DET-17: Audit trail stopped, deleted or narrowed¶
StopLogging, DeleteTrail, UpdateTrail or PutEventSelectors on a trail: someone may be blinding the logs these detections read.
| Property | Value |
|---|---|
| Severity | high |
| Platform | AWS Nitro Enclaves |
| Group | cloud |
| Log source | CloudTrail · CloudTrail |
| Related check | CLOUDTRAIL-01: CloudTrail records enclave KMS and S3 operations |
Fires when¶
eventName IN [StopLogging, DeleteTrail, UpdateTrail] AND trail covers the state-bucket data events
How it runs¶
untrust detect --platform nitro reads CloudTrail in the region you pass with --region, over the last --since minutes (default 60).
A match is a detection event with this rule's ID. Upload it to the console to alert on it; see Runtime detections.