MENU
      Contents x
      Soteria AWS Rules
      • 10 Dec 2024
      • 1 Minute to read
      • Print
      • Dark
      Contents

      Soteria AWS Rules

      • Updated on 10 Dec 2024
      • 1 Minute to read
      • Print
      • Dark
      Article summary

      Soteria's AWS ruleset provides coverage across multiple AWS telemetry streams, including:

      Data access

      Please note that Soteria won’t get access to your data, and you won’t be able to see or edit their rules - LimaCharlie acts as a broker between the two parties.

      To leverage detection logic provided by the ruleset:

      1. Subscribe your tenant to the Soteria AWS ruleset extension.

      2. Subscribe your tenant to tor lookup (provided at no cost).

      3. Configure AWS CloudTrail and AWS GuardDuty Adapters to start collecting AWS audit logs.

      Enabling Soteria's AWS Rules

      Soteria's AWS rules can be activated via two means.

      Activating via the Web UI

      To enable Soteria's AWS ruleset, navigate to the Extensions section of the Add-On Marketplace and search for Soteria. You can also directly select soteria-rules-aws.

      image.png

      Please note: Pricing may reflect when the screenshot was taken, not the actual pricing

      Under the Organization dropdown, select a tenant (organization) you want to subscribe to Soteria AWS rules and click Subscribe.

      image.png

      You can also manage add-ons from the Subscriptions menu under Billing.

      image.png

      Organizations that have been subscribed to Soteria's AWS rules will be marked with a green check mark in the Organization dropdown.

      Infrastructure as Code

      Alternatively, to manage tenants and LimaCharlie functionality at scale, you can leverage our Infrastructure as Code functionality.

      Was this article helpful?
      Related articles
      What's Next