Merge pull request #782 from wazuh/6034-AWS-ELB

New AWS ELB rules
wazuh · Nov 25, 2020 · 2a4c5c2 · 2a4c5c2
2 parents b0f81c8 + 274a52a
commit 2a4c5c2
Showing 1 changed file with 27 additions and 0 deletions.
diff --git a/rules/0350-amazon_rules.xml b/rules/0350-amazon_rules.xml
@@ -162,6 +162,33 @@ ID: 80200 - 80499
     </rule>
 
 
+    <!-- AWS ELB -->
+    <!-- Documentation: https://docs.aws.amazon.com/elasticloadbalancing/index.html -->
+    <rule id="80325" level="3">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">alb</field>
+        <description>AWS ALB alert.</description>
+        <group>aws_alb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+    <rule id="80330" level="3">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">clb</field>
+        <description>AWS CLB alert.</description>
+        <group>aws_clb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+    <rule id="80335" level="3">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">nlb</field>
+        <description>AWS NLB alert.</description>
+        <group>aws_nlb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+
     <!-- Macie Alerts -->
     <!-- Documentation: https://docs.aws.amazon.com/macie/latest/userguide/macie-alerts.html#macie-alert-severity -->
     <rule id="80350" level="0">