AWS EventBridge Rule Disabled or Deleted

 1[metadata]
 2creation_date = "2021/10/17"
 3integration = ["aws"]
 4maturity = "production"
 5min_stack_comments = "AWS integration breaking changes, bumping version to ^2.0.0"
 6min_stack_version = "8.9.0"
 7updated_date = "2024/04/14"
 8
 9[rule]
10author = ["Austin Songer"]
11description = """
12Identifies when a user has disabled or deleted an EventBridge rule. This activity can result in an unintended loss of
13visibility in applications or a break in the flow with other AWS services.
14"""
15false_positives = [
16    """
17    EventBridge Rules could be deleted or disabled by a system administrator. Verify whether the user identity, user
18    agent, and/or hostname should be making changes in your environment. EventBridge Rules being deleted or disabled by
19    unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the
20    rule.
21    """,
22]
23from = "now-20m"
24index = ["filebeat-*", "logs-aws.cloudtrail-*"]
25language = "kuery"
26license = "Elastic License v2"
27name = "AWS EventBridge Rule Disabled or Deleted"
28note = """## Setup
29
30The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
31references = [
32    "https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DeleteRule.html",
33    "https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_DisableRule.html",
34]
35risk_score = 21
36rule_id = "87594192-4539-4bc4-8543-23bc3d5bd2b4"
37severity = "low"
38tags = ["Domain: Cloud", "Data Source: AWS", "Data Source: Amazon Web Services", "Tactic: Impact"]
39timestamp_override = "event.ingested"
40type = "query"
41
42query = '''
43event.dataset:aws.cloudtrail and event.provider:eventbridge.amazonaws.com and event.action:(DeleteRule or DisableRule) and
44event.outcome:success
45'''
46
47
48[[rule.threat]]
49framework = "MITRE ATT&CK"
50[[rule.threat.technique]]
51id = "T1489"
52name = "Service Stop"
53reference = "https://attack.mitre.org/techniques/T1489/"
54
55
56[rule.threat.tactic]
57id = "TA0040"
58name = "Impact"
59reference = "https://attack.mitre.org/tactics/TA0040/"