IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« First Time Seen AWS Secret Value Accessed in Secrets Manager AWS Route Table Modified or Deleted »
Elastic Docs ›Elastic Security Solution [8.11] ›Downloadable rule update v8.11.11

AWS Route Table Created

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

AWS Route Table Created

edit

Identifies when an AWS Route Table has been created.

Rule type: query

Rule indices:

  • filebeat-*
  • logs-aws*

Severity: low

Risk score: 21

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Use Case: Network Security Monitoring
  • Tactic: Persistence

Version: 206

Rule authors:

  • Elastic
  • Austin Songer

Rule license: Elastic License v2

Investigation guide

edit

Setup

edit

The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

Rule query

edit
event.dataset:aws.cloudtrail and event.provider:ec2.amazonaws.com and event.action:(CreateRoute or CreateRouteTable) and
event.outcome:success

Framework: MITRE ATT&CKTM

« First Time Seen AWS Secret Value Accessed in Secrets Manager AWS Route Table Modified or Deleted »