Elastic low stable kql

AWS Detective Graph Deleted

Detects the deletion of an Amazon Detective behavior graph via the DeleteGraph API. Amazon Detective automatically collects log data from AWS services and uses machine learning, statistical analysis, and graph theory to build an interactive model of resource behaviors and interactions. Deleting a behavior graph destroys its historical analysis data and removes the ability to investigate security incidents using Detective's relationship mapping. An attacker with sufficient IAM permissions may delete the Detective graph to impair forensic investigation of a compromise.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "detective.amazonaws.com"
    and event.action: "DeleteGraph"
    and event.outcome: "success"

False Positives

⚠ Legitimate decommissioning of an AWS account, regional consolidation, or removal of an unused Detective deployment may trigger this rule. Validate the caller identity and confirm a corresponding change management ticket exists before closing.

Field Validations

Loading…

Comments (0)

Loading comments...