AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
Id | 9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21 |
Rulename | AWS Security Hub - Detect CloudTrail trails lacking KMS encryption |
Description | This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings. Unencrypted CloudTrail logs increase the risk of unauthorized access to sensitive audit data at rest. |
Severity | Medium |
Tactics | Impact DefenseEvasion |
Techniques | T1565.001 T1562.008 |
Required data connectors | AWSSecurityHub |
Kind | Scheduled |
Query frequency | 1h |
Query period | 1h |
Trigger threshold | 0 |
Trigger operator | gt |
Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/CloudTrailTrailEncryptionDisabled.yaml |
Version | 1.0.0 |
Arm template | 9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21.json |
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/CloudTrail.2"
or tostring(ComplianceSecurityControlId) == "CloudTrail.2"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsCloudTrailTrail"
| extend TrailId = tostring(Resource.Id)
| summarize TimeGenerated = max(TimeGenerated)
by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
AwsSecurityFindingId, ComplianceSecurityControlId, TrailId
entityMappings:
- fieldMappings:
- columnName: AwsAccountId
identifier: Name
- columnName: AwsAccountId
identifier: CloudAppAccountId
entityType: Account
- fieldMappings:
- columnName: TrailId
identifier: Name
entityType: CloudApplication
triggerThreshold: 0
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/CloudTrailTrailEncryptionDisabled.yaml
queryFrequency: 1h
status: Available
tags:
- CIS AWS Foundations Benchmark v1.4.0
- CIS AWS Foundations Benchmark v1.2.0
- NIST 800-53 r5
- PCI DSS v3.2.1
relevantTechniques:
- T1565.001
- T1562.008
triggerOperator: gt
version: 1.0.0
kind: Scheduled
id: 9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21
requiredDataConnectors:
- connectorId: AWSSecurityHub
dataTypes:
- AWSSecurityHubFindings
alertDetailsOverride:
alertDisplayNameFormat: AWS CloudTrail trail {{TrailId}} lacks KMS encryption
alertDescriptionFormat: AWS CloudTrail trail ({{TrailId}}) lacks customer-managed KMS encryption for Account {{AwsAccountId}}.
name: AWS Security Hub - Detect CloudTrail trails lacking KMS encryption
description: |
This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings.
Unencrypted CloudTrail logs increase the risk of unauthorized access to sensitive audit data at rest.
query: |
AWSSecurityHubFindings
| where RecordState == "ACTIVE" and ComplianceStatus == "FAILED"
| where tostring(AwsSecurityFindingGeneratorId) == "security-control/CloudTrail.2"
or tostring(ComplianceSecurityControlId) == "CloudTrail.2"
| mv-expand Resource = Resources
| where tostring(Resource.Type) == "AwsCloudTrailTrail"
| extend TrailId = tostring(Resource.Id)
| summarize TimeGenerated = max(TimeGenerated)
by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,
AwsSecurityFindingId, ComplianceSecurityControlId, TrailId
tactics:
- Impact
- DefenseEvasion
queryPeriod: 1h
customDetails:
Region: AwsRegion
FindingId: AwsSecurityFindingId
ComplianceControlId: ComplianceSecurityControlId
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21')]",
"properties": {
"alertDetailsOverride": {
"alertDescriptionFormat": "AWS CloudTrail trail ({{TrailId}}) lacks customer-managed KMS encryption for Account {{AwsAccountId}}.",
"alertDisplayNameFormat": "AWS CloudTrail trail {{TrailId}} lacks KMS encryption"
},
"alertRuleTemplateName": "9c2f6c3b-7fd8-4c5a-9d9d-3c4f9e6a7b21",
"customDetails": {
"ComplianceControlId": "ComplianceSecurityControlId",
"FindingId": "AwsSecurityFindingId",
"Region": "AwsRegion"
},
"description": "This query detects AWS CloudTrail trails that are not configured to use server-side encryption with a customer managed KMS key using AWS Security Hub control CloudTrail.2 findings. \nUnencrypted CloudTrail logs increase the risk of unauthorized access to sensitive audit data at rest.\n",
"displayName": "AWS Security Hub - Detect CloudTrail trails lacking KMS encryption",
"enabled": true,
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "AwsAccountId",
"identifier": "Name"
},
{
"columnName": "AwsAccountId",
"identifier": "CloudAppAccountId"
}
]
},
{
"entityType": "CloudApplication",
"fieldMappings": [
{
"columnName": "TrailId",
"identifier": "Name"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/AWS Security Hub/Analytic Rules/CloudTrailTrailEncryptionDisabled.yaml",
"query": "AWSSecurityHubFindings\n| where RecordState == \"ACTIVE\" and ComplianceStatus == \"FAILED\"\n| where tostring(AwsSecurityFindingGeneratorId) == \"security-control/CloudTrail.2\"\n or tostring(ComplianceSecurityControlId) == \"CloudTrail.2\"\n| mv-expand Resource = Resources\n| where tostring(Resource.Type) == \"AwsCloudTrailTrail\"\n| extend TrailId = tostring(Resource.Id)\n| summarize TimeGenerated = max(TimeGenerated)\n by AwsAccountId, AwsRegion, AwsSecurityFindingTitle, AwsSecurityFindingDescription,\n AwsSecurityFindingId, ComplianceSecurityControlId, TrailId\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"severity": "Medium",
"status": "Available",
"subTechniques": [
"T1565.001",
"T1562.008"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"DefenseEvasion",
"Impact"
],
"tags": [
"CIS AWS Foundations Benchmark v1.4.0",
"CIS AWS Foundations Benchmark v1.2.0",
"NIST 800-53 r5",
"PCI DSS v3.2.1"
],
"techniques": [
"T1562",
"T1565"
],
"templateVersion": "1.0.0",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}