Wiz

{
    "@timestamp": "2023-07-21T07:07:21.105Z",
    "agent": {
        "ephemeral_id": "ea58853f-b6e9-4a45-86ba-9551c6aec28f",
        "id": "83d115a5-188d-46b5-95ce-7c8e49e04018",
        "name": "elastic-agent-37311",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "wiz.audit",
        "namespace": "68164",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "83d115a5-188d-46b5-95ce-7c8e49e04018",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "action": "login",
        "agent_id_status": "verified",
        "category": [
            "authentication"
        ],
        "dataset": "wiz.audit",
        "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
        "ingested": "2025-04-22T09:53:49Z",
        "kind": "event",
        "original": "{\"action\":\"Login\",\"actionParameters\":{\"clientID\":\"afsdafasmdgj5c\",\"groups\":null,\"name\":\"example\",\"products\":[\"*\"],\"role\":\"\",\"scopes\":[\"read:issues\",\"read:reports\",\"read:vulnerabilities\",\"update:reports\",\"create:reports\",\"admin:audit\"],\"userEmail\":\"\",\"userID\":\"afsafasdghbhdfg5t35fdgs\",\"userpoolID\":\"us-east-2_GQ3gwvxsQ\"},\"id\":\"hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4\",\"requestId\":\"hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4\",\"serviceAccount\":{\"id\":\"mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg\",\"name\":\"elastic\"},\"sourceIP\":null,\"status\":\"SUCCESS\",\"timestamp\":\"2023-07-21T07:07:21.105685Z\",\"user\":null,\"userAgent\":null}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "http": {
        "request": {
            "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4"
        }
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "afsafasdghbhdfg5t35fdgs",
            "us-east-2_GQ3gwvxsQ"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-audit"
    ],
    "wiz": {
        "audit": {
            "action": "Login",
            "action_parameters": {
                "client_id": "afsdafasmdgj5c",
                "name": "example",
                "products": [
                    "*"
                ],
                "scopes": [
                    "read:issues",
                    "read:reports",
                    "read:vulnerabilities",
                    "update:reports",
                    "create:reports",
                    "admin:audit"
                ],
                "user": {
                    "id": "afsafasdghbhdfg5t35fdgs"
                },
                "userpool_id": "us-east-2_GQ3gwvxsQ"
            },
            "id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
            "request_id": "hhd8ab9c-f1bf-4a80-a1e1-13bc8769caf4",
            "service_account": {
                "id": "mlipebtwsndhxdmnzdwrxzmiolvzt6topjvv4nugzctcsyarazrhg",
                "name": "elastic"
            },
            "status": "SUCCESS",
            "timestamp": "2023-07-21T07:07:21.105Z"
        }
    }
}
		

{
    "@timestamp": "2024-08-07T12:55:52.012Z",
    "agent": {
        "ephemeral_id": "3fdb83a8-3bce-4186-8cee-72dd95c25b4d",
        "id": "4815c547-4daf-42b8-a256-e931be9bc655",
        "name": "elastic-agent-89828",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "id": "998231069301",
            "name": "wiz-integrations"
        },
        "provider": "aws",
        "service": {
            "name": "eks"
        }
    },
    "data_stream": {
        "dataset": "wiz.cloud_configuration_finding",
        "namespace": "30878",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "4815c547-4daf-42b8-a256-e931be9bc655",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2024-08-07T12:55:52.012Z",
        "dataset": "wiz.cloud_configuration_finding",
        "id": "1243196d-a365-589a-a8aa-13817c9877b2",
        "ingested": "2025-04-22T09:54:52Z",
        "kind": "state",
        "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"This rule checks if the AWS Root Account has access keys. \\nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \\nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\\n\\u003e**Note** \\nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \\n1. Use the following command to list the Root user's access keys. \\nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \\n```\\naws iam list-access-keys\\n```\\n2. Use the following command to delete the access key(s). \\n```\\naws iam delete-access-key /\\n --access-key-id \\u003cvalue\\u003e\\n```\\n\\u003e**Note** \\nOnce an access key is removed, any application using it will not work until a new one is configured for it.\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}",
        "outcome": "success",
        "type": [
            "info"
        ],
        "url": "https://app.wiz.io/findings/configuration-findings/cloud#~(filters~(status~()~rule~(equals~(~'563ed717-4fb6-47fd-929e-9c794e201d0a)))~groupBy~(~)~entity~(~'1243196d-a365-589a-a8aa-13817c9877b2*2cCONFIGURATION_FINDING))"
    },
    "input": {
        "type": "cel"
    },
    "message": "This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.",
    "observer": {
        "vendor": "Wiz"
    },
    "resource": {
        "id": "arn:aws:iam::998231069301:root",
        "name": "Root user",
        "sub_type": "rootUser",
        "type": "USER_ACCOUNT"
    },
    "result": {
        "evaluation": "passed"
    },
    "rule": {
        "description": "This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.",
        "id": "IAM-006",
        "name": "Root account access keys should not exist",
        "remediation": "Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id <value>\n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.",
        "uuid": "563ed717-4fb6-47fd-929e-9c794e201d0a"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-cloud_configuration_finding"
    ],
    "user": {
        "id": "arn:aws:iam::998231069301:root",
        "name": "Root user"
    },
    "wiz": {
        "cloud_configuration_finding": {
            "analyzed_at": "2024-08-07T12:55:52.012Z",
            "updated_at": "2024-08-07T12:55:52.012Z",
            "id": "1243196d-a365-589a-a8aa-13817c9877b2",
            "resource": {
                "cloud_platform": "EKS",
                "id": "f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea",
                "name": "Root user",
                "native_type": "rootUser",
                "provider_id": "arn:aws:iam::998231069301:root",
                "subscription": {
                    "cloud_provider": "AWS",
                    "external_id": "998231069301",
                    "name": "wiz-integrations"
                },
                "type": "USER_ACCOUNT"
            },
            "result": "PASS",
            "rule": {
                "description": "This rule checks if the AWS Root Account has access keys. \nThis rule fails if `AccountAccessKeysPresent` is not set to `0`. Note that it does not take into consideration the status of the keys if present. \nThe root account should avoid using access keys. Since the root account has full permissions across the entire account, creating access keys for it increases the chance that they will be compromised. Instead, it is recommended to create IAM users with predefined roles.\n>**Note** \nSee Cloud Configuration Rule `IAM-207` to see if the Root account's access keys are active.",
                "id": "563ed717-4fb6-47fd-929e-9c794e201d0a",
                "name": "Root account access keys should not exist",
                "remediation_instructions": "Perform the following steps, while being signed in as the Root user, in order to delete the root user's access keys via AWS CLI: \n1. Use the following command to list the Root user's access keys. \nCopy the `AccessKeyId` from the output and paste it into the `access-key-id` value in the next step. \n```\naws iam list-access-keys\n```\n2. Use the following command to delete the access key(s). \n```\naws iam delete-access-key /\n --access-key-id <value>\n```\n>**Note** \nOnce an access key is removed, any application using it will not work until a new one is configured for it.",
                "short_id": "IAM-006"
            }
        }
    }
}
		

{
    "@timestamp": "2025-04-22T09:55:55.722365112Z",
    "agent": {
        "ephemeral_id": "5f4b4a3b-5fe7-41c7-ae81-1859e2eb9fcf",
        "id": "54fad7af-68b0-41e9-ba13-01893279295d",
        "name": "elastic-agent-30873",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "id": "998231069301",
            "name": "wiz-integrations"
        },
        "provider": "aws",
        "service": {
            "name": "eks"
        }
    },
    "data_stream": {
        "dataset": "wiz.cloud_configuration_finding_full_posture",
        "namespace": "26487",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "54fad7af-68b0-41e9-ba13-01893279295d",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2024-08-07T12:55:52.012Z",
        "dataset": "wiz.cloud_configuration_finding_full_posture",
        "id": "1243196d-a365-589a-a8aa-13817c9877b2",
        "ingested": "2025-04-22T09:55:55Z",
        "kind": "state",
        "original": "{\"analyzedAt\":\"2024-08-07T12:55:52.012378Z\",\"updatedAt\":\"2024-08-07T12:55:52.012378Z\",\"id\":\"1243196d-a365-589a-a8aa-13817c9877b2\",\"remediation\":null,\"resource\":{\"cloudPlatform\":\"EKS\",\"id\":\"f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea\",\"name\":\"Root user\",\"nativeType\":\"rootUser\",\"providerId\":\"arn:aws:iam::998231069301:root\",\"region\":null,\"subscription\":{\"cloudProvider\":\"AWS\",\"externalId\":\"998231069301\",\"id\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"name\":\"wiz-integrations\"},\"tags\":[],\"type\":\"USER_ACCOUNT\"},\"result\":\"PASS\",\"rule\":{\"description\":\"description\",\"id\":\"563ed717-4fb6-47fd-929e-9c794e201d0a\",\"name\":\"Root account access keys should not exist\",\"remediationInstructions\":\"instructions\",\"shortId\":\"IAM-006\"},\"severity\":\"MEDIUM\"}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "vendor": "Wiz"
    },
    "resource": {
        "id": "arn:aws:iam::998231069301:root",
        "name": "Root user",
        "sub_type": "rootUser",
        "type": "USER_ACCOUNT"
    },
    "result": {
        "evaluation": "passed"
    },
    "rule": {
        "description": "description",
        "id": "IAM-006",
        "name": "Root account access keys should not exist",
        "remediation": "instructions",
        "uuid": "563ed717-4fb6-47fd-929e-9c794e201d0a"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-cloud_configuration_finding_full_posture"
    ],
    "user": {
        "id": "arn:aws:iam::998231069301:root",
        "name": "Root user"
    },
    "wiz": {
        "cloud_configuration_finding_full_posture": {
            "analyzed_at": "2024-08-07T12:55:52.012Z",
            "updated_at": "2024-08-07T12:55:52.012Z",
            "id": "1243196d-a365-589a-a8aa-13817c9877b2",
            "resource": {
                "cloud_platform": "EKS",
                "id": "f0f4163d-cbd7-517c-ba9e-f96bb90ab5ea",
                "name": "Root user",
                "native_type": "rootUser",
                "provider_id": "arn:aws:iam::998231069301:root",
                "subscription": {
                    "cloud_provider": "AWS",
                    "external_id": "998231069301",
                    "name": "wiz-integrations"
                },
                "type": "USER_ACCOUNT"
            },
            "result": "PASS",
            "rule": {
                "description": "description",
                "id": "563ed717-4fb6-47fd-929e-9c794e201d0a",
                "name": "Root account access keys should not exist",
                "remediation_instructions": "instructions",
                "short_id": "IAM-006"
            }
        }
    }
}
		

{
    "@timestamp": "2025-01-21T18:52:15.838Z",
    "agent": {
        "ephemeral_id": "10c542b8-ed29-40a5-9d04-f32da0fef9bc",
        "id": "c4be22ec-fa52-4247-accb-8c8e1762c834",
        "name": "elastic-agent-50085",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "provider": "AWS"
    },
    "data_stream": {
        "dataset": "wiz.defend",
        "namespace": "18676",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "c4be22ec-fa52-4247-accb-8c8e1762c834",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "action": "created",
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "wiz.defend",
        "id": "2b46aa0d-9f46-5cb9-a6ae-e83ca514144a",
        "ingested": "2025-04-28T09:00:38Z",
        "kind": "event",
        "original": "{\"severity\":\"MEDIUM\",\"threatId\":\"733edfe5-db25-5b14-ac58-dc69d6005c81\",\"description\":\"Process executed the touch binary with the relevant command line flag used to modify files date information such as creation time, and last modification time. This could indicate the presence of a threat actor achieving defense evasion using the Timestomping technique.\",\"trigger\":{\"ruleName\":\"Detections Webhook Test Rule\",\"source\":\"DETECTIONS\",\"type\":\"Created\",\"ruleId\":\"a08fe977-3f54-48bf-adcf-f76994739c1f\"},\"tdrId\":\"46fd0cdc-252e-5e69-be6e-66e4851d7ae4\",\"title\":\"Timestomping technique was detected\",\"triggeringEventsCount\":2,\"tdrSource\":\"WIZ_SENSOR\",\"primaryResource\":{\"cloudAccount\":{\"cloudPlatform\":\"AWS\",\"externalId\":\"134653897021\",\"id\":\"5d67ed02-738e-5217-b065-d93642dd2629\"},\"nativeType\":\"ecs#containerinstance\",\"name\":\"test-container\",\"externalId\":\"test-container\",\"id\":\"da259b23-de77-5adb-8336-8c4071696305\",\"region\":\"us-east-1\",\"type\":\"CONTAINER\"},\"mitreTechniques\":[\"T1070.006\"],\"cloudAccounts\":[{\"cloudPlatform\":\"AWS\",\"externalId\":\"134653897021\",\"id\":\"5d67ed02-738e-5217-b065-d93642dd2629\"}],\"timeframe\":{\"start\":\"2025-01-21T18:52:15.838Z\",\"end\":\"2025-01-21T18:52:15.838Z\"},\"createdAt\":\"2025-01-21T18:52:16.819883668Z\",\"mitreTactics\":[\"TA0005\"],\"id\":\"6a440e9b-c8d8-5482-a0e9-da714359aecf\",\"threatURL\":\"https://test.wiz.io/issues#~(issue~'733edfe5-db25-5b14-ac58-dc69d6005c81)\",\"triggeringEvent\":{\"cloudPlatform\":\"AWS\",\"origin\":\"WIZ_SENSOR\",\"externalId\":\"Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528\",\"description\":\"The program /usr/bin/bash executed the program /usr/bin/touch on container test-container\",\"resources\":[{\"cloudAccount\":{\"cloudPlatform\":\"AWS\",\"externalId\":\"134653897021\",\"id\":\"5d67ed02-738e-5217-b065-d93642dd2629\"},\"nativeType\":\"ecs#containerinstance\",\"name\":\"test-container\",\"externalId\":\"test-container\",\"id\":\"da259b23-de77-5adb-8336-8c4071696305\",\"region\":\"us-east-1\",\"type\":\"CONTAINER\"}],\"source\":\"WizSensorAlert##RuleEngine\",\"runtimeDetails\":{\"processTree\":[{\"container\":{\"imageId\":\"d18500ef-c0f7-5028-8c4c-1cd56c3a6652\",\"name\":\"test-container\",\"externalId\":\"test-container\",\"imageExternalId\":\"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb\",\"id\":\"da259b23-de77-5adb-8336-8c4071696305\"},\"executionTime\":\"2025-01-21T18:52:15.838Z\",\"path\":\"/usr/bin/touch\",\"size\":109616,\"id\":\"1560\",\"userId\":\"0\",\"hash\":\"a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6\",\"command\":\"touch -r /usr/bin /tmp/uga\",\"username\":\"root\"},{\"container\":{\"imageId\":\"d18500ef-c0f7-5028-8c4c-1cd56c3a6652\",\"name\":\"test-container\",\"externalId\":\"test-container\",\"imageExternalId\":\"sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb\",\"id\":\"da259b23-de77-5adb-8336-8c4071696305\"},\"executionTime\":\"2025-01-21T18:52:15.838Z\",\"path\":\"/usr/bin/bash\",\"size\":1265648,\"id\":\"1560\",\"userId\":\"0\",\"hash\":\"91fbd9d8c65de48dc82a1064b8a4fc89f5651778\",\"command\":\"/bin/bash -x -c touch -r /usr/bin /tmp/uga\",\"username\":\"root\"}]},\"cloudProviderUrl\":\"https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528\",\"actor\":{\"nativeType\":\"Microsoft Entra ID Application Service Principal\",\"name\":\"test-actor\",\"externalId\":\"test-actor\",\"id\":\"4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e\",\"type\":\"SERVICE_ACCOUNT\"},\"actorIPMeta\":{\"reputationSource\":\"Recorded Future\",\"country\":\"United States\",\"isForeign\":true,\"reputation\":\"Benign\",\"autonomousSystemNumber\":8075,\"autonomousSystemOrganization\":\"MICROSOFT-CORP-MSN-AS-BLOCK\"},\"name\":\"Timestomping technique was detected\",\"eventTime\":\"2025-01-21T18:52:15.838Z\",\"id\":\"2b46aa0d-9f46-5cb9-a6ae-e83ca514144a\",\"category\":\"Detection\",\"status\":\"Success\",\"actorIP\":\"81.2.69.192\"},\"cloudOrganizations\":[]}",
        "outcome": "success",
        "provider": "WizSensorAlert##RuleEngine",
        "severity": 47,
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "http_endpoint"
    },
    "message": "The program /usr/bin/bash executed the program /usr/bin/touch on container test-container",
    "observer": {
        "product": "Defend",
        "vendor": "Wiz"
    },
    "related": {
        "hash": [
            "a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6",
            "91fbd9d8c65de48dc82a1064b8a4fc89f5651778"
        ],
        "ip": [
            "81.2.69.192"
        ],
        "user": [
            "4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e",
            "test-actor",
            "0",
            "root"
        ]
    },
    "rule": {
        "id": "a08fe977-3f54-48bf-adcf-f76994739c1f",
        "name": "Detections Webhook Test Rule"
    },
    "source": {
        "as": {
            "number": 8075,
            "organization": {
                "name": "MICROSOFT-CORP-MSN-AS-BLOCK"
            }
        },
        "geo": {
            "city_name": "London",
            "continent_name": "Europe",
            "country_iso_code": "GB",
            "country_name": "United Kingdom",
            "location": {
                "lat": 51.5142,
                "lon": -0.0931
            },
            "region_iso_code": "GB-ENG",
            "region_name": "England"
        }
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-defend"
    ],
    "threat": {
        "indicator": {
            "id": [
                "733edfe5-db25-5b14-ac58-dc69d6005c81"
            ],
            "reference": "https://test.wiz.io/issues#~(issue~'733edfe5-db25-5b14-ac58-dc69d6005c81)"
        },
        "tactic": {
            "id": [
                "TA0005"
            ]
        },
        "technique": {
            "id": [
                "T1070.006"
            ]
        }
    },
    "user": {
        "id": "4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e",
        "name": "test-actor"
    },
    "wiz": {
        "defend": {
            "created_at": "2025-01-21T18:52:16.819Z",
            "description": "Process executed the touch binary with the relevant command line flag used to modify files date information such as creation time, and last modification time. This could indicate the presence of a threat actor achieving defense evasion using the Timestomping technique.",
            "friendly_name": "Detections Webhook Test Rule",
            "id": "6a440e9b-c8d8-5482-a0e9-da714359aecf",
            "mitreTactics": [
                "TA0005"
            ],
            "mitreTechniques": [
                "T1070.006"
            ],
            "primary_resource": {
                "cloud_account": {
                    "cloud_platform": "AWS",
                    "external_id": "134653897021",
                    "id": "5d67ed02-738e-5217-b065-d93642dd2629"
                },
                "external_id": "test-container",
                "id": "da259b23-de77-5adb-8336-8c4071696305",
                "name": "test-container",
                "native_type": "ecs#containerinstance",
                "region": "us-east-1",
                "type": "CONTAINER"
            },
            "severity": "MEDIUM",
            "tdr_id": "46fd0cdc-252e-5e69-be6e-66e4851d7ae4",
            "tdr_source": "WIZ_SENSOR",
            "threat_id": "733edfe5-db25-5b14-ac58-dc69d6005c81",
            "threat_url": "https://test.wiz.io/issues#~(issue~'733edfe5-db25-5b14-ac58-dc69d6005c81)",
            "timeframe": {
                "end": "2025-01-21T18:52:15.838Z",
                "start": "2025-01-21T18:52:15.838Z"
            },
            "title": "Timestomping technique was detected",
            "trigger": {
                "rule_id": "a08fe977-3f54-48bf-adcf-f76994739c1f",
                "rule_name": "Detections Webhook Test Rule",
                "source": "DETECTIONS",
                "type": "Created"
            },
            "triggering_event": {
                "actor": {
                    "external_id": "test-actor",
                    "id": "4e1bd57f-49b2-47a8-a4a7-0e66fe0b770e",
                    "name": "test-actor",
                    "native_type": "Microsoft Entra ID Application Service Principal",
                    "type": "SERVICE_ACCOUNT"
                },
                "actor_ip": "81.2.69.192",
                "actor_ip_meta": {
                    "autonomous_system_number": 8075,
                    "autonomous_system_organization": "MICROSOFT-CORP-MSN-AS-BLOCK",
                    "country": "United States",
                    "is_foreign": true,
                    "reputation": "Benign",
                    "reputation_source": "Recorded Future"
                },
                "category": "Detection",
                "cloud_platform": "AWS",
                "cloud_provider_url": "https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events/Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528",
                "description": "The program /usr/bin/bash executed the program /usr/bin/touch on container test-container",
                "event_time": "2025-01-21T18:52:15.838Z",
                "external_id": "Ptrace##test-container-SensorRuleEngine##sen-id-142-bd820642-34f2-4d3c-90b6-c384df0fd528",
                "id": "2b46aa0d-9f46-5cb9-a6ae-e83ca514144a",
                "name": "Timestomping technique was detected",
                "origin": "WIZ_SENSOR",
                "resources": [
                    {
                        "cloud_account": {
                            "cloud_platform": "AWS",
                            "external_id": "134653897021",
                            "id": "5d67ed02-738e-5217-b065-d93642dd2629"
                        },
                        "external_id": "test-container",
                        "id": "da259b23-de77-5adb-8336-8c4071696305",
                        "name": "test-container",
                        "native_type": "ecs#containerinstance",
                        "region": "us-east-1",
                        "type": "CONTAINER"
                    }
                ],
                "runtime_details": {
                    "process_tree": [
                        {
                            "command": "touch -r /usr/bin /tmp/uga",
                            "container": {
                                "external_id": "test-container",
                                "id": "da259b23-de77-5adb-8336-8c4071696305",
                                "image_external_id": "sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb",
                                "image_id": "d18500ef-c0f7-5028-8c4c-1cd56c3a6652",
                                "name": "test-container"
                            },
                            "execution_time": "2025-01-21T18:52:15.838Z",
                            "hash": "a0d0c6248d07a8fa8e3b6a94e218ff9c8c372ad6",
                            "id": "1560",
                            "path": "/usr/bin/touch",
                            "size": 109616,
                            "user_id": "0",
                            "username": "root"
                        },
                        {
                            "command": "/bin/bash -x -c touch -r /usr/bin /tmp/uga",
                            "container": {
                                "external_id": "test-container",
                                "id": "da259b23-de77-5adb-8336-8c4071696305",
                                "image_external_id": "sha256:dcad76015854d8bcab3041a631d9d25d777325bb78abfa8ab0882e1b85ad84bb",
                                "image_id": "d18500ef-c0f7-5028-8c4c-1cd56c3a6652",
                                "name": "test-container"
                            },
                            "execution_time": "2025-01-21T18:52:15.838Z",
                            "hash": "91fbd9d8c65de48dc82a1064b8a4fc89f5651778",
                            "id": "1560",
                            "path": "/usr/bin/bash",
                            "size": 1265648,
                            "user_id": "0",
                            "username": "root"
                        }
                    ]
                },
                "source": "WizSensorAlert##RuleEngine",
                "status": "Success"
            },
            "triggering_events_count": 2
        }
    }
}
		

{
    "@timestamp": "2026-07-01T15:13:36.318Z",
    "cloud": {
        "account": {
            "id": [
                "100000000001"
            ],
            "name": [
                "example-cloud-account"
            ]
        },
        "provider": [
            "AWS"
        ],
        "region": "us-east-2"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "event": {
        "category": [
            "threat"
        ],
        "id": "edb74e2d-e1bd-49a6-bcd7-ec6b2f5e4980",
        "kind": "alert",
        "original": "{\"type\":\"MATCH_ONLY\",\"origins\":[\"AWS_GUARD_DUTY\"],\"actors\":[{\"id\":\"7b6ce9df-40e3-4b6f-a0a0-1238986a32a5\",\"name\":\"192.0.2.10\",\"externalId\":\"192.0.2.10\",\"providerUniqueId\":null,\"type\":\"NETWORK_ADDRESS\"}],\"resources\":[{\"id\":\"afd6a19a-3f4e-4a69-9faf-4c313217b0e2\",\"name\":\"example-vm-1\",\"externalId\":\"i-0000000000000001\",\"providerUniqueId\":null,\"type\":\"VIRTUAL_MACHINE\"}],\"cloudAccounts\":[{\"id\":\"32a7e699-c09f-4afc-abf2-1e00e2998350\",\"name\":\"example-cloud-account\",\"externalId\":\"100000000001\",\"cloudProvider\":\"AWS\"}],\"cloudOrganizations\":null,\"createdAt\":\"2026-07-01T15:12:18.1559021Z\",\"updatedAt\":\"2026-07-01T15:13:36.3181301Z\",\"id\":\"edb74e2d-e1bd-49a6-bcd7-ec6b2f5e4980\",\"severity\":\"LOW\",\"description\":\"An EC2 instance has been involved in SSH brute force attacks. This rule's final severity is assigned dynamically according to the severity assigned by GuardDuty.\",\"primaryResource\":{\"type\":\"VIRTUAL_MACHINE\",\"name\":\"example-vm-1\",\"externalId\":\"i-0000000000000001\",\"region\":\"us-east-2\",\"id\":\"afd6a19a-3f4e-4a69-9faf-4c313217b0e2\"},\"issue\":null,\"primaryActor\":{\"id\":\"7b6ce9df-40e3-4b6f-a0a0-1238986a32a5\",\"name\":\"192.0.2.10\",\"type\":\"NETWORK_ADDRESS\",\"nativeType\":null,\"email\":null,\"userAgent\":null,\"MFA\":null,\"federated\":false,\"friendlyName\":null,\"accessKeyId\":null,\"externalId\":\"192.0.2.10\",\"providerUniqueId\":null,\"hasHighPrivileges\":false,\"hasAdminPrivileges\":false,\"hasHighKubernetesPrivileges\":false,\"hasAdminKubernetesPrivileges\":false,\"inactiveInLast90Days\":false,\"actingAs\":null,\"cloudAccount\":null},\"triggeringEvents\":{\"totalCountV2\":1,\"nodes\":[{\"id\":\"031e0c27-55c2-4496-92d9-4b7a97324515\",\"description\":\"192.0.2.10 is performing SSH brute force attacks against i-0000000000000001. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.\",\"actorIP\":\"192.0.2.10\",\"timestamp\":\"2026-07-01T15:05:03.533Z\",\"rawAuditLogRecord\":{},\"commandLine\":null,\"runtimeProgram\":{\"name\":null},\"parentRuntimeProgram\":{\"name\":null}}]},\"ruleMatch\":{\"rule\":{\"id\":\"f0568339-eb51-486b-bac1-7a835689f051\",\"name\":\"UnauthorizedAccess:EC2/SSHBruteForce\",\"builtin\":true,\"securitySubCategories\":[{\"id\":\"wsct-id-3522\",\"title\":\"Brute Force\",\"category\":{\"id\":\"wct-id-822\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-34\"}}},{\"id\":\"wsct-id-3518\",\"title\":\"Brute Force: Password Guessing\",\"category\":{\"id\":\"wct-id-822\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-34\"}}},{\"id\":\"wsct-id-3517\",\"title\":\"Brute Force: Password Cracking\",\"category\":{\"id\":\"wct-id-822\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-34\"}}},{\"id\":\"wsct-id-3519\",\"title\":\"Brute Force: Password Spraying\",\"category\":{\"id\":\"wct-id-822\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-34\"}}},{\"id\":\"wsct-id-3524\",\"title\":\"Brute Force: Credential Stuffing\",\"category\":{\"id\":\"wct-id-822\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-34\"}}},{\"id\":\"wsct-id-6532\",\"title\":\"Generic malicious activity\",\"category\":{\"id\":\"wct-id-2116\",\"name\":\"Generic malicious activity\",\"framework\":{\"id\":\"wf-id-103\"}}},{\"id\":\"wsct-id-10678\",\"title\":\"Credentials guessing\",\"category\":{\"id\":\"wct-id-1854\",\"name\":\"Initial Access\",\"framework\":{\"id\":\"wf-id-83\"}}},{\"id\":\"wsct-id-10714\",\"title\":\"Abnormal-sourced communication\",\"category\":{\"id\":\"wct-id-1861\",\"name\":\"C2 & Exfiltration\",\"framework\":{\"id\":\"wf-id-83\"}}},{\"id\":\"wsct-id-20507\",\"title\":\"Brute Force\",\"category\":{\"id\":\"wct-id-2772\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-181\"}}},{\"id\":\"wsct-id-20508\",\"title\":\"Brute Force: Password Guessing\",\"category\":{\"id\":\"wct-id-2772\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-181\"}}},{\"id\":\"wsct-id-20509\",\"title\":\"Brute Force: Password Cracking\",\"category\":{\"id\":\"wct-id-2772\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-181\"}}},{\"id\":\"wsct-id-20510\",\"title\":\"Brute Force: Password Spraying\",\"category\":{\"id\":\"wct-id-2772\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-181\"}}},{\"id\":\"wsct-id-20511\",\"title\":\"Brute Force: Credential Stuffing\",\"category\":{\"id\":\"wct-id-2772\",\"name\":\"Credential Access\",\"framework\":{\"id\":\"wf-id-181\"}}}]}}}",
        "severity": 21,
        "type": [
            "indicator"
        ],
        "agent_id_status": "verified",
        "dataset": "wiz.defend_v2",
        "ingested": "2026-07-02T12:00:00.000Z"
    },
    "message": "An EC2 instance has been involved in SSH brute force attacks. This rule's final severity is assigned dynamically according to the severity assigned by GuardDuty.",
    "observer": {
        "product": "Defend",
        "vendor": "Wiz"
    },
    "related": {
        "ip": [
            "192.0.2.10"
        ]
    },
    "rule": {
        "category": [
            "Credential Access",
            "Generic malicious activity",
            "Initial Access",
            "C2 & Exfiltration"
        ],
        "id": "f0568339-eb51-486b-bac1-7a835689f051",
        "name": "UnauthorizedAccess:EC2/SSHBruteForce"
    },
    "source": {
        "ip": [
            "192.0.2.10"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "wiz-defend-v2"
    ],
    "wiz": {
        "defend_v2": {
            "actors": [
                {
                    "external_id": "192.0.2.10",
                    "id": "7b6ce9df-40e3-4b6f-a0a0-1238986a32a5",
                    "name": "192.0.2.10",
                    "type": "NETWORK_ADDRESS"
                }
            ],
            "cloud_accounts": [
                {
                    "cloud_provider": "AWS",
                    "external_id": "100000000001",
                    "id": "32a7e699-c09f-4afc-abf2-1e00e2998350",
                    "name": "example-cloud-account"
                }
            ],
            "created_at": "2026-07-01T15:12:18.155Z",
            "origins": [
                "AWS_GUARD_DUTY"
            ],
            "primary_actor": {
                "external_id": "192.0.2.10",
                "federated": false,
                "has_admin_kubernetes_privileges": false,
                "has_admin_privileges": false,
                "has_high_kubernetes_privileges": false,
                "has_high_privileges": false,
                "id": "7b6ce9df-40e3-4b6f-a0a0-1238986a32a5",
                "inactive_in_last_90_days": false,
                "name": "192.0.2.10",
                "type": "NETWORK_ADDRESS"
            },
            "primary_resource": {
                "external_id": "i-0000000000000001",
                "id": "afd6a19a-3f4e-4a69-9faf-4c313217b0e2",
                "name": "example-vm-1",
                "type": "VIRTUAL_MACHINE"
            },
            "resources": [
                {
                    "external_id": "i-0000000000000001",
                    "id": "afd6a19a-3f4e-4a69-9faf-4c313217b0e2",
                    "name": "example-vm-1",
                    "type": "VIRTUAL_MACHINE"
                }
            ],
            "rule_match": {
                "rule": {
                    "builtin": true,
                    "security_sub_categories": [
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-34"
                                },
                                "id": "wct-id-822",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-3522",
                            "title": "Brute Force"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-34"
                                },
                                "id": "wct-id-822",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-3518",
                            "title": "Brute Force: Password Guessing"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-34"
                                },
                                "id": "wct-id-822",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-3517",
                            "title": "Brute Force: Password Cracking"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-34"
                                },
                                "id": "wct-id-822",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-3519",
                            "title": "Brute Force: Password Spraying"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-34"
                                },
                                "id": "wct-id-822",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-3524",
                            "title": "Brute Force: Credential Stuffing"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-103"
                                },
                                "id": "wct-id-2116",
                                "name": "Generic malicious activity"
                            },
                            "id": "wsct-id-6532",
                            "title": "Generic malicious activity"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-83"
                                },
                                "id": "wct-id-1854",
                                "name": "Initial Access"
                            },
                            "id": "wsct-id-10678",
                            "title": "Credentials guessing"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-83"
                                },
                                "id": "wct-id-1861",
                                "name": "C2 & Exfiltration"
                            },
                            "id": "wsct-id-10714",
                            "title": "Abnormal-sourced communication"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-181"
                                },
                                "id": "wct-id-2772",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-20507",
                            "title": "Brute Force"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-181"
                                },
                                "id": "wct-id-2772",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-20508",
                            "title": "Brute Force: Password Guessing"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-181"
                                },
                                "id": "wct-id-2772",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-20509",
                            "title": "Brute Force: Password Cracking"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-181"
                                },
                                "id": "wct-id-2772",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-20510",
                            "title": "Brute Force: Password Spraying"
                        },
                        {
                            "category": {
                                "framework": {
                                    "id": "wf-id-181"
                                },
                                "id": "wct-id-2772",
                                "name": "Credential Access"
                            },
                            "id": "wsct-id-20511",
                            "title": "Brute Force: Credential Stuffing"
                        }
                    ]
                }
            },
            "severity": "LOW",
            "triggering_events": {
                "nodes": [
                    {
                        "actor_ip": "192.0.2.10",
                        "description": "192.0.2.10 is performing SSH brute force attacks against i-0000000000000001. Brute force attacks are used to gain unauthorized access to your instance by guessing the SSH password.",
                        "id": "031e0c27-55c2-4496-92d9-4b7a97324515",
                        "timestamp": "2026-07-01T15:05:03.533Z"
                    }
                ],
                "total_count": 1
            },
            "type": "MATCH_ONLY"
        }
    },
    "agent": {
        "ephemeral_id": "d95a7140-a5b6-418a-b00d-6bafacc2481e",
        "id": "0059d5e7-da05-4e3e-becb-4c4d8eaa696c",
        "name": "elastic-agent-41482",
        "type": "filebeat",
        "version": "8.19.2"
    },
    "data_stream": {
        "dataset": "wiz.defend_v2",
        "namespace": "91669",
        "type": "logs"
    },
    "elastic_agent": {
        "id": "0059d5e7-da05-4e3e-becb-4c4d8eaa696c",
        "snapshot": false,
        "version": "8.19.2"
    },
    "input": {
        "type": "cel"
    }
}
		

{
    "@timestamp": "2023-07-21T06:26:08.708Z",
    "agent": {
        "ephemeral_id": "8ed8aec5-5335-4510-a6b6-e98441f37b7a",
        "id": "07d85902-c982-4c69-8827-318fa4d8050f",
        "name": "elastic-agent-67496",
        "type": "filebeat",
        "version": "8.16.6"
    },
    "cloud": {
        "provider": "Kubernetes",
        "region": "us-01"
    },
    "data_stream": {
        "dataset": "wiz.issue",
        "namespace": "49382",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "07d85902-c982-4c69-8827-318fa4d8050f",
        "snapshot": false,
        "version": "8.16.6"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2023-08-21T07:56:09.903Z",
        "dataset": "wiz.issue",
        "id": "ggf9cggd-64a7-412c-9445-cf837f4b0b10",
        "ingested": "2026-01-07T08:55:20Z",
        "kind": "event",
        "original": "{\"createdAt\":\"2023-08-21T07:56:09.903743Z\",\"dueAt\":\"2023-08-28T21:00:00Z\",\"entitySnapshot\":{\"cloudPlatform\":\"Kubernetes\",\"cloudProviderURL\":\"https://portal.az.com/#@sectest.on.com/resource//subscriptions/\",\"externalId\":\"k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519sad45/system:aggregate-to-edit/12\",\"id\":\"f307d472-b7da-5t05-9b25-71a271336b14\",\"name\":\"system:aggregate-to-edit\",\"nativeType\":\"ClusterRole\",\"providerId\":\"k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519bac0f24ae9/system:aggregate-to-edit/12\",\"region\":\"us-01\",\"resourceGroupExternalId\":\"/subscriptions/cfd132be-3bc7-4f86-8efd-ed53ae498fec/resourcegroups/test-selfmanaged-eastus\",\"status\":\"Active\",\"subscriptionExternalId\":\"998231069301\",\"subscriptionName\":\"demo-integrations\",\"subscriptionTags\":{},\"tags\":{\"kubernetes.io/bootstrapping\":\"rbac-defaults\",\"rbac.authorization.k8s.io/aggregate-to-edit\":\"true\"},\"type\":\"ACCESS_ROLE\"},\"id\":\"ggf9cggd-64a7-412c-9445-cf837f4b0b10\",\"notes\":[{\"createdAt\":\"2023-08-21T07:56:09.903743Z\",\"serviceAccount\":{\"name\":\"rev-ke\"},\"text\":\"updated\",\"updatedAt\":\"2023-09-09T23:10:22.588721Z\"},{\"createdAt\":\"2023-08-07T23:08:49.918941Z\",\"serviceAccount\":{\"name\":\"rev-ke2\"},\"text\":\"updated\",\"updatedAt\":\"2023-08-09T23:10:22.591487Z\"}],\"projects\":[{\"businessUnit\":\"\",\"id\":\"jf77n35n-a7b6-5762-8a53-8e8f59e68bd8\",\"name\":\"Project 2\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-2\"},{\"businessUnit\":\"Dev\",\"id\":\"af52828c-4eb1-5c4e-847c-ebc3a5ead531\",\"name\":\"project 4\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-4\"},{\"businessUnit\":\"Dev\",\"id\":\"d5h1545-aec0-52fc-80ab-bacd7b02f178\",\"name\":\"Project1\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project1\"}],\"resolvedAt\":\"2023-08-09T23:10:22.588721Z\",\"serviceTickets\":[{\"externalId\":\"638361121bbfdd10f6c1cbf3604bcb7e\",\"name\":\"SIR0010002\",\"url\":\"https://ven05658.testing.com/nav_to.do?uri=%2Fsn_si_incident.do%3Fsys_id%3D6385248sdsae421\"}],\"severity\":\"INFORMATIONAL\",\"sourceRules\":[{\"__typename\":\"Control\",\"description\":\"These EKS principals assume roles that provide bind, escalate and impersonate permissions. \\n\\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.\",\"id\":\"wc-id-1335\",\"name\":\"EKS principals assume roles that provide bind, escalate and impersonate permissions\",\"resolutionRecommendation\":\"To follow the principle of least privilege and minimize the risk of unauthorized access and data breaches, it is recommended not to grant `bind`, `escalate` or `impersonate` permissions.\",\"risks\":[\"INSECURE_KUBERNETES_CLUSTER\",\"VULNERABILITY\"],\"securitySubCategories\":[{\"category\":{\"framework\":{\"name\":\"CIS EKS 1.2.0\"},\"name\":\"4.1 RBAC and Service Accounts\"},\"title\":\"4.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster - Level 1 (Manual)\"},{\"category\":{\"framework\":{\"name\":\"Wiz for Risk Assessment\"},\"name\":\"Identity Management\"},\"title\":\"Privileged principal\"},{\"category\":{\"framework\":{\"name\":\"Wiz\"},\"name\":\"9 Container Security\"},\"title\":\"Container Security\"},{\"category\":{\"framework\":{\"name\":\"Wiz for Risk Assessment\"},\"name\":\"Container \\u0026 Kubernetes Security\"},\"title\":\"Cluster misconfiguration\"}]},{\"__typename\":\"CloudEventRule\",\"description\":\"Process wrote to a security configuration file. This could indicate the presence of a threat actor tampering with security controls.\",\"id\":\"cer-sen-id-002\",\"name\":\"Security configuration file was modified\",\"risks\":[\"INSECURE_KUBERNETES_CLUSTER\",\"VULNERABILITY\"],\"securitySubCategories\":[{\"category\":{\"framework\":{\"name\":\"Wiz for Threat Detection\"},\"name\":\"Defense Evasion\"},\"title\":\"Security tool tampering\"}],\"sourceType\":\"WIZ_SENSOR\",\"type\":\"FILE_INTEGRITY_MONITORING_WORKLOAD_RUNTIME_RULE\"},{\"__typename\":\"CloudEventRule\",\"description\":\"Python process spawned interactive shell. This can indicate the presence of a malicious actor enhancing a basic reverse shell.\",\"id\":\"cer-sen-id-003\",\"name\":\"Python process spawned interactive shell\",\"risks\":[\"INSECURE_KUBERNETES_CLUSTER\",\"VULNERABILITY\"],\"securitySubCategories\":[{\"category\":{\"framework\":{\"name\":\"Wiz for Threat Detection\"},\"name\":\"C2 \\u0026 Exfiltration\"},\"title\":\"Remote shell\"}],\"sourceType\":\"WIZ_SENSOR\",\"type\":\"WORKLOAD_RUNTIME_RULE\"}],\"status\":\"IN_PROGRESS\",\"statusChangedAt\":\"2023-07-21T06:26:08.708199Z\",\"updatedAt\":\"2023-08-14T06:06:18.331647Z\"}",
        "type": [
            "info"
        ],
        "url": "https://app.wiz.io/issues#~(filters~(status~())~issue~'ggf9cggd-64a7-412c-9445-cf837f4b0b10)"
    },
    "input": {
        "type": "cel"
    },
    "message": "These EKS principals assume roles that provide bind, escalate and impersonate permissions. \n\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.",
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-issue"
    ],
    "url": {
        "domain": "portal.az.com",
        "fragment": "@sectest.on.com/resource//subscriptions/",
        "original": "https://portal.az.com/#@sectest.on.com/resource//subscriptions/",
        "path": "/",
        "scheme": "https"
    },
    "wiz": {
        "issue": {
            "created_at": "2023-08-21T07:56:09.903Z",
            "due_at": "2023-08-28T21:00:00.000Z",
            "entity_snapshot": {
                "cloud": {
                    "platform": "Kubernetes",
                    "provider_url": "https://portal.az.com/#@sectest.on.com/resource//subscriptions/"
                },
                "external_id": "k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519sad45/system:aggregate-to-edit/12",
                "id": "f307d472-b7da-5t05-9b25-71a271336b14",
                "name": "system:aggregate-to-edit",
                "native_type": "ClusterRole",
                "provider_id": "k8s/clusterrole/aaa8e7ca2bf9bc85a75d5bbdd8ffd08d69f8852782a6341c3c3519bac0f24ae9/system:aggregate-to-edit/12",
                "region": "us-01",
                "resource_group_external_id": "/subscriptions/cfd132be-3bc7-4f86-8efd-ed53ae498fec/resourcegroups/test-selfmanaged-eastus",
                "status": "Active",
                "subscription": {
                    "external_id": "998231069301",
                    "name": "demo-integrations"
                },
                "tags": {
                    "kubernetes.io/bootstrapping": "rbac-defaults",
                    "rbac.authorization.k8s.io/aggregate-to-edit": "true"
                },
                "type": "ACCESS_ROLE"
            },
            "id": "ggf9cggd-64a7-412c-9445-cf837f4b0b10",
            "notes": [
                {
                    "created_at": "2023-08-21T07:56:09.903Z",
                    "service_account": {
                        "name": "rev-ke"
                    },
                    "text": "updated",
                    "updated_at": "2023-09-09T23:10:22.588Z"
                },
                {
                    "created_at": "2023-08-07T23:08:49.918Z",
                    "service_account": {
                        "name": "rev-ke2"
                    },
                    "text": "updated",
                    "updated_at": "2023-08-09T23:10:22.591Z"
                }
            ],
            "projects": [
                {
                    "id": "jf77n35n-a7b6-5762-8a53-8e8f59e68bd8",
                    "name": "Project 2",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-2"
                },
                {
                    "business_unit": "Dev",
                    "id": "af52828c-4eb1-5c4e-847c-ebc3a5ead531",
                    "name": "project 4",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-4"
                },
                {
                    "business_unit": "Dev",
                    "id": "d5h1545-aec0-52fc-80ab-bacd7b02f178",
                    "name": "Project1",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project1"
                }
            ],
            "resolved_at": "2023-08-09T23:10:22.588Z",
            "service_tickets": [
                {
                    "external_id": "638361121bbfdd10f6c1cbf3604bcb7e",
                    "name": "SIR0010002",
                    "url": "https://ven05658.testing.com/nav_to.do?uri=%2Fsn_si_incident.do%3Fsys_id%3D6385248sdsae421"
                }
            ],
            "severity": "INFORMATIONAL",
            "source_rules": [
                {
                    "__typename": "Control",
                    "description": "These EKS principals assume roles that provide bind, escalate and impersonate permissions. \n\nThe `bind` permission allows users to create bindings to roles with rights they do not already have. The `escalate` permission allows users effectively escalate their privileges. The `impersonate` permission allows users to impersonate and gain the rights of other users in the cluster. Running containers with these permissions has the potential to effectively allow privilege escalation to the cluster-admin level.",
                    "id": "wc-id-1335",
                    "name": "EKS principals assume roles that provide bind, escalate and impersonate permissions",
                    "resolution_recommendation": "To follow the principle of least privilege and minimize the risk of unauthorized access and data breaches, it is recommended not to grant `bind`, `escalate` or `impersonate` permissions.",
                    "risks": [
                        "INSECURE_KUBERNETES_CLUSTER",
                        "VULNERABILITY"
                    ],
                    "security_sub_categories": [
                        {
                            "category": {
                                "framework": {
                                    "name": "CIS EKS 1.2.0"
                                },
                                "name": "4.1 RBAC and Service Accounts"
                            },
                            "title": "4.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster - Level 1 (Manual)"
                        },
                        {
                            "category": {
                                "framework": {
                                    "name": "Wiz for Risk Assessment"
                                },
                                "name": "Identity Management"
                            },
                            "title": "Privileged principal"
                        },
                        {
                            "category": {
                                "framework": {
                                    "name": "Wiz"
                                },
                                "name": "9 Container Security"
                            },
                            "title": "Container Security"
                        },
                        {
                            "category": {
                                "framework": {
                                    "name": "Wiz for Risk Assessment"
                                },
                                "name": "Container & Kubernetes Security"
                            },
                            "title": "Cluster misconfiguration"
                        }
                    ]
                },
                {
                    "__typename": "CloudEventRule",
                    "description": "Process wrote to a security configuration file. This could indicate the presence of a threat actor tampering with security controls.",
                    "id": "cer-sen-id-002",
                    "name": "Security configuration file was modified",
                    "risks": [
                        "INSECURE_KUBERNETES_CLUSTER",
                        "VULNERABILITY"
                    ],
                    "security_sub_categories": [
                        {
                            "category": {
                                "framework": {
                                    "name": "Wiz for Threat Detection"
                                },
                                "name": "Defense Evasion"
                            },
                            "title": "Security tool tampering"
                        }
                    ],
                    "source_type": "WIZ_SENSOR",
                    "type": "FILE_INTEGRITY_MONITORING_WORKLOAD_RUNTIME_RULE"
                },
                {
                    "__typename": "CloudEventRule",
                    "description": "Python process spawned interactive shell. This can indicate the presence of a malicious actor enhancing a basic reverse shell.",
                    "id": "cer-sen-id-003",
                    "name": "Python process spawned interactive shell",
                    "risks": [
                        "INSECURE_KUBERNETES_CLUSTER",
                        "VULNERABILITY"
                    ],
                    "security_sub_categories": [
                        {
                            "category": {
                                "framework": {
                                    "name": "Wiz for Threat Detection"
                                },
                                "name": "C2 & Exfiltration"
                            },
                            "title": "Remote shell"
                        }
                    ],
                    "source_type": "WIZ_SENSOR",
                    "type": "WORKLOAD_RUNTIME_RULE"
                }
            ],
            "status": {
                "changed_at": "2023-07-21T06:26:08.708Z",
                "value": "IN_PROGRESS"
            },
            "updated_at": "2023-08-14T06:06:18.331Z"
        }
    }
}
		

{
    "@timestamp": "2023-08-16T18:40:57.000Z",
    "agent": {
        "ephemeral_id": "4c555afd-d62f-4893-8145-235a7a2aa42e",
        "id": "c3610579-6628-4346-bac5-22eb264323cb",
        "name": "elastic-agent-39585",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "name": "wiz-integrations"
        },
        "provider": "AWS",
        "region": "us-east-1"
    },
    "data_stream": {
        "dataset": "wiz.vulnerability",
        "namespace": "50935",
        "type": "logs"
    },
    "device": {
        "id": "c828de0d-4c42-5b1c-946b-2edee094d0b3"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "c3610579-6628-4346-bac5-22eb264323cb",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "wiz.vulnerability",
        "id": "5e95ff50-5490-514e-87f7-11e56f3230ff",
        "ingested": "2025-04-22T10:01:05Z",
        "kind": "alert",
        "original": "{\"CVEDescription\":\"In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.\",\"CVSSSeverity\":\"MEDIUM\",\"dataSourceName\":\"data Source\",\"description\":\"Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`\\u003c4.0.3-35.amzn2.0.1`.\\n\\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\\n\\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.\",\"detailedName\":\"libtiff\",\"detectionMethod\":\"PACKAGE\",\"epssPercentile\":46.2,\"epssProbability\":0.1,\"epssSeverity\":\"LOW\",\"exploitabilityScore\":1.8,\"firstDetectedAt\":\"2022-05-01T11:36:10.063767Z\",\"fixedVersion\":\"4.0.3-35.amzn2.0.1\",\"hasCisaKevExploit\":false,\"hasExploit\":false,\"id\":\"5e95ff50-5490-514e-87f7-11e56f3230ff\",\"ignoreRules\":{\"enabled\":true,\"expiredAt\":\"2023-08-16T18:40:57Z\",\"id\":\"aj3jqtvnaf\",\"name\":\"abc\"},\"impactScore\":3.6,\"lastDetectedAt\":\"2023-08-16T18:40:57Z\",\"layerMetadata\":{\"details\":\"xxxx\",\"id\":\"5e95ff50-5490-514e-87f7-11e56f3230ff\",\"isBaseLayer\":true},\"link\":\"https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html\",\"locationPath\":\"package/library/file\",\"name\":\"CVE-2020-3333\",\"portalUrl\":\"https://app.wiz.io/explorer/vulnerability-findings#~(entity~(~'xxx-xxx*2cSECURITY_TOOL_FINDING))\",\"projects\":[{\"businessUnit\":\"\",\"id\":\"83b76efe-a7b6-5762-8a53-8e8f59e68bd8\",\"name\":\"Project2\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-2\"},{\"businessUnit\":\"Dev\",\"id\":\"af52828c-4eb1-5c4e-847c-ebc3a5ead531\",\"name\":\"project4\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project-4\"},{\"businessUnit\":\"Dev\",\"id\":\"d6ac50bb-aec0-52fc-80ab-bacd7b02f178\",\"name\":\"Project1\",\"riskProfile\":{\"businessImpact\":\"MBI\"},\"slug\":\"project1\"}],\"remediation\":\"yumupdatelibtiff\",\"resolutionReason\":\"resolutionReason\",\"resolvedAt\":\"2023-08-16T18:40:57Z\",\"score\":5.5,\"status\":\"OPEN\",\"validatedInRuntime\":true,\"vendorSeverity\":\"MEDIUM\",\"version\":\"4.0.3-35.amzn2\",\"vulnerableAsset\":{\"cloudPlatform\":\"AWS\",\"cloudProviderURL\":\"https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#InstanceDetails:instanceId=i-0a0f7e1451da5f4a3\",\"hasLimitedInternetExposure\":true,\"hasWideInternetExposure\":true,\"id\":\"c828de0d-4c42-5b1c-946b-2edee094d0b3\",\"ipAddresses\":[\"89.160.20.112\",\"89.160.20.128\"],\"isAccessibleFromOtherSubscriptions\":false,\"isAccessibleFromOtherVnets\":false,\"isAccessibleFromVPN\":false,\"name\":\"test-4\",\"operatingSystem\":\"Linux\",\"providerUniqueId\":\"arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3\",\"region\":\"us-east-1\",\"status\":\"Active\",\"subscriptionExternalId\":\"998231069301\",\"subscriptionId\":\"94e76baa-85fd-5928-b829-1669a2ca9660\",\"subscriptionName\":\"wiz-integrations\",\"tags\":{\"Name\":\"test-4\"},\"type\":\"VIRTUAL_MACHINE\"}}",
        "type": [
            "info"
        ]
    },
    "host": {
        "name": "test-4",
        "os": {
            "family": "Linux"
        }
    },
    "input": {
        "type": "cel"
    },
    "message": "Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`<4.0.3-35.amzn2.0.1`.\n\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\n\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.",
    "observer": {
        "vendor": "Wiz"
    },
    "package": {
        "fixed_version": "4.0.3-35.amzn2.0.1",
        "name": "libtiff",
        "version": "4.0.3-35.amzn2"
    },
    "related": {
        "ip": [
            "89.160.20.112",
            "89.160.20.128"
        ]
    },
    "resource": {
        "id": "arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3",
        "name": "test-4"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "wiz-vulnerability"
    ],
    "vulnerability": {
        "cwe": "CVE-2020-3333",
        "description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
        "id": "CVE-2020-3333",
        "package": {
            "fixed_version": "4.0.3-35.amzn2.0.1",
            "name": "libtiff",
            "version": "4.0.3-35.amzn2"
        },
        "reference": "https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html",
        "score": {
            "base": 5.5
        },
        "severity": "MEDIUM",
        "title": "Vulnerability found - CVE-2020-3333"
    },
    "wiz": {
        "vulnerability": {
            "cve_description": "In LibTIFF, there is a memory malloc failure in tif_pixarlog.c. A crafted TIFF document can lead to an abort, resulting in a remote denial of service attack.",
            "cvss_severity": "MEDIUM",
            "data_source_name": "data Source",
            "description": "Thepackage`libtiff`version`4.0.3-35.amzn2`wasdetectedin`YUMpackagemanager`onamachinerunning`Amazon2(Karoo)`isvulnerableto`CVE-2020-35522`,whichexistsinversions`<4.0.3-35.amzn2.0.1`.\n\nThevulnerabilitywasfoundinthe[OfficialAmazonLinuxSecurityAdvisories](https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html)withvendorseverity:`Medium`([NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-35522)severity:`Medium`).\n\nThevulnerabilitycanberemediatedbyupdatingthepackagetoversion`4.0.3-35.amzn2.0.1`orhigher,using`yumupdatelibtiff`.",
            "detailed_name": "libtiff",
            "detection_method": "PACKAGE",
            "epss": {
                "percentile": 46.2,
                "probability": 0.1,
                "severity": "LOW"
            },
            "exploitability_score": 1.8,
            "first_detected_at": "2022-05-01T11:36:10.063Z",
            "fixed_version": "4.0.3-35.amzn2.0.1",
            "has_cisa_kev_exploit": false,
            "has_exploit": false,
            "id": "5e95ff50-5490-514e-87f7-11e56f3230ff",
            "ignore_rules": {
                "enabled": true,
                "expired_at": "2023-08-16T18:40:57.000Z",
                "id": "aj3jqtvnaf",
                "name": "abc"
            },
            "impact_score": 3.6,
            "last_detected_at": "2023-08-16T18:40:57.000Z",
            "layer_metadata": {
                "details": "xxxx",
                "id": "5e95ff50-5490-514e-87f7-11e56f3230ff",
                "is_base_layer": true
            },
            "link": "https://alas.aws.amazon.com/AL2/ALAS-2022-1780.html",
            "location_path": "package/library/file",
            "name": "CVE-2020-3333",
            "portal_url": "https://app.wiz.io/explorer/vulnerability-findings#~(entity~(~'xxx-xxx*2cSECURITY_TOOL_FINDING))",
            "projects": [
                {
                    "id": "83b76efe-a7b6-5762-8a53-8e8f59e68bd8",
                    "name": "Project2",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-2"
                },
                {
                    "business_unit": "Dev",
                    "id": "af52828c-4eb1-5c4e-847c-ebc3a5ead531",
                    "name": "project4",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project-4"
                },
                {
                    "business_unit": "Dev",
                    "id": "d6ac50bb-aec0-52fc-80ab-bacd7b02f178",
                    "name": "Project1",
                    "risk_profile": {
                        "business_impact": "MBI"
                    },
                    "slug": "project1"
                }
            ],
            "remedation": "yumupdatelibtiff",
            "resolution_reason": "resolutionReason",
            "resolved_at": "2023-08-16T18:40:57.000Z",
            "score": 5.5,
            "status": "OPEN",
            "validated_in_runtime": true,
            "vendor_severity": "MEDIUM",
            "version": "4.0.3-35.amzn2",
            "vulnerable_asset": {
                "cloud": {
                    "platform": "AWS",
                    "provider_url": "https://us-east-1.console.aws.amazon.com/ec2/v2/home?region=us-east-1#InstanceDetails:instanceId=i-0a0f7e1451da5f4a3"
                },
                "has_limited_internet_exposure": true,
                "has_wide_internet_exposure": true,
                "id": "c828de0d-4c42-5b1c-946b-2edee094d0b3",
                "ip_addresses": [
                    "89.160.20.112",
                    "89.160.20.128"
                ],
                "is_accessible_from": {
                    "other_subscriptions": false,
                    "other_vnets": false,
                    "vpn": false
                },
                "name": "test-4",
                "operating_system": "Linux",
                "provider_unique_id": "arn:aws:ec2:us-east-1:998231069301:instance/i-0a0f7e1451da5f4a3",
                "region": "us-east-1",
                "status": "Active",
                "subscription": {
                    "external_id": "998231069301",
                    "id": "94e76baa-85fd-5928-b829-1669a2ca9660",
                    "name": "wiz-integrations"
                },
                "tags": {
                    "name": "test-4"
                },
                "type": "VIRTUAL_MACHINE"
            }
        }
    }
}