aws:account

AWS account

Control plane, data plane and network logs for an AWS account.

Host type: AWS
Standards scope: cloud
Minimum events: 21
Recommended events: 89
Log sources: 7

Logs, as a whole

For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.

Log	Tier	Techniques	Rules
AWS CloudTrail	Minimum	90	463
CloudWatch Logs / metrics	Recommended	9	0
EKS control-plane audit log	Recommended	0	42
Amazon GuardDuty findings	Recommended	0	4
S3 server access logs / CloudTrail data events	Recommended	0	0
VPC Flow Logs	Minimum	17	13

Minimum

21 events meet the minimum bar for this role: an ATT&CK analytic names each one, and either a standard in the role's scope requires it or at least the platform's threshold of vendor rules depends on it. Grouped by log source; the source heading carries the cost class.

AWS CloudTrail21 events · Included

Event	Techniques	Rules
AssumeRole	7	Elastic 5
AssumeRoleWithWebIdentity	3	Elastic 3
AttachUserPolicy	3	Elastic 6, Microsoft Sentinel 3
ConsoleLogin	4	Splunk 10, Elastic 5, Microsoft Sentinel 7
CopyObject	7	Elastic 3
CreateAccessKey	1	Splunk 1, Elastic 7, Microsoft Sentinel 3
CreateLoginProfile	1	Splunk 1, Elastic 5
CreateUser	3	Elastic 5, Microsoft Sentinel 2
DescribeInstances	4	Elastic 3
GetCallerIdentity	2	Elastic 6, Microsoft Sentinel 1
GetObject	7	Splunk 1, Elastic 3, Microsoft Sentinel 4
GetSecretValue	3	Elastic 4
ListBuckets	2	Elastic 3
ModifyInstanceAttribute	1	Elastic 3, Microsoft Sentinel 1
ModifySnapshotAttribute	2	Splunk 2, Elastic 2
PutBucketPolicy	1	Elastic 2, Microsoft Sentinel 1
PutGroupPolicy	1	Elastic 1, Microsoft Sentinel 11
PutObject	2	Elastic 5, Microsoft Sentinel 2
PutRolePolicy	2	Elastic 4, Microsoft Sentinel 11
PutUserPolicy	1	Elastic 3, Microsoft Sentinel 11
UpdateLoginProfile	1	Splunk 1, Elastic 3

Event	Techniques	Rules
AddUserToGroup	0	Elastic 2, Microsoft Sentinel 2
AgentTrace.actionGroupInvocationInput	1	none
AgentTrace.knowledgeBaseLookupInput	1	none
AssumeRoleWithSAML	2	Elastic 2
AttachGroupPolicy	0	Elastic 3, Microsoft Sentinel 3
AttachRolePolicy	0	Elastic 7, Microsoft Sentinel 3
AuthorizeSecurityGroupIngress	2	Elastic 1
Converse	0	Elastic 5
ConverseStream	0	Elastic 4
CopySnapshot	1	none
CreateBucket	1	none
CreateFunction	1	Elastic 1
CreateImage	1	none
CreateKey	0	Splunk 1, Microsoft Sentinel 2
CreateKeyPair	1	Elastic 1
CreateNetworkAclEntry	0	Splunk 1, Elastic 2, Microsoft Sentinel 1
CreatePolicyVersion	2	Splunk 1, Elastic 1
CreateRole	0	Elastic 3, Microsoft Sentinel 2
CreateSnapshot	3	Splunk 1
CreateVirtualMFADevice	0	Splunk 1, Elastic 1, Microsoft Sentinel 2
CreateVolume	1	none
Decrypt	1	Elastic 1
DeleteBucket	2	none
DeleteDBCluster	2	Elastic 1
DeleteGroup	0	Splunk 2, Microsoft Sentinel 2
DeleteGuardrail	0	Splunk 1, Elastic 2
DeleteModelInvocationLoggingConfiguration	0	Splunk 1, Elastic 2
DeleteRule	0	Splunk 1, Elastic 2
DeleteSnapshot	3	Splunk 1
DeleteTrail	0	Splunk 1, Elastic 2
DeleteVolume	1	none
DescribeDBInstances	1	Elastic 1
DescribeImages	1	Elastic 1
DescribeImageScanFindings	0	Splunk 3, Microsoft Sentinel 1
DescribeInstanceIdentity	1	none
DescribeSnapshots	1	none
GetAccountPasswordPolicy	1	Splunk 1
GetAccountSummary	0	Elastic 3
GetConsoleOutput	1	none
GetFederationToken	1	Elastic 2
GetInstanceIdentityDocument	1	none
GetMetadata	1	none
GetParameters	0	Elastic 3
GetSessionToken	2	Elastic 1
GetSigninToken	0	Elastic 3
ImportKeyPair	1	none
InvokeFunction	2	none
InvokeModel	0	Elastic 5
InvokeModelWithResponseStream	0	Elastic 5
ListAccessKeys	1	Elastic 1, Microsoft Sentinel 1
ListAccountAliases	0	Elastic 3
ListAttachedRolePolicies	1	Elastic 1, Microsoft Sentinel 1
ListGroups	1	Elastic 1
ListObjectsV2	1	Elastic 1
ListResources	1	none
ListRoles	0	Elastic 2, Microsoft Sentinel 1
ListUsers	0	Elastic 2, Microsoft Sentinel 1
ModifyDBInstance	0	Splunk 1, Elastic 4, Microsoft Sentinel 1
ModifyImageAttribute	1	Splunk 1
ModifyVolume	1	none
PassRole	1	none
PutBucketLifecycle	1	Splunk 1, Elastic 1
PutBucketVersioning	0	Splunk 1, Elastic 2
PutIdentityPolicy	1	none
PutKeyPolicy	0	Splunk 1, Elastic 1, Microsoft Sentinel 2
PutLifecycleConfiguration	1	none
RegisterImage	1	none
ReplaceNetworkAclEntry	0	Splunk 1, Elastic 1, Microsoft Sentinel 1
RequestServiceQuotaIncrease	1	Elastic 1
RevertSnapshot	1	none
RunInstances	8	Microsoft Sentinel 2
SendCommand	0	Elastic 3, Microsoft Sentinel 1
SendEmail	1	none
SetBucketLifecycle	1	none
SetDefaultPolicyVersion	0	Splunk 1, Elastic 1, Microsoft Sentinel 1
ssm:GetCommandInvocation	1	none
ssm:ListInventoryEntries	1	none
StartInstances	4	Elastic 1
StopInstances	1	Elastic 1
StopLogging	0	Splunk 1, Elastic 2
storage.buckets.update	1	none
sts:GetFederationToken	1	none
TerminateInstances	5	none
UpdateAccountPasswordPolicy	1	Splunk 1
UpdateAssumeRolePolicy	0	Elastic 3
UpdateSAMLProvider	0	Splunk 1, Elastic 1, Microsoft Sentinel 1
UpdateTrail	0	Splunk 1, Elastic 1, Microsoft Sentinel 2

EKS control-plane audit log2 events · Usage billed

Event	How to enable	Techniques	Rules	Standards
get		0	Elastic 4
list		0	Elastic 3

Logs, as a whole

Minimum

AWS CloudTrail21 events · Included

Recommended

Log sources on this role