Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update 0350-amazon_rules.xml #775

Merged
merged 5 commits into from Nov 11, 2020
Merged

Update 0350-amazon_rules.xml #775

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fb6d95a
Update 0350-amazon_rules.xml
odintree Nov 10, 2020
6c03c9d
Update CHANGELOG.md
odintree Nov 10, 2020
3a6c846
Update CHANGELOG.md
MiguelCasaresRobles Nov 10, 2020
c9cd84a
Update 0350-amazon_rules.xml
MiguelCasaresRobles Nov 10, 2020
3bc550f
Update CHANGELOG.md
MiguelCasaresRobles Nov 11, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Expand Up @@ -6,6 +6,8 @@ All notable changes to this project will be documented in this file.
### Added

- Let the Ruleset update tool to bypass the version check with the force option. ([#773](https://github.com/wazuh/wazuh-ruleset/pull/773))
- Added new AWS Config-History rules to make it more granular by including every item status supported ([#775](https://github.com/wazuh/wazuh-ruleset/pull/775))



## [v4.0.1]
Expand Down
35 changes: 34 additions & 1 deletion rules/0350-amazon_rules.xml
View file
Open in desktop
Expand Up @@ -300,12 +300,45 @@ ID: 80200 - 80499
</rule>

<!-- Config history -->
<rule id="80453" level="3">
<rule id="80453" level="0">
<if_sid>80451</if_sid>
<field name="aws.configurationItemStatus">OK</field>
<description>AWS Config - History [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus))</description>
<group>aws_config,aws_config_history,</group>
<options>no_full_log</options>
</rule>

<rule id="80454" level="3">
<if_sid>80451</if_sid>
<field name="aws.configurationItemStatus">ResourceDiscovered</field>
<description>The resource was newly discovered. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus))</description>
<group>aws_config,aws_config_history,</group>
<options>no_full_log</options>
</rule>

<rule id="80455" level="3">
<if_sid>80451</if_sid>
<field name="aws.configurationItemStatus">ResourceNotRecorded</field>
<description>The resource was discovered but its configuration was not recorded since the recorder excludes the recording of resources of this type. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus))</description>
<group>aws_config,aws_config_history,</group>
<options>no_full_log</options>
</rule>

<rule id="80456" level="3">
<if_sid>80451</if_sid>
<field name="aws.configurationItemStatus">ResourceDeleted</field>
<description>The resource was deleted. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus))</description>
<group>aws_config,aws_config_history,</group>
<options>no_full_log</options>
</rule>

<rule id="80457" level="3">
<if_sid>80451</if_sid>
<field name="aws.configurationItemStatus">ResourceDeletedNotRecorded</field>
<description>The resource was deleted but its configuration was not recorded since the recorder excludes the recording of resources of this type. AWS Config - History: [$(aws.awsAccountId) $(aws.awsRegion)] [$(aws.resourceType)]: $(aws.resourceId) ($(aws.configurationItemStatus))</description>
<group>aws_config,aws_config_history,</group>
<options>no_full_log</options>
</rule>

<!-- Config Snapshot -->
<rule id="80475" level="3">
Expand Down