AWS Security Hub - Detect SQS Queue lacking encryption at rest

Back


Id	7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10
Rulename	AWS Security Hub - Detect SQS Queue lacking encryption at rest
Description	This query detects Amazon SQS queues without server-side encryption at rest enabled, using AWS Security Hub control SQS.1 findings. Lack of encryption for SQS queues can expose sensitive message contents if underlying storage or backups are accessed by unauthorized parties.
Severity	Medium
Tactics	Impact
Techniques	T1565.001
Required data connectors	AWSSecurityHub
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SQSQueueNotEncrypted.yaml
Version	1.0.0
Arm template	7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10.json

KQL

AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/SQS.1"
      or tostring(ComplianceSecurityControlId) == "SQS.1"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsSqsQueue"
| extend QueueArn = tostring(Resource.Id)
| summarize TimeGenerated = max(TimeGenerated)
    by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
       AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn

YAML

tactics:
- Impact
severity: Medium
entityMappings:
- fieldMappings:
  - columnName: AwsAccountId
    identifier: Name
  - columnName: AwsAccountId
    identifier: CloudAppAccountId
  entityType: Account
- fieldMappings:
  - columnName: QueueArn
    identifier: Name
  entityType: CloudApplication
description: |
  This query detects Amazon SQS queues without server-side encryption at rest enabled, using AWS Security Hub control SQS.1 findings.
  Lack of encryption for SQS queues can expose sensitive message contents if underlying storage or backups are accessed by unauthorized parties.  
customDetails:
  ComplianceControlId: ComplianceSecurityControlId
  FindingId: AwsSecurityFindingId
  Region: AwsRegion
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/SQSQueueNotEncrypted.yaml
requiredDataConnectors:
- dataTypes:
  - AWSSecurityHubFindings
  connectorId: AWSSecurityHub
tags:
- AWS Foundational Security Best Practices v1.0.0
- NIST 800-53 r5
name: AWS Security Hub - Detect SQS Queue lacking encryption at rest
query: |
  AWSSecurityHubFindings
  | where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
  | where tostring(AwsSecurityFindingGeneratorId) == "security-control/SQS.1"
        or tostring(ComplianceSecurityControlId) == "SQS.1"
  | mv-expand Resource = Resources
  | where tostring(Resource.Type) == "AwsSqsQueue"
  | extend QueueArn = tostring(Resource.Id)
  | summarize TimeGenerated = max(TimeGenerated)
      by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
         AwsSecurityFindingId, ComplianceSecurityControlId, QueueArn  
id: 7b8c5e2d-6f1c-4a1f-9e2a-3c5f7a8b9c10
relevantTechniques:
- T1565.001
queryFrequency: 1h
queryPeriod: 1h
alertDetailsOverride:
  alertDescriptionFormat: AWS Account {{AwsAccountId}} has an SQS queue ({{QueueArn}}) without server-side encryption enabled. Enable KMS encryption to protect message data at rest.
  alertDisplayNameFormat: SQS queue {{QueueArn}} not encrypted at rest
triggerThreshold: 0
status: Available
version: 1.0.0
kind: Scheduled
triggerOperator: gt

ARM