AWS Glue Development Endpoint Activity

{
  "selection": {
    "eventSource": "glue.amazonaws.com",
    "eventName": [
      "CreateDevEndpoint",
      "DeleteDevEndpoint",
      "UpdateDevEndpoint"
    ]
  },
  "condition": "selection"
}

False Positives

• ⚠ Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
• ⚠ If known behavior is causing false positives, it can be exempted from the rule.