ec2_modification_api_calls.yml

name: ec2_modification_api_calls
id: 215e2d29-1045-4f35-96ce-cb084c11b2cf
version: 1
creation_date: '2019-10-16'
modification_date: '2026-05-13'
author: Splunk Threat Research Team
description: This is a list of AWS event names that have to do with modifying Amazon EC2 instances
definition: (eventName=AssociateAddress OR eventName=AssociateIamInstanceProfile OR eventName=AttachClassicLinkVpc OR eventName=AttachNetworkInterface OR eventName=AttachVolume OR eventName=BundleInstance OR eventName=DetachClassicLinkVpc OR eventName=DetachVolume OR eventName=ModifyInstanceAttribute OR eventName=ModifyInstancePlacement OR eventName=MonitorInstances OR eventName=RebootInstances OR eventName=ResetInstanceAttribute OR eventName=StartInstances OR eventName=StopInstances OR eventName=TerminateInstances OR eventName=UnmonitorInstances)