Sagan medium stable other

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (ACL)

[CONFLUENT] Kafka Broker Dynamic Configuration Altered (ACL)

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg: "[CONFLUENT] Kafka Broker Dynamic Configuration Altered (ACL)"; json_content: ".data.methodName", "kafka.IncrementalAlterConfigs"; json_content: ".data.authorizationInfo.granted", "true"; json_content: ".data.authorizationInfo.superUs", "false"; json_content: ".data.authorizationInfo.aclAuth", "ALLOW"; classtype: configuration-change; reference: url,docs.confluent.io/cloud/current/access-management/audit-logging/cloud-audit-log-concepts.html; sid:5005944; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...