Panther informational experimental python
AWS CloudTrail SES Check SES Sending Enabled
Detect when a user inquires whether SES Sending is enabled.
Detection Logic
from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent
def rule(event: PantherEvent) -> bool:
return event.get("eventName") == "GetAccountSendingEnabled"
def alert_context(event: PantherEvent) -> dict:
context = aws_rule_context(event)
context["accountRegion"] = f"{event.get('recipientAccountId')}_{event.get('eventRegion')}"
return context Field Validations
Loading…
Comments (0)
Loading comments...