Elastic low stable eql
Spike in AWS Error Messages
A machine learning job detected a significant spike in the rate of a particular error in the CloudTrail messages. Spikes in error messages may accompany attempts at privilege escalation, lateral movement, or discovery.
Detection Logic
False Positives
- ⚠ Spikes in error message activity can also be due to bugs in cloud automation scripts or workflows; changes to cloud automation scripts or workflows; adoption of new services; changes in the way services are used; or changes to IAM privileges.
Field Validations
Loading…
Comments (0)
Loading comments...