Anvilogic high experimental other

AWS Add role to instance profile [snowflake-awscloudtrail]

This use case looks for when a role has been added to an instance profile.

View Source

Detection Logic

select * from awscloudtrail where event_time > dateadd(hour, -2, sysdate()) and event_name = 'AddRoleToInstanceProfile'

Field Validations

Loading…

Comments (0)

Loading comments...