Search for Alerting Rule: AWS Tokens

Use the search tokens below that we provide during rule creation wizard.

account.idaccount.id

Use a text value ##### to show resources based on the unique account ID associated with the connector/ARN at the time of creation.

Example

Show findings with this account ID

account.id: 205767712438

regionregion

Select the name of the region you're interested in. Select from names in the drop-down menu. The drop-down menu options contains region code. For example, the region code for Singapore is ap-southeast-1. For the complete mapping of region code to region, view AWS Region Mapping.

Example

Find resources in the ap-southeast-1 (Singapore) region

region: ap-southeast-1

service.typeservice.type

Select the type of service you're interested in. Select from names in the drop-down menu. The drop-down menu options contains service type code. For example, the service code for CloudTrail is CLOUD_TRAIL. For the complete mapping of service type code to service type AWS Service Type Mapping.

Example

Show service type CloudTrail

service.type: CLOUD_TRAIL

resource.typeresource.type

Select the type of resource you're interested in. Select from names in the drop-down menu. The drop-down menu options contains of resource type code. For example, the service code for S3 Bucket is BUCKET . For the complete mapping of resource type code to resource type, view AWS Resource Type Mapping.

Example

Show resources of type S3 Bucket

resource.type: BUCKET

resource.idresource.id

Use a text value ##### to find resources by the unique ID assigned to the resource.

Example

Show resources with ID acl-8e5198f5

resource.id: acl-8e5198f5

cidcid

Use a text value ##### to show controls based on the unique control ID associated with the control at the time of creation.

Example

Show controls with this ID

cid: 205767712438

control.namecontrol.name

Use values within quotes to help you find controls with a certain name.

Examples

Show findings with this name

control.name: Avoid the use of the root account

Show any findings that contain parts of name

control.name: "Avoid the use of the root account"

control.criticalitycontrol.criticality

Select the control criticality (HIGH, MEDIUM, LOW) you're interested in.

Example

Show controls with High criticality

control.criticality: HIGH

control.resultcontrol.result

Use control result value (FAIL) to view controls with specific result.

Example

Show controls that failed

control.result: FAIL

evaluatedOnevaluatedOn

Use a date range or specific date to define when the resource was evaluated on.

Examples

Show resources discovered within certain dates

evaluatedOn: [2018-01-01 ... 2018-03-01]

Show resources updated starting 2018-10-01, ending 1 month ago

evaluatedOn: [2018-01-01 ... now-1m]

Show resources updated starting 2 weeks ago, ending 1 second ago

evaluatedOn: [now-2w ... now-1s]

Show resources discovered on specific date

evaluatedOn: 2018-01-08

lastEvaluatedlastEvaluated

Use a date range or specific date to define when the resource was last evaluated on.

Examples

Show resources last evaluated within certain dates

lastEvaluated: [2018-01-01 ... 2018-03-01]

Show resources last evaluated starting 2018-10-01, ending 1 month ago

lastEvaluated: [2018-01-01 ... now-1m]

Show resources last evaluated starting 2 weeks ago, ending 1 second ago

lastEvaluated: [now-2w ... now-1s]

Show resources last evaluated on specific date

lastEvaluated: 2018-01-08

firstEvaluatedfirstEvaluated

Use a date range or specific date to define when the resource was first discovered and evaluated.

Examples

Show resources first evaluated within certain dates

firstEvaluated: [2018-01-01 ... 2018-03-01]

Show resources first evaluated starting 2018-10-01, ending 1 month ago

firstEvaluated: [2018-01-01 ... now-1m]

Show resources first evaluated starting 2 weeks ago, ending 1 second ago

firstEvaluated: [now-2w ... now-1s]

Show resources first evaluated on specific date

firstEvaluated: 2018-01-08

policy.namepolicy.name

Use values within quotes to find a CIS or AWS policy by name.

Examples

Show findings with this name

policy.name: CIS Amazon Web Services Foundations Benchmark

Show any findings that contain parts of name

policy.name: "CIS Amazon Web Services Foundations Benchmark"

qflow.idqflow.id

Use a text value ##### to show controls created from QFlow with specified QFlow id.

Examples

Show controls with specific qflow id

qflow.id: 80313390-aa04-11e9-9596-45e2d51410b1

qflow.nameqflow.name

Use values within quotes or back-ticks to find controls created from QFlow with the specified name.

Examples

Show controls that are created from QFlow with a name that partially matches the specified QFlow name.

qflow.name: "Publicly accessible S3 buckets"

Show controls that are created from QFlow with a name that exactly matches the specified QFlow name.

qflow.name: `S3 buckets`

AWS Region Mapping

Code	Region Name
us-east-2	Ohio
us-east-1	N. Virginia
us-west-1	N. California
us-west-2	Oregon
ca-central-1	Canada Central
ap-south-1	Mumbai
ap-east-1	Hong Kong
ap-northeast-2	Seoul
ap-southeast-1	Singapore
ap-southeast-2	Sydney
ap-northeast-1	Tokyo
eu-central-1	Frankfurt
eu-west-1	Ireland
eu-west-2	London
sa-east-1	São Paulo
eu-west-3	Paris
eu-north-1	Stockholm
eu-south-1	Milan
me-south-1	Bahrain
af-south-1	Cape Town
us-gov-east-1	US GovCloud East
us-gov-west-1	US GovCloud West
cn-north-1	Bejing
cn-northwest-1	Ningxia

AWS Service Type Mapping

Code	Service Type
IAM	IAM
CONFIG	Config
CLOUD_TRAIL	CloudTrail
CLOUD_WATCH	CloudWatch
EC2	EC2
S3	S3
RDS	RDS
VPC	VPC
REDSHIFT	Redshift
SQS	SQS
CLOUD_FRONT	CloudFront
LAMBDA	Lambda Function
DOCUMENT_DB	DocumentDB
NEPTUNE_DB	NeptuneDB
EFS	Efs
SECRETS_MANAGER	Secrets Manager
SNS	SNS
ELASTICACHE	ElastiCache
ELASTICSEARCH_SERVICE	Elasticsearch Service
KINESIS	Kinesis
DYNAMO_DB	DynamoDB
ROUTE_53	Route 53
KMS	KMS

AWS Resource Type Mapping

Code	Resource Type
EC2_INSTANCE	Instance
LOAD_BALANCER	Load Balancer
VPC	VPC
INTERNET_GATEWAY	Internet Gateway
SUBNET	Subnet
ROUTE_TABLE	Route Table
NETWORK_ACL	Network ACL
VPC_SECURITY_GROUP	Security Group
AUTO_SCALING_GROUP	Auto Scaling Group
BUCKET	S3 Bucket
IAM_USER	IAM User
RDS	RDS
EBS	EBS Volume
LAMBDA	Lambda Function
IAM_PASSWORD	IAM Password
SECRETS	Secrets
REDSHIFT_CLUSTERS	Redshift Clusters
DOCUMENT_DB_INSTANCES	DocumentDB Instances
EC2_IMAGES	AMI
EC2_VOLUME_SNAPSHOT	EBS Snapshots
DOCUMENT_DB_CLUSTERS	DocumentDB Clusters
NEPTUNE_DB_CLUSTERS	NeptuneDB Clusters
EFS	EFS
NEPTUNE_DB_INSTANCES	NeptuneDB Instances
SNS_TOPIC	SNS Topic
SQS_QUEUE	SQS Queue
RDS_CLUSTER	Amazon Aurora
RDS_CLUSTER_SNAPSHOT	Aurora Snapshot
REDIS	Redis
MEMCACHED	Memcached
IAM_GROUPS	IAM Groups
IAM_USER_ATTACHED_POLICY	IAM User Attached Policy
IAM_USER_INLINE_POLICY	IAM User Inline Policy
ES_DOMAIN	Elasticsearch Service Domain
FIREHOSE	Firehose
DYNAMO_DB_TABLE	DynamoDB Table
ROUTE_53_DOMAIN	Route 53 Domain
IAM_ACCESS_ANALYZER	Access analyzer