- Notifications
You must be signed in to change notification settings - Fork 603
[Rule Tuning] AWS EC2 User Data Retrieval for EC2 Instance #4808
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
- changed execution window - explicitly added flattened fields to query, to reduce wildcard usage - added investigation fields - changed new terms field to evaluate `user.name` over `aws.cloudtrail.user_identity.arn` so that only the role name for Assumed Role identitites is being evaluated instead of each individual session. This should greatly impact performance as most instances of this rule in telemetry is triggered by Assumed Roles.
Rule: Tuning - GuidelinesThese guidelines serve as a reminder set of considerations when tuning an existing rule. Documentation and Context
Rule Metadata Checks
Testing and Validation
|
Aegrah approved these changes Jun 17, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
Samirbous approved these changes Jun 17, 2025
imays11 commented Jun 17, 2025
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
terrancedejesus approved these changes Jun 17, 2025
Mikaayenson reviewed Jun 17, 2025
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
Mikaayenson reviewed Jun 17, 2025
""" | ||
from = "now-9m" | ||
from = "now-6m" | ||
interval = "5m" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IINM, may not need to directly add the default interval.
Mikaayenson reviewed Jun 17, 2025
rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml Outdated Show resolved Hide resolved
Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backport: auto Domain: Cloud Integration: AWS AWS related rules patch Rule: Tuning tweaking or tuning an existing rule Team: TRADE
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
Pull Request
Issue link(s):
Summary - What I changed
user.name
overaws.cloudtrail.user_identity.arn
so that only the role name for Assumed Role identitites is being evaluated instead of each individual session. This should greatly impact performance as most instances of this rule in telemetry is triggered by Assumed Roles.How To Test
You can use this script to test the rule using both an IAM user and a Role
To test manually launch an EC2 instance and use your user or role to access it's user data with the following command: