Describe the bug
When ingesting AWS CloudTrail logs using the Microsoft Sentinel AWS connector, CloudTrail events generated by AWS services may legitimately populate the UserAgent field with the value of the calling AWS service - for example: user-subscriptions.amazonaws.com.
This behavior can be confirmed as expected in this document under the "userAgent" section. CloudTrail record contents for management, data, and network activity events
When a connection comes from the "user-subscriptions.amazonaws.com" service - it creates a false=positive detection due to this logic in the analytic: | where UserAgent startswith "User" or UserAgent startswith '\"'
To Reproduce
When ingesting AWSCloudTrail logs that include calls from user-subscriptions.amazonaws.com service into Sentinel using the default connector, run the following:
AWSCloudTrail | where (UserAgent startswith "User" and UserAgent endswith ".amazonaws.com")
Expected behavior
Given the widespread use of AWS CloudTrail logs, exclude this useragent in the default analytic.
Something like:
| where not(UserAgent == "user-subscriptions.amazonaws.com" and Type == "AWSCloudTrail")
Describe the bug
When ingesting AWS CloudTrail logs using the Microsoft Sentinel AWS connector, CloudTrail events generated by AWS services may legitimately populate the UserAgent field with the value of the calling AWS service - for example: user-subscriptions.amazonaws.com.
This behavior can be confirmed as expected in this document under the "userAgent" section. CloudTrail record contents for management, data, and network activity events
When a connection comes from the "user-subscriptions.amazonaws.com" service - it creates a false=positive detection due to this logic in the analytic:
| where UserAgent startswith "User" or UserAgent startswith '\"'To Reproduce
When ingesting AWSCloudTrail logs that include calls from user-subscriptions.amazonaws.com service into Sentinel using the default connector, run the following:
AWSCloudTrail | where (UserAgent startswith "User" and UserAgent endswith ".amazonaws.com")Expected behavior
Given the widespread use of AWS CloudTrail logs, exclude this useragent in the default analytic.
Something like:
| where not(UserAgent == "user-subscriptions.amazonaws.com" and Type == "AWSCloudTrail")