diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml index 23f9e800c1..353baeda04 100644 --- a/prowler/config/config.yaml +++ b/prowler/config/config.yaml @@ -40,6 +40,12 @@ aws: # aws.cloudwatch_log_group_retention_policy_specific_days_enabled --> by default is 365 days log_group_retention_days: 365 + # AWS CloudTrail Configuration + # aws.cloudtrail_threat_detector_privilege_escalation + # aws.cloudtrail_threat_detector_enumeration + threat_detection_entropy: 0.7 # 70% of actions found to decide if it is an attack event + threat_detection_days: 1 + # AWS AppStream Session Configuration # aws.appstream_fleet_session_idle_disconnect_timeout max_idle_disconnect_timeout_in_seconds: 600 # 10 Minutes diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py index 47f8089aba..ce9c723b93 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_enumeration/cloudtrail_threat_detector_enumeration.py @@ -5,7 +5,7 @@ cloudtrail_client, ) -ENTROPY_THRESHOLD = 0.7 +ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get("threat_detection_entropy", 0.7) THREAT_DETECTION_DAYS = cloudtrail_client.audit_config.get("threat_detection_days", 1) ENUMERATION_ACTIONS = [ "DescribeAccessEntry", diff --git a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py index cccc5b1293..cc673c91a6 100644 --- a/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py +++ b/prowler/providers/aws/services/cloudtrail/cloudtrail_threat_detector_privilege_escalation/cloudtrail_threat_detector_privilege_escalation.py @@ -5,7 +5,7 @@ cloudtrail_client, ) -ENTROPY_THRESHOLD = 0.7 +ENTROPY_THRESHOLD = cloudtrail_client.audit_config.get("threat_detection_entropy", 0.7) THREAT_DETECTION_DAYS = cloudtrail_client.audit_config.get("threat_detection_days", 1) PRIVILEGE_ESCALATION_ACTIONS = [ "AddPermission",