Tuning runbook for EC2 Download User Data (#1522)

panther-labs · Feb 13, 2025 · 5ef0a45 · 5ef0a45
1 parent 980b44f
commit 5ef0a45
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/rules/aws_cloudtrail_rules/aws_ec2_download_instance_user_data.yml b/rules/aws_cloudtrail_rules/aws_ec2_download_instance_user_data.yml
@@ -19,6 +19,9 @@ Runbook: >
   An entity has accessed the user data scripts of multiple EC2 instances. This is
   often an attempt to find unsecured credentials. Ensure the EC2 instances accessed
   do not have any sensitive information stored in the user data.
+
+  Cloud security scanning tools may trigger false positives.  Add an exclude filter for
+  the scanning tool's service account to prevent false positives.
 SummaryAttributes:
   - userAgent
   - sourceIpAddress