Elastic medium stable kql

AWS GuardDuty Threat Intelligence Set Deleted

Detects the deletion of an Amazon GuardDuty threat intelligence set. Threat intelligence sets are custom lists of known-malicious IP addresses or domains that GuardDuty uses to generate findings when monitored resources communicate with those indicators. Deleting a threat intel set degrades GuardDuty's detection capability for known adversary infrastructure, allowing communication with threat-actor-controlled IP ranges to go undetected.

View Source

Detection Logic

data_stream.dataset: "aws.cloudtrail"
    and event.provider: "guardduty.amazonaws.com"
    and event.action: "DeleteThreatIntelSet"
    and event.outcome: "success"

False Positives

⚠ Removal of an outdated or inaccurate threat intelligence set during a scheduled feed rotation may trigger this rule. Confirm the deletion corresponds to a planned feed update and that a replacement set was activated.

Field Validations

Loading…

Comments (0)

Loading comments...