LoFP / legitimate guardrail updates by authorized identities.

Techniques

• t1685

Sample rules

AWS Bedrock Guardrail Updated

• source: sigma
• technicques:
  • t1685

Description

Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses.

Detection logic

condition: selection
selection:
  eventName: UpdateGuardrail
  eventSource: bedrock.amazonaws.com