AWSCloudTrail - Network ACL with all the open ports to a specified CIDR

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Content Index

---

Detects Network ACL entries that allow very broad inbound access ranges, including all protocols or large port ranges. Such changes can significantly increase exposure and may indicate weakening of cloud network controls.

Attribute	Value
Type	Analytic Rule
Solution	Amazon Web Services
ID	f8ea7d50-e33b-4b9d-9c3e-a59fcbcee281
Severity	High
Status	Available
Kind	Scheduled
Tactics	DefenseEvasion
Techniques	T1562.007
Required Connectors	AWS
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Selection Criteria	Transformations	Ingestion API	Lake-Only
AWSCloudTrail	EventName in "CreateNetworkAclEntry,ReplaceNetworkAclEntry"	✓	✓	✓

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Analytic Rules · Back to Amazon Web Services