[AWS Content Packs] [OOTB Alerts] Add alerting templates #16750

Linu-Elias · 2026-01-02T04:23:18Z

Proposed commit message

Adding alerting rule templates to AWS Content Packs:

AWS VPC Flow Logs
AWS Cloudtrail Logs
AWS ELB Logs

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.
I have verified that Kibana version constraints are current according to guidelines.
I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

[ ]

How to test this PR locally

Related issues

Screenshots

muthu-mps · 2026-01-13T08:43:28Z

Template name:

Can we update the template names as below,

Excessive high-risk actions succeed

High-risk actions succeeded

Massive resource deletion from same IP

High resource deletion

Multiple error spike from same IP

High error rate

Multiple failed login attempts from same IP

Multiple failed login attempts

Applicationl level failures

Application errors

Backend target failures

Backend errors

Excessive data transfer from a single source

High data transfer rate

Excessive REJECT actions with single source IP

High reject actions.

elasticmachine · 2026-01-13T09:47:48Z

💚 Build Succeeded

Buildkite Build
Commit: a475f2a

History

💚 Build #36248 succeeded 561461a
💚 Build #36120 succeeded 5decaef
💚 Build #36108 succeeded e75240e
💔 Build #36107 failed d7273e6
💚 Build #36079 succeeded 83f3fef
💚 Build #36049 succeeded 34e0b3f

cc @Linu-Elias

tommyers-elastic

i sort of reviewed this back to front, so the more general comments are on the later rules.

i noticed that all these rules run every 5m over the last 10/15m of data. did we consider each rule independently and decide that this is the best schedule in every case?

tommyers-elastic · 2026-01-13T09:21:00Z

...s/aws_vpcflow_otel/kibana/alerting_rule_template/aws-vpcflow-otel-massive-data-transfer.json

+    "id": "aws-vpcflow-otel-massive-data-transfer",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[AWS VPC OTEL] Excessive data transfer from a single source",


[AWS VPC OTEL] doesn't seem very use friendly

can we remove 'OTEL'?

tommyers-elastic · 2026-01-13T09:27:39Z

...aws_vpcflow_otel/kibana/alerting_rule_template/aws-vpcflow-otel-high-data-transfer-rate.json

+            "searchType": "esqlQuery",
+            "timeWindowSize": 10,
+            "timeWindowUnit": "m",
+            "esqlQuery": {


i don't think we need to include WHERE @timestamp > NOW()- 10m - it's handled by the timeWindowSize param in the rule.

(same for all other rules in this PR)

tommyers-elastic · 2026-01-13T09:33:45Z

packages/aws_vpcflow_otel/kibana/alerting_rule_template/aws-vpcflow-otel-reject-ip.json

+    "id": "aws-vpcflow-otel-reject-ip",
+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[AWS VPC OTEL] Excessive REJECT actions with single source IP",


let's keep the naming consistent. above we have "from a single source", here we have "with single source IP"

tommyers-elastic · 2026-01-13T09:34:46Z

...s/aws_vpcflow_otel/kibana/alerting_rule_template/aws-vpcflow-otel-massive-data-transfer.json

+    "type": "alerting_rule_template",
+    "attributes": {
+        "name": "[AWS VPC OTEL] Excessive data transfer from a single source",
+        "tags": ["AWS VPC Logs OpenTelemetry Assets"],


this isn't a good tag name

we should have tags for 'aws', 'vpc' (and possibly 'otel'?)

(same for all other rules in this PR)

tommyers-elastic · 2026-01-13T09:39:00Z

...s/aws_vpcflow_otel/kibana/alerting_rule_template/aws-vpcflow-otel-massive-data-transfer.json

+            "timeWindowSize": 10,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "// Alert triggers when any source IP address whose bytes exceed a threshold (e.g. > 50GB in 10 minutes)\n// You can adjust the threshold value in WHERE clause as needed.\nFROM logs-aws.vpcflow.otel-default | WHERE @timestamp > NOW()- 10m | STATS total_bytes = SUM(aws.vpc.flow.bytes) BY source.address | WHERE total_bytes > 53687091200 | SORT total_bytes DESC"


do we need the SORT?

(same for all other rules)

tommyers-elastic · 2026-01-13T09:51:24Z

...dtrail_otel/kibana/alerting_rule_template/aws-cloudtrail-otel-massive-resource-deletion.json

+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 10,


should be 15m to match description

tommyers-elastic · 2026-01-13T10:01:11Z

...udtrail_otel/kibana/alerting_rule_template/aws-cloudtrail-otel-multiple-failed-login-ip.json

+        },
+        "params": {
+            "searchType": "esqlQuery",
+            "timeWindowSize": 10,


does 10m seem like a long time period for detecting failed login attempts?

tommyers-elastic · 2026-01-13T10:01:54Z

...udtrail_otel/kibana/alerting_rule_template/aws-cloudtrail-otel-multiple-failed-login-ip.json

+            "timeWindowSize": 10,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "// Alert triggers when any source IP address whose reject requests exceed a threshold (e.g. > 100 in 10 minutes)\n// You can adjust the threshold value in WHERE clause as needed.\nFROM logs-aws.cloudtrail.otel-default | WHERE @timestamp > NOW()- 10m | WHERE rpc.method == \"ConsoleLogin\" | WHERE aws.error.code IS NOT NULL | STATS failed_count = COUNT(*), users_tried = VALUES(user.name) BY source.address | WHERE failed_count >= 100 | SORT failed_count DESC"


do we need the VALUES agg here?

tommyers-elastic · 2026-01-13T10:03:57Z

...ages/aws_elb_otel/kibana/alerting_rule_template/aws-elb-otel-application-level-failures.json

+            "timeWindowSize": 10,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "// Alert triggers when any client IP address whose error count exceed a threshold (e.g. > 50 in 10 minutes)\n// You can adjust the threshold value in WHERE clause as needed.\nFROM logs-aws.elbaccess.otel-default | WHERE @timestamp > NOW()- 10m | WHERE aws.elb.status.code != 200| STATS error_count = COUNT(*) BY client.address | WHERE error_count >= 50 | SORT error_count DESC"


should client errors, e.g. 404, trigger this alert?

tommyers-elastic · 2026-01-13T10:17:21Z

...udtrail_otel/kibana/alerting_rule_template/aws-cloudtrail-otel-multiple-failed-login-ip.json

+            "timeWindowSize": 10,
+            "timeWindowUnit": "m",
+            "esqlQuery": {
+                "esql": "// Alert triggers when any source IP address whose reject requests exceed a threshold (e.g. > 100 in 10 minutes)\n// You can adjust the threshold value in WHERE clause as needed.\nFROM logs-aws.cloudtrail.otel-default | WHERE @timestamp > NOW()- 10m | WHERE rpc.method == \"ConsoleLogin\" | WHERE aws.error.code IS NOT NULL | STATS failed_count = COUNT(*), users_tried = VALUES(user.name) BY source.address | WHERE failed_count >= 100 | SORT failed_count DESC"


i had a few concerns about this rule and did a sanity check by asking chatgpt for some feedback. it has a lot of concerns about this rule.

did we get an LLM to thouroughly review all the queries here?

i don't know if the concerns are valid, but i just want to check we have considered feedback like this.

please DM me for the detail i got from GPT, but the summary was:

Primary concerns:

Threshold is orders of magnitude too high

Failure signal is weak

Missing service scoping

Detection intent is unclear

As written, this alert will almost certainly never fire for real attacks, while giving a false sense of coverage.

Linu-Elias added 7 commits January 2, 2026 09:48

Alerts

4e63f7a

fix IDs

a26bc1d

fix IDs

34e0b3f

changelog

83f3fef

add elb alerts

d7273e6

fix IDs

e75240e

fix

5decaef

Linu-Elias self-assigned this Jan 5, 2026

Linu-Elias marked this pull request as ready for review January 6, 2026 05:16

Linu-Elias requested a review from a team as a code owner January 6, 2026 05:16

Linu-Elias requested review from gpop63, muthu-mps and mykola-elastic January 8, 2026 09:23

Update aws-cloudtrail-otel-multiple-errors-spike.json

561461a

update names

a475f2a

tommyers-elastic requested changes Jan 13, 2026

View reviewed changes

[AWS Content Packs] [OOTB Alerts] Add alerting templates #16750

Are you sure you want to change the base?

[AWS Content Packs] [OOTB Alerts] Add alerting templates #16750

Uh oh!

Conversation

Linu-Elias commented Jan 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed commit message

Checklist

Author's Checklist

How to test this PR locally

Related issues

Screenshots

Uh oh!

muthu-mps commented Jan 13, 2026

Template name:

Uh oh!

elasticmachine commented Jan 13, 2026

💚 Build Succeeded

History

Uh oh!

tommyers-elastic left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Linu-Elias commented Jan 2, 2026 •

edited

Loading