Isai
926befff83
* [Rule Tuning] AWS Access Token Used from Multiple Addresses Summary Tuning changes to reduce noise and improve fidelity for the AWS Access Token Used from Multiple Addresses rule. After several tuning this rule is still producing ~2000 alerts/day - Added aws.cloudtrail.session_credential_from_console exclusion to filter out legitimate console login sessions - Added Esql.event_provider_count_distinct > 1 condition requiring activity across multiple AWS services to reduce single-service noise - Changed interval from 5m to 30m to reduce alert frequency - Updated query time window from 30 minutes to 32 minutes to align with the from setting - Added min_stack_version = "9.2.0" for the new console credential field (AWS integration 4.6.0+) Rational - Console login sessions generate temporary credentials that can appear from multiple IPs during VPN/network transitions - Requiring activity across multiple AWS service providers increases confidence that the token is being used for broader reconnaissance rather than normal single-service operations - Longer interval reduces duplicate alerting per access token while still catching the behavior within the 32-minute aggregation window * Apply suggestions from code review * Update rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml * Update initial_access_iam_session_token_used_from_multiple_addresses.toml
rules/
Rules within this folder are organized by solution or platform. The structure is flattened out, because nested file hierarchies are hard to navigate and find what you're looking for. Each directory contains several .toml files, and the primary ATT&CK tactic is included in the file name when it's relevant (i.e. windows/execution_via_compiled_html_file.toml)
| folder | description |
|---|---|
. |
Root directory where rules are stored |
apm/ |
Rules that use Application Performance Monitoring (APM) data sources |
cross-platform/ |
Rules that apply to multiple platforms, such as Windows and Linux |
integrations/ |
Rules organized by Fleet integration |
linux/ |
Rules for Linux or other Unix based operating systems |
macos/ |
Rules for macOS |
ml/ |
Rules that use machine learning jobs (ML) |
network/ |
Rules that use network data sources |
promotions/ |
Rules that promote external alerts into detection engine alerts |
windows/ |
Rules for the Microsoft Windows Operating System |
Integration specific rules are stored in the integrations/ directory:
| folder | integration |
|---|---|
aws/ |
Amazon Web Services (AWS) |
azure/ |
Microsoft Azure |
cyberarkpas/ |
Cyber Ark Privileged Access Security |
endpoint/ |
Elastic Endpoint Security |
gcp/ |
Google Cloud Platform (GCP) |
google_workspace/ |
Google Workspace (formerly GSuite) |
o365/ |
Microsoft Office |
okta/ |
Okta |