Sagan informational stable other

[AWS-SECRETSMANAGER] UpdateSecret Event Detected

[AWS-SECRETSMANAGER] UpdateSecret Event Detected

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[AWS-SECRETSMANAGER] UpdateSecret Event Detected"; program:secretsmanager.amazonaws.com; json_content:".eventName","UpdateSecret"; content: !"
| 22
| mfaAuthenticated
| 22 3a 20 22
| true
| 22
| "; parse_src_ip:1; classtype:system-event; reference:url,https://docs.aws.amazon.com/secretsmanager/latest/apireference/Welcome.html; sid:5014223; rev:2;)

Field Validations

Loading…

Comments (0)

Loading comments...