About APaul

I am trying to write a custom query to get the unauthorized access details or Access denied details captured and after a certain number of attempts is there it will alert.   I am referring to the mentioned article : ( Example: Authorization Failures ) I need to capture this in cloudtrail logs: { ($.errorCode = "*UnauthorizedOperation") || ($.errorCode = "AccessDenied*") } I used this Custom Redlock Query: event where cloud.type = 'aws' AND json.rule = (( $.errorCode = "*UnauthorizedOperation") ) However, I am not getting the desired result.   ... View more

I need to write a query to check for events of a snapshot taken using programmatic access :   event where cloud.type = 'aws' AND operation = 'CreateInstanceSnapshot' AND json.rule = $.userIdentity.type = "Consolepassword" Till now I have tried to do this, and I am pretty sure "json.rule = $.userIdentity.type = "Consolepassword" is 100% incorrect.   I need help on the second part to check if the user is using programmatic access or console access to take a snapshot. ... View more