paulmataruso/main
1
0
Fork 0
mirror of https://github.com/socfortress/Wazuh-Rules.git synced 2025-10-23 00:02:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create 100030-amazon_aws_cloudwatch.xml

Browse Source
This commit is contained in:
taylor_socfortress
2024-12-11 08:04:51 -06:00
committed by GitHub
parent 186107bf47
commit ceaff9522b
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
AWS/100030-amazon_aws_cloudwatch.xml Normal file
View File

@@ -0,0 +1,15 @@
<group name="amazon,aws,cloudwatch,">
<rule id="100030" level="3">
<decoded_as>json</decoded_as>
<location>Wazuh-AWS$</location>
<options>no_full_log</options>
<description>Wazuh AWS Integration</description>
</rule>
<rule id="100031" level="3">
<if_sid>100030</if_sid>
<field name="httpSourceName">^ALB$</field>
<options>no_full_log</options>
<description>AWS WAF Event - WAF Action $(action) By Rule Type: $(terminatingRuleType)</description>
<group>awswaf,</group>
</rule>
</group>