AWS EC2 Encryption Disablededit

Identifies disabling of Amazon Elastic Block Store (EBS) encryption by default in the current region. Disabling encryption by default does not change the encryption status of your existing volumes.

Rule type: query

Rule indices:

  • filebeat-*
  • logs-aws*

Severity: medium

Risk score: 47

Runs every: 10m

Searches indices from: now-60m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100



  • Domain: Cloud
  • Data Source: AWS
  • Data Source: Amazon Web Services
  • Tactic: Impact

Version: 205

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guideedit

Rule queryedit

event.dataset:aws.cloudtrail and and event.action:DisableEbsEncryptionByDefault and event.outcome:success