Cloudwatch Filters

From Federal Burro of Information
Revision as of 13:33, 30 September 2019 by David (talk | contribs)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to navigationJump to search

http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html

{ $.mfaAuthenticated = "false" }
{ $.userIdentity.type != "AssumedRole" }
{ ( $.eventSource != "iam.amazonaws.com" ) && ( $.eventSource != "cloudtrail.amazonaws.com" ) && ( $.eventSource != "elasticfilesystem.amazonaws.com" )}
{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "DescribeInstanceStatus" ) }
{ $.userIdentity.sessionContext.attributes.mfaAuthenticated != "true" }
{ ( $.eventSource != "iam.amazonaws.com" ) && ( $.eventSource != "cloudtrail.amazonaws.com" ) && ( $.eventSource != "elasticfilesystem.amazonaws.com" ) && ( $.eventSource != "sts.amazonaws.com" ) && ( $.eventSource != "signin.amazonaws.com" ) && ( $.eventSource != "ec2.amazonaws.com" ) && ( $.eventSource != "logs.amazonaws.com" ) }
{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "DescribeInstanceStatus" ) && ( $.eventName != "DescribeVolumeStatus" ) && ( $.eventName != "DescribeAddresses" )}
{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName != "Describe*" ) && ( $.eventName != "Create*" ) && ( $.eventName != "Delete*" ) }
{ ( $.eventSource = "ec2.amazonaws.com" ) && ( $.eventName = "StopInstances" ) }
{ ( $.eventName != "DescribeVolumeStatus" )  && ( $.eventName != "DescribeAddresses" ) && ( $.eventName != "DescribeAddresses" )}

someone messed with my ASG!!

{ $.eventName = "UpdateAutoScalingGroup" }

someone's messing with my EKS

{ ( $.objectRef.namespace = "kube-system" ) && ( $.Kind != "Event" ) && ( $.verb != "watch" ) }

filtering out other services:

{ ( $.eventSource != "logs.amazonaws.com" ) && ( $.eventSource != "sns.amazonaws.com" ) && ( $.eventSource != "ec2.amazonaws.com" ) && ( $.eventSource != "sts.amazonaws.com" )  }