Skip to content

Lacework Cloud Security

Overview

The Lacework Cloud Security provides continuous cloud security monitoring and automated threat detection, safeguarding cloud environments with real-time insights and compliance enforcement.

The following Sekoia.io built-in rules match the intake Lacework Cloud Security. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Lacework Cloud Security on ATT&CK Navigator

Account Added To A Security Enabled Group

Detection in order to investigate who has added a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4728)

  • Effort: master
Account Removed From A Security Enabled Group

Detection in order to investigate who has removed a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4729)

  • Effort: master
Computer Account Deleted

Detects computer account deletion.

  • Effort: master
Domain Trust Created Or Removed

A trust was created or removed to a domain. An attacker could perform that in order to do lateral movement easily between domains or shutdown the ability of two domains to communicate.

  • Effort: advanced
Failed Logon Source From Public IP Addresses

A login from a public IP can indicate a misconfigured firewall or network boundary. The sekoia.tags are used to filter internal Ipv4 addresses (10.0.0.0/8 172.16.0.0/12 127.0.0.0/8 169.254.0.0/16 192.168.0.0/16).

  • Effort: master
Password Change On Directory Service Restore Mode (DSRM) Account

The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.

  • Effort: intermediate
Possible Replay Attack

This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems.

  • Effort: intermediate
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
User Account Created

Detects user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this on your windows server logs and not on your DC logs. One default account defaultuser0 is excluded as only used during Windows set-up. This detection use Security Event ID 4720.

  • Effort: master
User Account Deleted

Detects local user deletion

  • Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
AWS CloudTrail logs Lacework leverages Amazon Web Services to process the data collected by the platform
File monitoring The Lacework agent periodically scans system directories on a monitored system and generates hashes of the files located within directories
Process monitoring The Lacework agent collects metadata information about the processes running on the system.
Network intrusion detection system The Lacework agent collects metadata information about the network connections to and from the system.

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind alert
Category ``
Type ``

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\"alertId\": 813628, \"startTime\": \"2022-06-30T00:00:00.000Z\", \"alertType\": \"CloudActivityLogIngestionFailed\", \"severity\": \"High\", \"endTime\": \"2022-06-30T01:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertName\": \"Clone of Cloud Activity log ingestion failure detected\", \"alertInfo\": {\"subject\": \"Clone of Cloud Activity log ingestion failure detected: `azure-al-india-dnd` (and `3` more) is failing for data ingestion into Lacework\", \"description\": \"New integration failure detected for azure-al-india-dnd (and 3 more)\", \"supportingFacts\": [{\"supportingFactText\": \"Container Escape\", \"subElements\": [{\"supportingFactText\": \"Use of known container privilege escalation and exploit tools 6 time(s) on host(s) ip-172-18-0-240\"}]}]}, \"entityMap\": {\"API\": \"{object}\", \"CT_User\": \"{object}\", \"CT_RawTime\": \"{object}\", \"Region\": \"{object}\", \"Resource\": \"{object}\", \"RulesTriggered\": \"{object}\", \"SourceIpAddress\": \"{object}\"}}",
    "event": {
        "code": "CloudActivityLogIngestionFailed",
        "end": "2022-06-30T01:00:00Z",
        "kind": "alert",
        "reason": "Clone of Cloud Activity log ingestion failure detected",
        "start": "2022-06-30T00:00:00Z"
    },
    "@timestamp": "2022-06-30T00:00:00Z",
    "lacework": {
        "cloud_security": {
            "alert": {
                "id": 813628,
                "info": {
                    "description": "New integration failure detected for azure-al-india-dnd (and 3 more)",
                    "subject": "Clone of Cloud Activity log ingestion failure detected: `azure-al-india-dnd` (and `3` more) is failing for data ingestion into Lacework"
                },
                "severity": "High",
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "{object}"
        ]
    },
    "rule": {
        "name": "{object}"
    },
    "user": {
        "name": "{object}"
    }
}

{
    "message": "{\"alertId\": 205, \"alertName\": \"Usage of Root Account\", \"startTime\": \"2024-02-13T17:00:00.000Z\", \"alertType\": \"UsageOfRootAccount\", \"severity\": \"Info\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-13T18:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Root account was successfully used 96 times  by user  0123456789    \", \"subject\": \"Usage of Root Account:  For account: 0123456789  : Root account was successfully used 96 times  by user  0123456789    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-8\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UsageOfRootAccount",
        "end": "2024-02-13T18:00:00Z",
        "kind": "alert",
        "reason": "Usage of Root Account",
        "start": "2024-02-13T17:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-13T17:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 205,
                "info": {
                    "description": " For account: 0123456789  : Root account was successfully used 96 times  by user  0123456789    ",
                    "subject": "Usage of Root Account:  For account: 0123456789  : Root account was successfully used 96 times  by user  0123456789    "
                },
                "severity": "Info",
                "sight": 96,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "0123456789"
        ]
    },
    "user": {
        "name": "0123456789"
    }
}

{
    "message": "{\"alertId\": 206, \"alertName\": \"Unauthorized API Call\", \"startTime\": \"2024-02-13T18:00:00.000Z\", \"alertType\": \"UnauthorizedAPICall\", \"severity\": \"Medium\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-13T19:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10    \", \"subject\": \"Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-29\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UnauthorizedAPICall",
        "end": "2024-02-13T19:00:00Z",
        "kind": "alert",
        "reason": "Unauthorized API Call",
        "start": "2024-02-13T18:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-13T18:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 206,
                "info": {
                    "description": " For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10    ",
                    "subject": "Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10    "
                },
                "severity": "Medium",
                "sight": 18,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10"
        ]
    },
    "user": {
        "name": "AROAUR6F6MOZQBRKBX6RG:3e0ac0bf-fa18-4e70-8aa4-44debb525a10"
    }
}

{
    "message": "{\"alertId\": 207, \"alertName\": \"Unauthorized API Call\", \"startTime\": \"2024-02-13T19:00:00.000Z\", \"alertType\": \"UnauthorizedAPICall\", \"severity\": \"Low\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-13T20:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Unauthorized API call was attempted 99 times  by user  AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external    \", \"subject\": \"Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 99 times  by user  AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-29\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UnauthorizedAPICall",
        "end": "2024-02-13T20:00:00Z",
        "kind": "alert",
        "reason": "Unauthorized API Call",
        "start": "2024-02-13T19:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-13T19:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 207,
                "info": {
                    "description": " For account: 0123456789  : Unauthorized API call was attempted 99 times  by user  AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external    ",
                    "subject": "Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 99 times  by user  AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external    "
                },
                "severity": "Low",
                "sight": 99,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external"
        ]
    },
    "user": {
        "name": "AROAUR6F6MOZ7YRJNRFJB:LACEWORK-CFG-external"
    }
}

{
    "message": "{\"alertId\": 208, \"alertName\": \"Unauthorized API Call\", \"startTime\": \"2024-02-14T03:00:00.000Z\", \"alertType\": \"UnauthorizedAPICall\", \"severity\": \"Medium\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-14T04:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e    \", \"subject\": \"Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-29\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UnauthorizedAPICall",
        "end": "2024-02-14T04:00:00Z",
        "kind": "alert",
        "reason": "Unauthorized API Call",
        "start": "2024-02-14T03:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-14T03:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 208,
                "info": {
                    "description": " For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e    ",
                    "subject": "Unauthorized API Call:  For account: 0123456789  : Unauthorized API call was attempted 18 times  by user  AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e    "
                },
                "severity": "Medium",
                "sight": 18,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e"
        ]
    },
    "user": {
        "name": "AROAUR6F6MOZQBRKBX6RG:a7913090-862e-4cfa-ad11-80508825167e"
    }
}

{
    "message": "{\"alertId\": 209, \"alertName\": \"Usage of Root Account\", \"startTime\": \"2024-02-14T10:00:00.000Z\", \"alertType\": \"UsageOfRootAccount\", \"severity\": \"Info\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-14T11:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Root account was successfully used 83 times  by user  0123456789    \", \"subject\": \"Usage of Root Account:  For account: 0123456789  : Root account was successfully used 83 times  by user  0123456789    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-8\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UsageOfRootAccount",
        "end": "2024-02-14T11:00:00Z",
        "kind": "alert",
        "reason": "Usage of Root Account",
        "start": "2024-02-14T10:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-14T10:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 209,
                "info": {
                    "description": " For account: 0123456789  : Root account was successfully used 83 times  by user  0123456789    ",
                    "subject": "Usage of Root Account:  For account: 0123456789  : Root account was successfully used 83 times  by user  0123456789    "
                },
                "severity": "Info",
                "sight": 83,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "0123456789"
        ]
    },
    "user": {
        "name": "0123456789"
    }
}

{
    "message": "{\"alertId\": 210, \"alertName\": \"Usage of Root Account\", \"startTime\": \"2024-02-14T11:00:00.000Z\", \"alertType\": \"UsageOfRootAccount\", \"severity\": \"Info\", \"internetExposure\": \"UnknownInternetExposure\", \"reachability\": \"UnknownReachability\", \"derivedFields\": {\"category\": \"Policy\", \"sub_category\": \"Cloud Activity\", \"source\": \"AWS\"}, \"endTime\": \"2024-02-14T12:00:00.000Z\", \"lastUserUpdatedTime\": \"\", \"status\": \"Open\", \"alertInfo\": {\"description\": \" For account: 0123456789  : Root account was successfully used 8 times  by user  0123456789    \", \"subject\": \"Usage of Root Account:  For account: 0123456789  : Root account was successfully used 8 times  by user  0123456789    \", \"customerCount\": 0, \"isExpectedLWBehavior\": false}, \"policyId\": \"lacework-global-8\", \"evolvingAlert\": false, \"tagMetadata\": []}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "UsageOfRootAccount",
        "end": "2024-02-14T12:00:00Z",
        "kind": "alert",
        "reason": "Usage of Root Account",
        "start": "2024-02-14T11:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2024-02-14T11:00:00Z",
    "lacework": {
        "cloud_security": {
            "account": {
                "name": "0123456789"
            },
            "alert": {
                "id": 210,
                "info": {
                    "description": " For account: 0123456789  : Root account was successfully used 8 times  by user  0123456789    ",
                    "subject": "Usage of Root Account:  For account: 0123456789  : Root account was successfully used 8 times  by user  0123456789    "
                },
                "severity": "Info",
                "sight": 8,
                "status": "Open"
            }
        }
    },
    "observer": {
        "product": "Lacework Cloud Security",
        "vendor": "Lacework"
    },
    "related": {
        "user": [
            "0123456789"
        ]
    },
    "user": {
        "name": "0123456789"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.end date event.end contains the date when the event ended or when the activity was last observed.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.start date event.start contains the date when the event started or when the activity was first observed.
event.type keyword Event type. The third categorization field in the hierarchy.
lacework.cloud_security.account.name keyword Account name
lacework.cloud_security.alert.id long Lacework alert ID
lacework.cloud_security.alert.info.description keyword Alert info description
lacework.cloud_security.alert.info.subject keyword Alert info subject
lacework.cloud_security.alert.severity keyword Alert severity
lacework.cloud_security.alert.sight long Number of times an alert have been seen
lacework.cloud_security.alert.status keyword Alert status
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
rule.name keyword Rule name
source.ip ip IP address of the source.
user.name keyword Short name or login of the user.

Configure

Prerequisites

To create API keys, you must have the account admin role or otherwise have write permissions for API keys in the Lacework Console.

Create Lacework Credentials

Create a service user

In the lacework console:

  1. Go to Settings

    step 1

  2. In the settings, go to Access Control > Users > Account level and click + Add New

    step 2

  3. To create a service user:

    1. Select Service user as user type
    2. Give the user a name and an optional description

    3. Click Next

      step 3

    4. Select Read-Only User as user group

    5. Click Save

      step 4

Create API keys

In the Lacework console:

  1. In the Settings, go to Configuration > API keys > Service User API Keys and click + Add New

    step 5

  2. To create an API Key:

    1. Give the key a name and an optional description.

    2. Click Save.

      step 6

Download the generated API key file and open it in an editor to view and use the key ID and generated secret in your API requests. You can create up to 20 API keys.

Create an intake

Go to the intake page and create a new intake from the Lacework Cloud Security format.

Pull events

To start to pull events, you have to:

  1. Go to the Playbook page.
  2. Click on + PLAYBOOK and choose Create a playbook from scratch.
  3. Give it a name and a description and click on Next.
  4. In Choose a trigger, select Fetch new logs from Lacework.
  5. On the right sidebar, in "Using which account ?", select + Add new account.
  6. Write a name and set up the account configuration with the account, the keyId and the secret of your API Key.
  7. In the Trigger Configuration section, click on Create new configuration.
  8. Write a name, choose a frequency - Default is 60 -, paste the intake_key associated to your Lacework Cloud Security intake and click on Save.
  9. On the top right corner, start the Playbook. You should see monitoring messages in the Trigger logs section.
  10. Check on the Events page that the Lacework logs are being received.

Further Readings