aws_new_rules

[saakovv]

Summary of the Pull Request

Changelog

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

Please provide log example in order for me to verify the logic of the rules.

[saakovv]

Please provide log example in order for me to verify the logic of the rules.

In AWS logs, "eventName" and "status" fields are mainly used to detect events.

Events can be found here (for example):
https://docs.aws.amazon.com/
https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_Operations.html
https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html

Some alerts may be developed for preventive detection and it is not always possible to quickly find logs at hand.
I have attached some logs for example (unpersonalized)
aws_cloudtrail_delete_bucket.yml.json
aws_cloudtrail_console_login_without_mfa.yml.json
aws_cloudtrail_console_login_failure.yml.json.json

[saakovv]

Hi!
@nasbench , any updates on this review? do you need anything else from me?

[nasbench]

In progress :)