Skip to content

Commit 523242b

Browse files
misravedmisraved
authored
Merge pull request #12 from turbot/release/v0.3.0
Release/v0.3.0
2 parents ab22f23 + f920e46 commit 523242b

25 files changed

+253
-38
lines changed

‎CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
## v0.3.0 [2025-03-03]
2+
3+
_Enhancements_
4+
5+
- Added `title`, `description`, and `folder = "Account"` tag to `Activity Dashboard` queries for improved organization and clarity. https://github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections/pull/11
6+
- Removed `title` and added `folder = "Hidden"` tag to `Root User Activity Report` queries to streamline visibility. https://github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections/pull/11
7+
- Added `folder = "<service>"` tag to `service common tag locals` for better query categorization. https://github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections/pull/11
8+
- Standardized all queries to use `service common tags`, ensuring consistency across detection queries. https://github.com/turbot/tailpipe-mod-aws-cloudtrail-log-detections/pull/11
9+
110
## v0.2.0 [2025-02-06]
211

312
_Enhancements_

‎dashboards/activity_dashboard.pp

Lines changed: 42 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -69,18 +69,24 @@
6969
# Query definitions
7070

7171
query "activity_dashboard_total_logs" {
72-
title = "Log Count"
72+
title = "Log Count"
73+
description = "Count the total log entries."
7374

7475
sql = <<-EOQ
7576
select
7677
count(*) as "Total Logs"
7778
from
7879
aws_cloudtrail_log;
7980
EOQ
81+
82+
tags = {
83+
folder = "Account"
84+
}
8085
}
8186

8287
query "activity_dashboard_logs_by_source_ip" {
83-
title = "Top 10 Source IPs (Non-AWS)"
88+
title = "Top 10 Source IPs (Excluding AWS Services and Internal)"
89+
description = "List the top 10 source IPs by frequency, excluding events from AWS services and internal."
8490

8591
sql = <<-EOQ
8692
select
@@ -97,10 +103,15 @@
97103
count(*) desc
98104
limit 10;
99105
EOQ
106+
107+
tags = {
108+
folder = "Account"
109+
}
100110
}
101111

102112
query "activity_dashboard_logs_by_actor" {
103-
title = "Top 10 Actors (Non-AWS)"
113+
title = "Top 10 Actors (Excluding AWS Services)"
114+
description = "List the top 10 actors by frequency, excluding AWS services and service roles."
104115

105116
sql = <<-EOQ
106117
select
@@ -117,11 +128,15 @@
117128
count(*) desc
118129
limit 10;
119130
EOQ
120-
}
121131

132+
tags = {
133+
folder = "Account"
134+
}
135+
}
122136

123137
query "activity_dashboard_logs_by_service" {
124-
title = "Top 10 Services"
138+
title = "Top 10 Services (Excluding Read-Only)"
139+
description = "List the top 10 services by frequency, excluding read-only events."
125140

126141
sql = <<-EOQ
127142
select
@@ -137,10 +152,15 @@
137152
count(*) desc
138153
limit 10;
139154
EOQ
155+
156+
tags = {
157+
folder = "Account"
158+
}
140159
}
141160

142161
query "activity_dashboard_logs_by_event" {
143-
title = "Top 10 Events"
162+
title = "Top 10 Events (Excluding Read-Only)"
163+
description = "List the 10 most frequently called events, excluding read-only events."
144164

145165
sql = <<-EOQ
146166
select
@@ -156,11 +176,15 @@
156176
count(*) desc
157177
limit 10;
158178
EOQ
159-
}
160179

180+
tags = {
181+
folder = "Account"
182+
}
183+
}
161184

162185
query "activity_dashboard_logs_by_account" {
163-
title = "Activity by Account"
186+
title = "Logs by Account"
187+
description = "Count log entries grouped by account ID."
164188

165189
sql = <<-EOQ
166190
select
@@ -173,10 +197,15 @@
173197
order by
174198
count(*) desc;
175199
EOQ
200+
201+
tags = {
202+
folder = "Account"
203+
}
176204
}
177205

178206
query "activity_dashboard_logs_by_region" {
179-
title = "Activity by Region"
207+
title = "Logs by Region"
208+
description = "Count log entries grouped by region."
180209

181210
sql = <<-EOQ
182211
select
@@ -189,4 +218,8 @@
189218
order by
190219
count(*) desc;
191220
EOQ
221+
222+
tags = {
223+
folder = "Account"
224+
}
192225
}

‎dashboards/root_user_activity_report.pp

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@
6565
and recipient_account_id in $2
6666
and user_identity.type = 'Root'
6767
EOQ
68+
69+
tags = {
70+
folder = "Hidden"
71+
}
6872
}
6973
7074
query "root_user_activity_report_table" {
@@ -88,13 +92,15 @@
8892
timestamp desc
8993
limit 10000;
9094
EOQ
95+
96+
tags = {
97+
folder = "Hidden"
98+
}
9199
}
92100
93101
# Input queries
94102
95103
query "root_user_activity_report_aws_accounts_input" {
96-
title = "Root User Activity Report AWS Accounts Input"
97-
98104
sql = <<-EOQ
99105
with aws_account_ids as (
100106
select
@@ -112,6 +118,6 @@
112118
EOQ
113119
114120
tags = {
115-
folder = "Internal"
121+
folder = "Hidden"
116122
}
117123
}

‎detections/cloudfront.pp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
cloudfront_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "CloudFront"
34
service = "AWS/CloudFront"
45
})
56

@@ -45,6 +46,8 @@
4546
order by
4647
event_time desc;
4748
EOQ
49+
50+
tags = local.cloudfront_common_tags
4851
}
4952

5053
detection "cloudfront_distribution_logging_disabled" {
@@ -73,4 +76,6 @@
7376
order by
7477
event_time desc;
7578
EOQ
79+
80+
tags = local.cloudfront_common_tags
7681
}

‎detections/cloudtrail.pp

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
cloudtrail_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "CloudTrail"
34
service = "AWS/CloudTrail"
45
})
56

@@ -48,9 +49,7 @@
4849
event_time desc;
4950
EOQ
5051

51-
tags = {
52-
recommended = "true"
53-
}
52+
tags = local.cloudtrail_common_tags
5453
}
5554

5655
detection "cloudtrail_trail_kms_key_updated" {
@@ -83,6 +82,8 @@
8382
order by
8483
event_time desc;
8584
EOQ
85+
86+
tags = local.cloudtrail_common_tags
8687
}
8788

8889
detection "cloudtrail_trail_s3_logging_bucket_updated" {
@@ -115,6 +116,8 @@
115116
order by
116117
event_time desc;
117118
EOQ
119+
120+
tags = local.cloudtrail_common_tags
118121
}
119122

120123
detection "cloudtrail_trail_global_service_logging_disabled" {
@@ -139,11 +142,13 @@
139142
where
140143
event_source = 'cloudtrail.amazonaws.com'
141144
and event_name = 'UpdateTrail'
142-
and (request_parameters -> 'includeGlobalServiceEvents') = 'false'
145+
and (request_parameters -> 'includeGlobalServiceEvents') = false
143146
-- here we exclude console-based events by requiring 'session_credential_from_console' to be null, because console requests show all fields while CLI only shows updated fields.
144147
and session_credential_from_console is null
145148
${local.detection_sql_where_conditions}
146149
order by
147150
event_time desc;
148151
EOQ
152+
153+
tags = local.cloudtrail_common_tags
149154
}

‎detections/cloudwatch.pp

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
cloudwatch_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "CloudWatch"
34
service = "AWS/CloudWatch"
45
})
56
}
@@ -44,4 +45,6 @@
4445
order by
4546
event_time desc;
4647
EOQ
48+
49+
tags = local.cloudwatch_common_tags
4750
}

‎detections/codebuild.pp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
codebuild_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "CodeBuild"
34
service = "AWS/CodeBuild"
45
})
56

@@ -48,6 +49,8 @@
4849
order by
4950
event_time desc;
5051
EOQ
52+
53+
tags = local.codebuild_common_tags
5154
}
5255

5356
detection "codebuild_project_service_role_updated" {
@@ -77,6 +80,8 @@
7780
order by
7881
event_time desc;
7982
EOQ
83+
84+
tags = local.codebuild_common_tags
8085
}
8186

8287
detection "codebuild_project_source_repository_updated" {
@@ -106,6 +111,8 @@
106111
order by
107112
event_time desc;
108113
EOQ
114+
115+
tags = local.codebuild_common_tags
109116
}
110117

111118
detection "codebuild_project_environment_variable_updated" {
@@ -135,4 +142,6 @@
135142
order by
136143
event_time desc;
137144
EOQ
145+
146+
tags = local.codebuild_common_tags
138147
}

‎detections/config.pp

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
config_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "Config"
34
service = "AWS/Config"
45
})
56

@@ -45,6 +46,8 @@
4546
order by
4647
event_time desc;
4748
EOQ
49+
50+
tags = local.config_common_tags
4851
}
4952

5053
detection "config_configuration_recorder_stopped" {
@@ -73,4 +76,6 @@
7376
order by
7477
event_time desc;
7578
EOQ
79+
80+
tags = local.config_common_tags
7681
}

‎detections/ebs.pp

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
locals {
22
ebs_common_tags = merge(local.aws_cloudtrail_log_detections_common_tags, {
3+
folder = "EBS"
34
service = "AWS/EBS"
45
})
56
}
@@ -47,6 +48,8 @@
4748
order by
4849
event_time desc;
4950
EOQ
51+
52+
tags = local.ebs_common_tags
5053
}
5154

5255
detection "ebs_volume_detached" {
@@ -75,6 +78,8 @@
7578
order by
7679
event_time desc;
7780
EOQ
81+
82+
tags = local.ebs_common_tags
7883
}
7984

8085
detection "ebs_snapshot_shared_publicly" {
@@ -108,9 +113,7 @@
108113
event_time desc;
109114
EOQ
110115
111-
tags = {
112-
recommended = "true"
113-
}
116+
tags = local.ebs_common_tags
114117
}
115118
116119
detection "ebs_snapshot_created_with_encryption_disabled" {
@@ -140,6 +143,8 @@
140143
order by
141144
tp_timestamp desc;
142145
EOQ
146+
147+
tags = local.ebs_common_tags
143148
}
144149
145150
detection "ebs_snapshot_unlocked" {
@@ -168,4 +173,6 @@
168173
order by
169174
tp_timestamp desc;
170175
EOQ
176+
177+
tags = local.ebs_common_tags
171178
}

0 commit comments

Comments
 (0)