Skip to main content

Sample AWS Event RQL Queries

note

The following guide will walk you through AWS Event RQL Query Examples, based on audit logs

Alert on sensitive user activities from non-automation users

event from cloud.audit_logs where operation IN ( 'AddUserToGroup', 'AttachGroupPolicy',
'AttachUserPolicy' , 'AttachRolePolicy' , 'CreateAccessKey', 'CreateKeyPair', 'DeleteKeyPair',
'DeleteLogGroup' ) AND json.rule = $.userIdentity.arn does not contain 'AWSCloudFormation'
and $.userIdentity.arn does not contain 'ocp_installer' and $.userIdentity.arn does not contain 'automation_user'

Alert when someone deletes a key

event from cloud.audit_logs where cloud.type = 'aws' AND operation IN ( 'DeleteAccessKey' )

Failed AWS API calls

event from cloud.audit_logs where json.rule = $.errorCode exists ADDCOLUMN $.errorCode