2_ds_amazon_aws_guardduty.md

June 14, 2023 · View on GitHub

Use-Case	Event Types/Parsers	MITRE ATT&CK® TTP	Content
Malware	security-alert ↳cef-aws-guardduty-security-alert-1 ↳cef-aws-guardduty-security-alert-2 ↳cef-aws-guardduty ↳cef-aws-guardduty-security-alert-5 ↳cef-aws-guardduty-security-alert-18 ↳cef-aws-guardduty-security-alert-6 ↳cef-aws-guardduty-security-alert-19 ↳cef-aws-guardduty-discovery-alert ↳cef-aws-guardduty-security-alert-3 ↳cef-aws-guardduty-security-alert-16 ↳cef-aws-guardduty-security-alert-4 ↳cef-aws-guardduty-security-alert-17 ↳cef-aws-guardduty-security-alert-9 ↳cef-aws-guardduty-security-alert-7 ↳cef-aws-guardduty-security-alert-8 ↳cef-aws-guardduty-security-alert-10 ↳cef-aws-guardduty-security-alert-21 ↳cef-aws-guardduty-security-alert-11 ↳cef-aws-guardduty-security-alert-20 ↳cef-aws-guardduty-security-alert-14 ↳cef-aws-guardduty-security-alert-15 ↳cef-aws-guardduty-security-alert-12 ↳cef-aws-guardduty-security-alert-13	TA0002 - TA0002	4 Rules 2 Models
Privileged Activity	security-alert ↳cef-aws-guardduty-security-alert-1 ↳cef-aws-guardduty-security-alert-2 ↳cef-aws-guardduty ↳cef-aws-guardduty-security-alert-5 ↳cef-aws-guardduty-security-alert-18 ↳cef-aws-guardduty-security-alert-6 ↳cef-aws-guardduty-security-alert-19 ↳cef-aws-guardduty-discovery-alert ↳cef-aws-guardduty-security-alert-3 ↳cef-aws-guardduty-security-alert-16 ↳cef-aws-guardduty-security-alert-4 ↳cef-aws-guardduty-security-alert-17 ↳cef-aws-guardduty-security-alert-9 ↳cef-aws-guardduty-security-alert-7 ↳cef-aws-guardduty-security-alert-8 ↳cef-aws-guardduty-security-alert-10 ↳cef-aws-guardduty-security-alert-21 ↳cef-aws-guardduty-security-alert-11 ↳cef-aws-guardduty-security-alert-20 ↳cef-aws-guardduty-security-alert-14 ↳cef-aws-guardduty-security-alert-15 ↳cef-aws-guardduty-security-alert-12 ↳cef-aws-guardduty-security-alert-13	T1068 - Exploitation for Privilege Escalation	1 Rules