Add detection for repeated CloudWatch Logs read operations - #4288

Summary

Adds an AWS CloudTrail analytic that detects more than 500 Amazon CloudWatch Logs read operations performed by the same principal and AWS account within a rolling five-minute window.

Monitored operations

• DescribeLogGroups
• DescribeLogStreams
• DownloadLogEvents
• FilterLogEvents
• GetLogEvents
• GetQueryResults

Detection details

• Groups activity by AWS principal ID and account
• Uses a rolling five-minute window
• Requires more than 500 matching operations
• Maps to MITRE ATT&CK T1530
• Uses AWS CloudTrail management read events

Testing

• Validated with 650 unique GetLogEvents events generated in 37 seconds
• Passed contentctl validation
• Passed the focused contentctl unit test

Attack data

splunk/attack_data#1225