sigma-rules

Files

T

History

Mika Ayenson, PhD 4e1c8f677c [Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

Resolves #5202
Resolves #5203
Resolves #5204

The gen_ai.policy.action field is an array, so an additional mv_expand
is necessary for the rules to work correctly with AWS Bedrock integration
events that contain multiple policy actions.

Updated rules:
- Unusual High Word Policy Blocks Detected
- Unusual High Denied Topic Blocks Detected
- Unusual High Denied Sensitive Information Policy Blocks Detected
- Unusual High Confidence Content Filter Blocks Detected
- AWS Bedrock Guardrails Detected Multiple Policy Violations Within a Single Blocked Request

Co-authored-by: shashank-elastic <91139415+shashank-elastic@users.noreply.github.com>

2025-11-11 07:37:40 +05:30

aws_bedrock_execution_without_guardrails.toml

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )

2025-09-30 00:36:29 -04:00

aws_bedrock_guardrails_multiple_violations_by_single_user.toml

[Rule Tuning] Updated ESQL Rules Based on Validation Results (#5151 )

2025-09-30 00:36:29 -04:00

aws_bedrock_guardrails_multiple_violations_in_single_request.toml

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )

2025-11-11 07:37:40 +05:30

aws_bedrock_high_confidence_misconduct_blocks_detected.toml

[Tuning] Add mv_expand for gen_ai.policy.action field (#5296 )