RQL Query to search for suspicious activity on specific S3 Bucket

[RDunsirn23]

We have a specific S3 bucket that we'd like to watch for events and alert on them.  I've used this query:

event from cloud.audit_logs where operation IN ( 'AddUserToGroup', 'AttachGroupPolicy', 'AttachGroupPolicy', 'AttachUserPolicy' , 'AttachRolePolicy' , 'CreateAccessKey', 'CreateKeyPair', 'DeleteKeyPair', 'DeleteLogGroup' )

but need to modify it to only query if events happen on a specific S3 bucket (not on all buckets).  Anyone know how I can add to this RQL query to only query against the specific S3 bucket?

Thanks!

[srnair]

Hello RDunsirn23, 

Can you check if the below RQL query works for your use case

event from cloud.audit_logs where cloud.service = 's3.amazonaws.com' AND json.rule = $.requestParameters.bucketName = "<bucket_name>"

Here, replace the bucket name with the S3 bucket name and this should generate an alert anytime any event is performed on the bucket. You can filter this further such that alerts are generated only for specific events by using operation IN ( '<API name>') 
Refer Event Query attributes doc to learn about the different attributes for event query.

[RDunsirn23]

Thank you!  I will try this out.