AWS Iam Successful Group Deletion

AWS Iam Successful Group Deletion

Description

The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser to additional events thay may unfold. Review parallel IAM events - recently added users, new groups and so forth. Inversely, review failed attempts in a similar manner.

   Help

AWS Iam Successful Group Deletion Help

The Splunk AWS Add-on and Splunk App for AWS is required to utilize this data. The search requires AWS Cloudtrail logs.

   Search

Open in Search