diff --git a/CHANGELOG.md b/CHANGELOG.md index a3dd6a3e9..1ca9db9df 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ All notable changes to this project will be documented in this file. ### Added - Let the Ruleset update tool to bypass the version check with the force option. ([#773](https://github.com/wazuh/wazuh-ruleset/pull/773)) +- Added new AWS Config-History rules to make it more granular by including every item status supported ([#775](https://github.com/wazuh/wazuh-ruleset/pull/775)) + ## [v4.0.1] diff --git a/rules/0350-amazon_rules.xml b/rules/0350-amazon_rules.xml index 980deb76b..419f98913 100644 --- a/rules/0350-amazon_rules.xml +++ b/rules/0350-amazon_rules.xml @@ -300,12 +300,45 @@ ID: 80200 - 80499 - + 80451 + OK AWS Config - History [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)) aws_config,aws_config_history, no_full_log + + + 80451 + ResourceDiscovered + The resource was newly discovered. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)) + aws_config,aws_config_history, + no_full_log + + + + 80451 + ResourceNotRecorded + The resource was discovered but its configuration was not recorded since the recorder excludes the recording of resources of this type. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)) + aws_config,aws_config_history, + no_full_log + + + + 80451 + ResourceDeleted + The resource was deleted. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)) + aws_config,aws_config_history, + no_full_log + + + + 80451 + ResourceDeletedNotRecorded + The resource was deleted but its configuration was not recorded since the recorder excludes the recording of resources of this type. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus)) + aws_config,aws_config_history, + no_full_log +