Add references to rules (aws_eks_rules)

panther-labs · Dec 11, 2023 · 2b18565 · 2b18565
1 parent ca86dd4
commit 2b18565
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/rules/aws_eks_rules/source_ip_multiple_403.yml b/rules/aws_eks_rules/source_ip_multiple_403.yml
@@ -10,6 +10,7 @@ Tags:
 Reports:
   MITRE ATT&CK:
     - 'TA0007:T1613'
+Reference: https://aws.github.io/aws-eks-best-practices/security/docs/detective/
 Severity: Info
 Description: > # (Optional)
   This detection identifies if a public sourceIP is generating multiple 403s

diff --git a/rules/aws_eks_rules/system_namespace_public_ip.yml b/rules/aws_eks_rules/system_namespace_public_ip.yml
@@ -10,6 +10,7 @@ Tags:
 #Reports: # (Optional)
 #  MITRE ATT&CK:
 #    - 'TA0027:T1475' # Tactic ID:Technique ID (https://attack.mitre.org/tactics/enterprise/)
+Reference: https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html
 Severity: Info
 Description: > # (Optional)
   This detection identifies if an activity is recorded in the Kubernetes audit log where