From 7eb3451abbf3a02a7a1a74c0a52a779879a3c83b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?=
 <adrianjpr@gmail.com>
Date: Mon, 23 Nov 2020 10:43:15 +0100
Subject: [PATCH 1/3] Add AWS ELB rules

---
 rules/0350-amazon_rules.xml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/rules/0350-amazon_rules.xml b/rules/0350-amazon_rules.xml
index 419f98913..aee91062b 100644
--- a/rules/0350-amazon_rules.xml
+++ b/rules/0350-amazon_rules.xml
@@ -162,6 +162,33 @@ ID: 80200 - 80499
     </rule>
 
 
+    <!-- AWS ELB -->
+    <!-- Documentation: https://docs.aws.amazon.com/elasticloadbalancing/index.html -->
+    <rule id="80325" level="0">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">alb</field>
+        <description>AWS ALB alert.</description>
+        <group>aws_elb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+    <rule id="80330" level="0">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">clb</field>
+        <description>AWS CLB alert.</description>
+        <group>aws_elb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+    <rule id="80335" level="0">
+        <if_sid>80200</if_sid>
+        <field name="aws.source">nlb</field>
+        <description>AWS NLB alert.</description>
+        <group>aws_elb,</group>
+        <options>no_full_log</options>
+    </rule>
+
+
     <!-- Macie Alerts -->
     <!-- Documentation: https://docs.aws.amazon.com/macie/latest/userguide/macie-alerts.html#macie-alert-severity -->
     <rule id="80350" level="0">

From 1c81d6efeba93dcf322b49a6d20aac77579cd2b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?=
 <adrianjpr@gmail.com>
Date: Tue, 24 Nov 2020 14:11:19 +0100
Subject: [PATCH 2/3] Change ELB groups

---
 rules/0350-amazon_rules.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rules/0350-amazon_rules.xml b/rules/0350-amazon_rules.xml
index aee91062b..09e25360c 100644
--- a/rules/0350-amazon_rules.xml
+++ b/rules/0350-amazon_rules.xml
@@ -168,7 +168,7 @@ ID: 80200 - 80499
         <if_sid>80200</if_sid>
         <field name="aws.source">alb</field>
         <description>AWS ALB alert.</description>
-        <group>aws_elb,</group>
+        <group>aws_alb,</group>
         <options>no_full_log</options>
     </rule>
 
@@ -176,7 +176,7 @@ ID: 80200 - 80499
         <if_sid>80200</if_sid>
         <field name="aws.source">clb</field>
         <description>AWS CLB alert.</description>
-        <group>aws_elb,</group>
+        <group>aws_clb,</group>
         <options>no_full_log</options>
     </rule>
 
@@ -184,7 +184,7 @@ ID: 80200 - 80499
         <if_sid>80200</if_sid>
         <field name="aws.source">nlb</field>
         <description>AWS NLB alert.</description>
-        <group>aws_elb,</group>
+        <group>aws_nlb,</group>
         <options>no_full_log</options>
     </rule>
 

From 274a52a7bc71bd646c61dc48f7f4ea050dc9b6ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Jes=C3=BAs=20Pe=C3=B1a=20Rodr=C3=ADguez?=
 <adrianjpr@gmail.com>
Date: Tue, 24 Nov 2020 15:45:03 +0100
Subject: [PATCH 3/3] Update ELB rules level

---
 rules/0350-amazon_rules.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rules/0350-amazon_rules.xml b/rules/0350-amazon_rules.xml
index 09e25360c..3b17e1123 100644
--- a/rules/0350-amazon_rules.xml
+++ b/rules/0350-amazon_rules.xml
@@ -164,7 +164,7 @@ ID: 80200 - 80499
 
     <!-- AWS ELB -->
     <!-- Documentation: https://docs.aws.amazon.com/elasticloadbalancing/index.html -->
-    <rule id="80325" level="0">
+    <rule id="80325" level="3">
         <if_sid>80200</if_sid>
         <field name="aws.source">alb</field>
         <description>AWS ALB alert.</description>
@@ -172,7 +172,7 @@ ID: 80200 - 80499
         <options>no_full_log</options>
     </rule>
 
-    <rule id="80330" level="0">
+    <rule id="80330" level="3">
         <if_sid>80200</if_sid>
         <field name="aws.source">clb</field>
         <description>AWS CLB alert.</description>
@@ -180,7 +180,7 @@ ID: 80200 - 80499
         <options>no_full_log</options>
     </rule>
 
-    <rule id="80335" level="0">
+    <rule id="80335" level="3">
         <if_sid>80200</if_sid>
         <field name="aws.source">nlb</field>
         <description>AWS NLB alert.</description>