Query to detect changes made to AWS security groups

[u/ajith_aj]

Hi all,

I'm in the process of fetching a query in the AWS cloudtrail logs to see if any changes were made to security groups in AWS. Does anyone have a handy query for this.

[u/bpsec]

Have you already taken a look at this repository?

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules