Panther medium experimental python

AWS Macie Disabled/Updated

Amazon Macie is a data security and data privacy service to discover and protect sensitive data. Security teams use Macie to detect open S3 Buckets that could have potentially sensitive data in it along with policy violations, such as missing Encryption. If an attacker disables Macie, it could potentially hide data exfiltration.

View Source

Detection Logic

from panther_base_helpers import pattern_match

MACIE_EVENTS = {
    "ArchiveFindings",
    "CreateFindingsFilter",
    "DeleteMember",
    "DisassociateFromMasterAccount",
    "DisassociateMember",
    "DisableMacie",
    "DisableOrganizationAdminAccount",
    "UpdateFindingsFilter",
    "UpdateMacieSession",
    "UpdateMemberSession",
    "UpdateClassificationJob",
}


def rule(event):
    return event.get("eventName") in MACIE_EVENTS and pattern_match(
        event.get("eventSource"), "macie*.amazonaws.com"
    )


def title(event):
    account = event.get("recipientAccountId")
    user_arn = event.deep_get("userIdentity", "arn")
    return f"AWS Macie in AWS Account [{account}] Disabled/Updated by [{user_arn}]"

Field Validations

Loading…

Comments (0)

Loading comments...