log-*


All - AWS Account

All - AWS Account


All - AWS Region

All - AWS Region


All - LogType

All - LogType


log-aws-guardduty-*


GuardDuty - Type Table

GuardDuty - Type Table


All - Source IP

All - Source IP


All - Source Countries

All - Source Countries


All - Source AS Organization

All - Source AS Organization


All - Destination IP table

All - Destination IP table


All - Destination Countries

All - Destination Countries


All - Destination AS Organization

All - Destination AS Organization


log-aws-vpcflowlogs-*


VPCFlowLogs - Action Table

VPCFlowLogs - Action Table


VPCFlowLogs - Sent Size via VPC

VPCFlowLogs - Sent Size via VPC


VPCFlowLogs - Recieved Size via VPC

VPCFlowLogs - Recieved Size via VPC


log-aws-cloudtrail-*


S3Trail - Bucket Access Count

S3Trail - Bucket Access Count


S3Trail - Upload

S3Trail - Upload


S3Trail - Download

S3Trail - Download


search - _ECS Fields


All - Threat Hunting


CloudTrail - AWS Account(Bar)

Count

CloudTrail - AWS Account(Bar)


CloudTrail - Region(Bar)

CloudTrail - Region(Bar)

Count


CloudTrail - Source Countries

CloudTrail - Source Countries


CloudTrail - Source IP

CloudTrail - Source IP


CloudTrail - Source Countries(Geo)

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

CloudTrail - Source Countries(Geo)


CloudTrail - Source AS

CloudTrail - Source AS


CloudTrail - Login Failed

CloudTrail - Login Failed

Question: responseElements.ConsoleLogin:Failure


CloudTrail - Root Login(CIS3.3)

CloudTrail - Root Login(CIS3.3)

Question: userIdentity.type:Root AND NOT userIdentity.invokedBy:* AND NOT eventType:AwsServiceEvent


CloudTrail - Unauthorized API Calls(CIS3.1)

Question: errorCode:*UnauthorizedOperation OR errorCode:AccessDenied*


CloudTrail - UserIdentity.arn

CloudTrail - UserIdentity.arn


CloudTrail - Security Group Changed(CIS3.10)

Question: eventName:(AuthorizeSecurityGroupIngress OR AuthorizeSecurityGroupEgress OR RevokeSecurityGroupIngress OR RevokeSecurityGroupEgress OR CreateSecurityGroup OR DeleteSecurityGroup)


CloudTrail - NACL Changed(CIS3.11)

CloudTrail - NACL Changed(CIS3.11)

Question: eventName:(CreateNetworkAcl OR CreateNetworkAclEntry OR DeleteNetworkAcl OR DeleteNetworkAclEntry OR ReplaceNetworkAclEntry OR ReplaceNetworkAclAssociation)


CloudTrail - Network Gateway Changd(CIS3.12)

Question: eventName:(CreateCustomerGateway OR DeleteCustomerGateway OR AttachInternetGateway OR CreateInternetGateway OR DeleteInternetGateway OR DetachInternetGateway)


CloudTrail - Route Table Changd(CIS3.13)

Question: eventName:(CreateRoute OR CreateRouteTable OR ReplaceRoute OR ReplaceRouteTableAssociation OR DeleteRouteTable OR DeleteRoute OR DisassociateRouteTable)


CloudTrail - VPC Changed(CIS3.14)

CloudTrail - VPC Changed(CIS3.14)

Question: eventName:(CreateVpc OR DeleteVpc OR ModifyVpcAttribute OR AcceptVpcPeeringConnection OR CreateVpcPeeringConnection OR DeleteVpcPeeringConnection OR RejectVpcPeeringConnection OR AttachClassicLinkVpc OR DetachClassicLinkVpc OR DisableVpcClassicLink OR EnableVpcClassicLink)


CloudTrail - S3 Bucket Changed(CIS3.8)

CloudTrail - S3 Bucket Changed(CIS3.8)

Question: eventSource:s3.amazonaws.com AND (eventName:(PutBucketAcl OR PutBucketPolicy OR PutBucketCors OR PutBucketLifecycle OR PutBucketReplication OR DeleteBucketPolicy OR DeleteBucketCors OR DeleteBucketLifecycle OR DeleteBucketReplication))


CloudTrail - Event Name(Pie)

CloudTrail - Event Name(Pie)


CloudTrail - Event Name(Area)

CloudTrail - Event Name(Area)

Count


CloudTrail - Event Type(Pie)

CloudTrail - Event Type(Pie)


CloudTrail - Event Type(Area)

CloudTrail - Event Type(Area)

Count


CloudTrail - Error Code(Pie)

CloudTrail - Error Code(Pie)


CloudTrail - Error Code(Area)

CloudTrail - Error Code(Area)

Count


CloudTrail - Event Source(Pie)

CloudTrail - Event Source(Pie)


CloudTrail - Event Source(Area)

CloudTrail - Event Source(Area)

Count


search - CloudTrail


CloudTrail Summary


GuardDuty - AWS Account(Bar)

Count

GuardDuty - AWS Account(Bar)


GuardDuty - Region(Bar)

Count

GuardDuty - Region(Bar)


GuardDuty - Severity Count by Findings

Question: severitylabel:high

Question: severitylabel:medium

Question: severitylabel:low

GuardDuty - Severity Count by Findings


GuardDuty - Severity Count by Logs

Question: severitylabel:high

Question: severitylabel:medium

Question: severitylabel:low

GuardDuty - Severity Count by Logs


GuardDuty - Severity Count by Logs (Bar)

Question: severitylabel:high

Question: severitylabel:medium

Question: severitylabel:low

Count


GuardDuty - Network Direction

GuardDuty - Network Direction


GuardDuty - Affected Instance

GuardDuty - Affected Instance


GuardDuty - ThreatPurpose

GuardDuty - ThreatPurpose


GuardDuty - ThreatFamilyName

GuardDuty - ThreatFamilyName


GuardDuty - Resource Type Affected

GuardDuty - Resource Type Affected


GuardDuty - Source Countries Geo Map

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

GuardDuty - Source Countries Geo Map


search - GuardDuty


GuardDuty Summary


log-aws-securityhub-*


SecurityHub - Controls

SecurityHub - Controls


SecurityHub - AWS Account(Bar)

Count

SecurityHub - AWS Account(Bar)


SecurityHub - Region(Bar)

Count

SecurityHub - Region(Bar)


SecurityHub - Severity Count by Findings

Question: Severity.Label:CRITICAL

Question: Severity.Label:HIGH

Question: Severity.Label:MEDIUM

Question: Severity.Label:LOW

Question: Severity.Label:INFORMATIONAL


SecurityHub - Severity Count by Logs

Question: Severity.Label:CRITICAL

Question: Severity.Label:HIGH

Question: Severity.Label:MEDIUM

Question: Severity.Label:LOW

Question: Severity.Label:INFORMATIONAL

SecurityHub - Severity Count by Logs


SecurityHub - Severity Count By Logs(Bar)

Question: Severity.Label:CRITICAL

Question: Severity.Label:HIGH

Question: Severity.Label:MEDIUM

Question: Severity.Label:LOW

Question: Severity.Label:INFORMATIONAL

Count


SecurityHub - Network Direction

SecurityHub - Network Direction


SecurityHub - Finding Types

SecurityHub - Finding Types


SecurityHub - Affected Instance ID

SecurityHub - Affected Instance ID


SecurityHub - Source Countries Geo Map

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

SecurityHub - Source Countries Geo Map


SecurityHub - Count of source.ip

SecurityHub - Count of source.ip


SecurityHub - GuardDuty Header

GuardDuty

SecurityHub - GuardDuty Header


SecurityHub - GuardDuty ResourceTypeAffected


SecurityHub - GuardDuty ThreatPurpose

SecurityHub - GuardDuty ThreatPurpose


SecurityHub - GuardDuty ThreatFamilyName


search - SecurityHub


SecurityHub Summary


log-aws-elb-*


ELB - Controls

ELB - Controls


ELB - AWS Account(Bar)

Count

ELB - AWS Account(Bar)


ELB - Region(Bar)

Count

ELB - Region(Bar)


ELB - HTTP Response Code(PIE)

ELB - HTTP Response Code(PIE)


ELB - HTTP Response Code Trend

Count

ELB - HTTP Response Code Trend


ELB - Transfer Size(MB)

doc['http.request.bytes'].value / 1024.0 / 1024.0

doc['http.response.bytes'].value / 1024.0 / 1024.0

Sum of http.request.bytes

ELB - Transfer Size(MB)


ELB - HTTP Protocol(PIE)

ELB - HTTP Protocol(PIE)


ELB - HTTP Request Method(PIE)

ELB - HTTP Request Method(PIE)


ELB - SSL Protocol(PIE)

ELB - SSL Protocol(PIE)


ELB - SSL Cipher

ELB - SSL Cipher


ELB - URL Domain

ELB - URL Domain


ELB - URL Path

ELB - URL Path


ELB - User Agent

ELB - User Agent


ELB - Source IP Country

ELB - Source IP Country


ELB - Source Countries Geo Map

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

ELB - Source Countries Geo Map


ELB - Source IP

ELB - Source IP


ELB - Destination IP

ELB - Destination IP


ELB - Processing TIme

Question: NOT request_processing_time<0 AND NOT response_processing_time<0

Processing Time (Seconds)

ELB - Processing TIme


search - ELB


ELB Summary


log-aws-cloudfront-*


CloudFront - AWS Account(Bar)

Count

CloudFront - AWS Account(Bar)


CloudFront - Edge Location(Bar)

Count

CloudFront - Edge Location(Bar)


CloudFront - Status Code Trend

Count

CloudFront - Status Code Trend


CloudFront - Request Size

Request Size(GiB)

CloudFront - Request Size


CloudFront - Result Type(Pie)

CloudFront - Result Type(Pie)


CloudFront - Response Size

Response Size(GiB)

CloudFront - Response Size


CloudFront - Response Time (seconds)

CloudFront - Response Time (seconds)


CloudFront - Source IP(Pie)

CloudFront - Source IP(Pie)


CloudFront - Source Country(Pie)

CloudFront - Source Country(Pie)


CloudFront - URL Scheme(Pie)

CloudFront - URL Scheme(Pie)


CloudFront - SSL Protocol(Pie)

CloudFront - SSL Protocol(Pie)


CloudFront - SSL Cipher

CloudFront - SSL Cipher


CloudFront - Distribution Domain Name

CloudFront - Distribution Domain Name


CloudFront - Top 10 Access

CloudFront - Top 10 Access


CloudFront - Top 10 Referer

CloudFront - Top 10 Referer


CloudFront - Top 10 UserAgent

CloudFront - Top 10 UserAgent


CloudFront - Source Country

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

CloudFront - Source Country


CloudFront - Maximum Latency per Country

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name


CloudFront Summary


VPCFlowLogs - AWS Account(Bar)

VPCFlowLogs - AWS Account(Bar)

Count


VPCFlowLogs - Region(Bar)

VPCFlowLogs - Region(Bar)

Count


VPCFlowLogs - Accept Packets(Line Chart)

Question: "action": "ACCEPT"


VPCFlowLogs - Reject Packets(Line Chart)

Question: "action": "REJECT"


Question: action:ACCEPT

Question: ACCEPT

VPCFlowLogs - Accept Src Packets(Pie)

VPCFlowLogs - Accept Src Packets(Pie)


Question: ACCEPT

VPCFlowLogs - Accept Src Packets(Table)

VPCFlowLogs - Accept Src Packets(Table)


Question: action:REJECT

Question: REJECT

VPCFlowLogs - Reject Src Packets(Pie)

VPCFlowLogs - Reject Src Packets(Pie)


Question: REJECT

VPCFlowLogs - Reject Src Packets(Table)

VPCFlowLogs - Reject Src Packets(Table)


Question: ACCEPT

VPCFlowLogs - Accept Src Count(Geo)

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

VPCFlowLogs - Accept Src Count(Geo)


Question: REJECT

VPCFlowLogs - Reject Src Count(Geo)

ISO 3166-1 alpha-2 Code

World Countries

ISO 3166-1 alpha-2 Code

ISO 3166-1 alpha-3 Code

name

Name

VPCFlowLogs - Reject Src Count(Geo)


VPCFlowLogs - Top 10 Chart Source IP

VPCFlowLogs - Top 10 Chart Source IP

Count


VPCFlowLogs Summary


log-aws-waf-*


AWSWAF - AWS Account(Bar)

Count

AWSWAF - AWS Account(Bar)


AWSWAF - Region(Bar)

Count

AWSWAF - Region(Bar)


AWSWAF - Executed WAF Rules

AWSWAF - Executed WAF Rules


AWSWAF - Number of All Requests

AWSWAF - Number of All Requests


AWSWAF - Allowed vs Blocked Requests

AWSWAF - Allowed vs Blocked Requests


Question: action:BLOCK

AWSWAF - Number of Blocked Requests

AWSWAF - Number of Blocked Requests


AWSWAF - Filters

AWSWAF - Filters


AWSWAF - Countries By Number of Request

World Countries

Made with NaturalEarth | Elastic Maps Service

ISO 3166-1 alpha-2 code

ISO 3166-1 alpha-3 code

name

name

ISO 3166-1 alpha-2 code

AWSWAF - Countries By Number of Request


AWSWAF - HTTP Methods

AWSWAF - HTTP Methods


AWSWAF - HTTP Versions

AWSWAF - HTTP Versions


AWSWAF - Unique IP Count

AWSWAF - Unique IP Count


AWSWAF - Requests Count

AWSWAF - Requests Count


AWSWAF - Top 10 URI

AWSWAF - Top 10 URI


AWSWAF - Top 10 IP Addresses

AWSWAF - Top 10 IP Addresses


AWSWAF - Top 10 Countries

AWSWAF - Top 10 Countries


AWSWAF - Top 10 WebACL

AWSWAF - Top 10 WebACL


AWSWAF - Top 10 User-Agents

AWSWAF - Top 10 User-Agents


AWSWAF - Top 10 Hosts

AWSWAF - Top 10 Hosts


AWSWAF - Top 10 Rules

AWSWAF - Top 10 Rules


search - AWSWAF


AWSWAF Summary


log-linux-secure-*


log-linux-os-*


log-aws-r53resolver-*


log-aws-s3accesslog-*


log-aws-*