Panther informational experimental python

AWS CloudTrail SES Check SES Sending Enabled

Detect when a user inquires whether SES Sending is enabled.

View Source

Detection Logic

from panther_aws_helpers import aws_rule_context
from panther_core import PantherEvent


def rule(event: PantherEvent) -> bool:
    return event.get("eventName") == "GetAccountSendingEnabled"


def alert_context(event: PantherEvent) -> dict:
    context = aws_rule_context(event)
    context["accountRegion"] = f"{event.get('recipientAccountId')}_{event.get('eventRegion')}"
    return context

Field Validations

Loading…

Comments (0)

Loading comments...