Terrance DeJesus
38e0f13e23
* new rule 'First Occurrence of User Identity Sending Requests to EC2 Instance' * updated description and name * added investigation guide; adjusted description * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com> * updated query logic * fixed spacing issue * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml * Update rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml --------- Co-authored-by: Isai <59296946+imays11@users.noreply.github.com> Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>