction
34+
- dvc
35+
- errorCode
36+
- eventCategory
37+
- eventID
38+
- eventName
39+
- eventSource
40+
- eventTime
41+
- eventType
42+
- eventVersion
43+
- eventtype
44+
- host
45+
- index
46+
- linecount
47+
- managementEvent
48+
- msg
49+
- object_category
50+
- product
51+
- protocol
52+
- protocol_code
53+
- punct
54+
- readOnly
55+
- recipientAccountId
56+
- region
57+
- requestID
58+
- requestParameters.knowledgeBaseId
59+
- responseElements.requestId
60+
- signature
61+
- source
62+
- sourceIPAddress
63+
- sourcetype
64+
- splunk_server
65+
- src
66+
- src_ip
67+
- src_ip_range
68+
- start_time
69+
- status
70+
- tag
71+
- tag::eventtype
72+
- timeendpos
73+
- timestartpos
74+
- user
75+
- userAgent
76+
- userIdentity.accessKeyId
77+
- userIdentity.accountId
78+
- userIdentity.arn
79+
- userIdentity.principalId
80+
- userIdentity.sessionContext.attributes.creationDate
81+
- userIdentity.sessionContext.attributes.mfaAuthenticated
82+
- userIdentity.sessionContext.sessionIssuer.accountId
83+
- userIdentity.sessionContext.sessionIssuer.arn
84+
- userIdentity.sessionContext.sessionIssuer.principalId
85+
- userIdentity.sessionContext.sessionIssuer.type
86+
- userIdentity.sessionContext.sessionIssuer.userName
87+
- userIdentity.type
88+
- userName
89+
- user_access_key
90+
- user_agent
91+
- user_arn
92+
- user_group_id
93+
- user_id
94+
- user_name
95+
- user_type
96+
- vendor
97+
- vendor_account
98+
- vendor_product
99+
- vendor_region
100+
example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "AssumedRole", "principalId": "AROA:[email protected]", "arn": "arn:aws:sts::111111111:assumed-role/daftpunk/[email protected]", "accountId": "111111111", "accessKeyId": "ASIAYTOGP2RLLIVGGYLX", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROA", "arn": "arn:aws:iam::111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/daftpunk", "accountId": "111111111", "userName": "daftpunk"}, "attributes": {"creationDate": "2025-04-03T21:50:08Z", "mfaAuthenticated": "false"}}}, "eventTime": "2025-04-03T23:49:06Z", "eventSource": "bedrock.amazonaws.com", "eventName": "DeleteKnowledgeBase", "awsRegion": "us-west-2", "sourceIPAddress": "23.93.242.200", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36", "requestParameters": {"knowledgeBaseId": "T9PFUXGAPO"}, "responseElements": {"Access-Control-Expose-Headers": "x-amzn-Apigw-id,x-amzn-ErrorMessage,x-amzn-RequestId,x-amzn-ErrorType,x-amzn-Trace-id,refreshtoken,Date", "knowledgeBaseId": "T9PFUXGAPO", "status": "DELETING"}, "requestID": "9dfbaf92-e781-4837-ad53-d72e20be1ac2", "eventID": "bff5a344-3908-41f0-bb57-d57a01014ff3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111", "eventCategory": "Management"}'
101+
output_fields:
102+
- dest
103+
- user
104+
- user_agent
105+
- src
106+
- vendor_account
107+
- vendor_region
108+
- vendor_product

‎data_sources/aws_cloudtrail_deletemodelinvocationloggingconfiguration.yml‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
name: AWS CloudTrail DeleteModelInvocationLoggingConfiguration
2+
id: fe2b3a52-1c8d-4e17-9f74-76c531a87e21
3+
version: 1
4+
date: '2023-10-15'
5+
author: Bhavin Patel, Splunk
6+
description: Logs an event when a model invocation logging configuration is deleted within the AWS CloudTrail.
7+
mitre_components:
8+
- Cloud Service Modification
9+
source: aws_cloudtrail
10+
sourcetype: aws:cloudtrail
11+
separator: eventName
12+
separator_value: DeleteModelInvocationLoggingConfiguration
13+
supported_TA:
14+
- name: Splunk Add-on for AWS
15+
url: https://splunkbase.splunk.com/app/1876
16+
version: 7.9.1
17+
fields:
18+
- _time
19+
- action
20+
- app
21+
- authentication_method
22+
- awsRegion
23+
- aws_account_id
24+
- change_type
25+
- command
26+
- date_hour
27+
- date_mday
28+
- date_minute
29+
- date_month
30+
- date_second
31+
- date_wday
32+
- date_year
33+
- date_zone
34+
- desc
35+
- dest
36+
- dest_ip_range
37+
- dest_port_range
38+
- direction
39+
- dvc
40+
- errorCode
41+
- errorMessage
42+
- eventCategory
43+
- eventID
44+
- eventName
45+
- eventSource
46+
- eventTime
47+
- eventType
48+
- eventVersion
49+
- eventtype
50+
- host
51+
- image_id
52+
- index
53+
- instance_type
54+
- linecount
55+
- managementEvent
56+
- msg
57+
- object
58+
- object_attrs
59+
- object_category
60+
- object_id
61+
- object_path
62+
- product
63+
- protocol
64+
- protocol_code
65+
- punct
66+
- readOnly
67+
- reason
68+
- recipientAccountId
69+
- region
70+
- requestID
71+
- requestParameters
72+
- responseElements
73+
- result
74+
- result_id
75+
- rule_action
76+
- signature
77+
- source
78+
- sourceIPAddress
79+
- sourcetype
80+
- splunk_server
81+
- splunk_server_group
82+
- src
83+
- src_ip
84+
- src_ip_range
85+
- src_port_range
86+
- src_user
87+
- src_user_id
88+
- src_user_name
89+
- src_user_role
90+
- src_user_type
91+
- start_time
92+
- status
93+
- tag
94+
- tag::action
95+
- tag::eventtype
96+
- tag::object_category
97+
- temp_access_key
98+
- timeendpos
99+
- timestartpos
100+
- tlsDetails.cipherSuite
101+
- tlsDetails.clientProvidedHostHeader
102+
- tlsDetails.tlsVersion
103+
- user
104+
- userAgent
105+
- userIdentity.accessKeyId
106+
- userIdentity.accountId
107+
- userIdentity.arn
108+
- userIdentity.principalId
109+
- userIdentity.type
110+
- userIdentity.userName
111+
- userName
112+
- user_access_key
113+
- user_agent
114+
- user_arn
115+
- user_group_id
116+
- user_id
117+
- user_name
118+
- user_role
119+
- user_type
120+
- vendor
121+
- vendor_account
122+
- vendor_product
123+
- vendor_region
124+
example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "IAMUser", "principalId": "AAAAAAA", "arn": "arn:aws:iam::111111111111:user/daftpunk", "accountId": "111111111111", "accessKeyId": "AKIAAAAAAAA", "userName": "daftpunk"}, "eventTime": "2025-04-03T17:16:02Z", "eventSource": "bedrock.amazonaws.com", "eventName": "DeleteModelInvocationLoggingConfiguration", "awsRegion": "us-west-2", "sourceIPAddress": "23.93.242.200", "userAgent": "aws-cli/2.24.22 md/awscrt#0.23.8 ua/2.1 os/macos#24.3.0 md/arch#arm64 lang/python#3.12.9 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#bedrock.delete-model-invocation-logging-configuration", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::111111111111:user/daftpunk is not authorized to perform: bedrock:DeleteModelInvocationLoggingConfiguration because no identity-based policy allows the bedrock:DeleteModelInvocationLoggingConfiguration action", "requestParameters": null, "responseElements": null, "requestID": "11519ac6-2761-4434-813a-585547a59096", "eventID": "1f7bd76f-13fb-4dff-b9bb-95a466217721", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "bedrock.us-west-2.amazonaws.com"}}'
125+
output_fields:
126+
- dest
127+
- user
128+
- user_agent
129+
- src
130+
- vendor_account
131+
- vendor_region
132+
- vendor_product

0 commit comments

Comments
 (0)