Panther high experimental python

AWS CloudTrail Management Events Enabled

This policy ensures that at least one CloudTrail has management (control plane) operations logged.

View Source

Detection Logic

def policy(resource):
    # pylint: disable=R1260
    if not resource.get("Trails"):
        return False

    if not any(
        [resource.get("GlobalEventSelectors"), resource.get("GlobalAdvancedEventSelectors")]
    ):
        return False

    if resource.get("GlobalEventSelectors"):
        for selector in resource.get("GlobalEventSelectors", [{}]):
            if selector.get("IncludeManagementEvents") and selector.get("ReadWriteType") == "All":
                return True

    if resource.get("GlobalAdvancedEventSelectors"):
        for advanced_selector in resource.get("GlobalAdvancedEventSelectors", [{}]):
            management_present = False
            readonly_present = False
            for field_selector in advanced_selector.get("FieldSelectors", [{}]):
                if field_selector.get("Field") == "eventCategory":
                    event_categories = field_selector.get("Equals", [])
                    if "Management" in event_categories:
                        management_present = True
                if field_selector.get("Field") == "readOnly":
                    readonly_present = True
            if all([management_present, not readonly_present]):
                return True
    return False

Field Validations

Loading…

Comments (0)

Loading comments...