Skip to content

Event Detection

Use Nova reasoning models to identify, classify, and analyze events from data streams or text.

System Prompt Template

  You are an expert {domain} analyst who specializes in detecting and analyzing {event types}.
  Identify relevant events from the provided data and provide detailed analysis.

User Prompt Template

  ## Data ##
  {data stream/text/logs}

  ## Detection Criteria ##
  {specific events to detect}

  Ask clarifying questions if needed.

Example

Amazon Nova 2 Lite System Prompt

  You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs.
  Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions.

Amazon Nova 2 Lite User Prompt

  ## Data ##
  ```
  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100
  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf
  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com
  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50
  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL
  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)
  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com
  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com
  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe
  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75
  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task
  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42
  ```

  ## Detection Criteria ##
  Identify and analyze:
  - Brute force attacks
  - Insider threat indicators
  - Malware/suspicious file activity
  - Data exfiltration attempts
  - Network anomalies
  - Account compromise indicators

  For each detected event, provide:
  - Event classification and severity
  - Timeline and affected systems/users
  - Potential impact assessment
  - Recommended immediate actions
  - Investigation priorities

  Ask clarifying questions if needed.

Amazon Nova 2 Lite Sample Response

Response

Security Incident Analysis Report

Executive Summary

The provided log data contains several security events that warrant immediate attention. These include brute force attacks, insider threat indicators, malware/suspicious file activity, data exfiltration attempts, network anomalies, and account compromise indicators. Each event is classified, analyzed for severity, timeline, impact, and recommended actions are provided.

1. Brute Force Attack

Event Classification & Severity

  • Classification: Brute Force Attack
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:24:12 – 2024-03-19 14:24:31
  • User: admin@company.com
  • Source IP: 203.0.113.45
  • Action: Three consecutive failed login attempts followed by an account lockout.

Potential Impact

  • Account Compromise: The admin@company.com account was locked out, preventing legitimate access.
  • Privilege Escalation Risk: If the attacker had succeeded, they could have gained administrative privileges.
  • Lateral Movement: Admin credentials could be used to access other systems or sensitive data.
  1. Unlock the Account: After confirming no malicious activity is ongoing, unlock the admin@company.com account.
  2. Reset Password: Force a password reset for the admin@company.com account and ensure it meets strong complexity requirements.
  3. Review Recent Activity: Check for any actions performed by admin@company.com prior to the lockout.
  4. Block Malicious IP: Add 203.0.113.45 to the denylist/firewall blocklist.
  5. Enable MFA: If not already enabled, enforce Multi-Factor Authentication (MFA) for the admin account.

Investigation Priorities

  • Review all authentication logs for admin@company.com over the past 7 days.
  • Check for any other IPs or locations attempting to access the admin account.
  • Determine if the attacker used any known credential stuffing lists.

2. Insider Threat Indicators

Event Classification & Severity

  • Classification: Insider Threat / Data Misuse
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:25:15 – 2024-03-19 14:25:22
  • User: sarah.smith@company.com
  • Action:
  • Executed a database query filtering for records where ssn IS NOT NULL.
  • Initiated a large data export of 50,000 records.

Potential Impact

  • Data Exposure: Potential exposure of Sensitive Personal Information (SPI) — specifically Social Security Numbers (SSNs).
  • Data Exfiltration Risk: Large-scale export of sensitive data may indicate preparation for data exfiltration or insider misuse.
  • Regulatory Violations: Breach of data protection laws (e.g., GDPR, HIPAA) if SSNs are exported unauthorized.
  1. Quarantine Export: Prevent the data export from completing or being downloaded.
  2. Review Export Destination: Determine where the exported data was sent (e.g., local drive, cloud, external device).
  3. Audit User Activity: Review all actions performed by sarah.smith@company.com before and after the export.
  4. Interview User: Conduct a formal interview with Sarah Smith to understand the purpose of the query and export.
  5. Access Control Review: Ensure that sarah.smith@company.com has appropriate access rights and no excessive permissions.

Investigation Priorities

  • Analyze database access logs for any other suspicious queries by Sarah or others.
  • Check for any anomalies in network traffic or file transfers from her workstation.
  • Review recent changes to data access policies or permissions.

3. Malware / Suspicious File Activity

Event Classification & Severity

  • Classification: Malware / Suspicious File Detection
  • Severity: Critical

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:27:30
  • User: mike.wilson@company.com
  • Action: Antivirus alert for a suspicious file detected at /tmp/update.exe.

Potential Impact

  • Malware Infection: The file could be malware (e.g., ransomware, trojan, downloader).
  • Lateral Movement: If executed, it may attempt to spread to other systems or exfiltrate data.
  • Persistence Mechanism: Could establish a backdoor or scheduled task for future access.
  1. Isolate the System: Disconnect the affected workstation from the network immediately.
  2. Quarantine the File: Prevent /tmp/update.exe from executing.
  3. Scan System: Perform a full antivirus/anti-malware scan on the system.
  4. Analyze File: Submit the file to a sandbox or malware analysis tool to determine its behavior.
  5. Check for Execution: Determine whether the file was executed or just detected.

Investigation Priorities

  • Review process monitoring logs to see if the file was executed.
  • Examine recent downloads, USB devices, or email attachments related to the user.
  • Check for any changes to system settings, scheduled tasks, or services.
  • Review network traffic for any outbound connections from the affected system.

4. Data Exfiltration Attempt

Event Classification & Severity

  • Classification: Data Exfiltration Attempt
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:25:22
  • User: sarah.smith@company.com
  • Action: Initiated export of 50,000 records — likely sensitive customer data.

Potential Impact

  • Data Theft: If completed, this could lead to massive data breach.
  • Financial Loss: Fines, legal liabilities, and reputational damage.
  • Identity Theft: Exposure of customer SSNs could enable identity theft.
  1. Stop Export Process: If still in progress, halt the export immediately.
  2. Check Export Status: Determine whether the data was successfully exported and where it was sent.
  3. Review Network Traffic: Look for large outbound transfers or connections to external IPs/domains.
  4. Preserve Logs: Retain all logs related to this export for forensic analysis and potential legal action.

Investigation Priorities

  • Correlate with the database query (SELECT * FROM customer_data WHERE ssn IS NOT NULL) to confirm the data exported contains SSNs.
  • Check for any encryption or compression of the exported data.
  • Determine if the export was triggered via an application, SQL client, or script.

5. Network Anomaly

Event Classification & Severity

  • Classification: Network Anomaly / Potential Exfiltration
  • Severity: Medium to High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:29:33
  • Source IP: 185.220.101.42
  • Action: Unusual outbound traffic detected.

Potential Impact

  • Data Exfiltration: Traffic could be carrying sensitive data to an external IP.
  • Command & Control (C2): Could indicate a compromised system beaconing to a C2 server.
  • Lateral Movement: Could be part of an attacker's reconnaissance or data movement phase.
  1. Block Destination IP: Add 185.220.101.42 to the firewall denylist.
  2. Inspect Traffic: Review packet captures (PCAPs) or NetFlow logs for details on the traffic (port, protocol, size, timing).
  3. Identify Source System: Determine which internal system initiated the connection to 185.220.101.42.
  4. Scan Source System: If identified, scan the source system for malware or unauthorized software.

Investigation Priorities

  • Determine if 185.220.101.42 is known malicious (e.g., via threat intelligence feeds).
  • Correlate with other logs (e.g., endpoint logs) to see if any system contacted this IP around the same time.
  • Check for any DNS lookups or HTTP requests to known malicious domains.

6. Account Compromise Indicators

Event Classification & Severity

  • Classification: Account Compromise / Suspicious Login
  • Severity: Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:27:12
  • User: mike.wilson@company.com
  • Action: Unusual file access pattern detected.

Potential Impact

  • Unauthorized Data Access: The user may have accessed files they shouldn't have, indicating compromise or insider misuse.
  • Privilege Abuse: If Mike's account is compromised, attacker may abuse privileges.
  1. Review File Access Logs: Identify which files were accessed and by what process/user.
  2. Check for Anomalies: Look for access to sensitive directories (e.g., /etc/passwd, /home/*, /tmp).
  3. Reset Credentials: Force password reset for mike.wilson@company.com.
  4. Enable MFA: If not already enabled, enforce MFA for this account.

Investigation Priorities

  • Correlate with the suspicious file detection (/tmp/update.exe) — could be related.
  • Review recent login history and IP addresses for mike.wilson@company.com.
  • Check for any unusual processes or scheduled tasks running under his account.

7. Additional Suspicious Activity

Multiple Failed SSH Attempts

Event Classification & Severity

  • Classification: Brute Force / Reconnaissance
  • Severity: Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:28:01
  • Source IP: 198.51.100.75
  • Action: Multiple failed SSH attempts.

Potential Impact

  • Privilege Escalation Attempt: SSH access often provides high-level system access.
  • Reconnaissance: Attacker may be probing for vulnerabilities.
  1. Block IP: Add 198.51.100.75 to the firewall denylist.
  2. Review SSH Logs: Check for successful logins from this IP or others.
  3. Enforce Strong SSH Policies: Disable root login, use key-based authentication, limit SSH users.

Investigation Priorities

  • Check if any successful logins occurred from this IP or related IPs.
  • Determine if any brute force tools (e.g., Hydra) were used.

VPN Connection Established

Event Classification & Severity

  • Classification: Normal Activity / Potential Risk
  • Severity: Low to Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:26:45
  • User: mike.wilson@company.com
  • Source IP: 198.51.100.75

Potential Impact

  • Legitimate Access: Could be a legitimate remote user connecting in.
  • Risk: If the user's device is compromised, the attacker now has access via VPN.
  1. Verify User Location: Confirm if Mike Wilson was legitimately working remotely.
  2. Review Device Security Posture: Ensure the device used to connect is secure and up to date.
  3. Monitor Session: Log all actions performed during the VPN session for anomalies.

Investigation Priorities

  • Correlate with other logs (e.g., endpoint logs) during the time of the VPN connection.
  • Check if any suspicious processes or file modifications occurred during the session.

Summary of Immediate Actions

Incident Action
Brute Force on Admin Account Unlock, reset password, enable MFA, block IP
Insider Data Export Stop export, audit user, preserve logs
Suspicious File Detection Isolate system, scan, analyze file
Network Anomaly Block IP, inspect traffic, identify source
Unusual File Access Review logs, reset password, enable MFA
Failed SSH Attempts Block IP, review SSH logs
VPN Connection Verify legitimacy, monitor session

Next Steps / Investigation Roadmap

  1. Forensic Imaging: Perform forensic imaging of systems involved (especially Mike Wilson's workstation).
  2. Threat Intelligence Lookup: Query 203.0.113.45, 198.51.100.75, and 185.220.101.42 in threat intelligence platforms (e.g., VirusTotal, AlienVault, Mandiant).
  3. User Interviews: Conduct interviews with Sarah Smith and Mike Wilson.
  4. Access Review: Conduct a full access control review for all users involved.
  5. Incident Response Plan Activation: If not already active, initiate the Incident Response Plan.
  6. Regulatory Reporting: If customer data was exposed, prepare for potential regulatory reporting (e.g., GDPR, HIPAA).

Clarifying Questions (if needed)

To further enhance the analysis, the following information would be helpful:

  1. What type of system is being logged? (e.g., SIEM, web app, endpoint, firewall)
  2. Is Multi-Factor Authentication (MFA) enabled for admin or other accounts?
  3. What are the access controls and permissions for the customer_data database?
  4. Do you have endpoint detection and response (EDR) tools deployed?
  5. Are there any existing security policies regarding large data exports or SSN access?
  6. What is the typical user behavior for mike.wilson@company.com?
  7. Is there a SOAR or automated response system in place?

If you can provide any of this context, I can refine the analysis and recommendations accordingly.

API Request

import boto3
import json

# Initialize the Bedrock Runtime client
bedrock_runtime = boto3.client('bedrock-runtime', region_name='us-west-2')

# Define the system prompt
system_prompt = """You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs.
  Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions."""

# Define the user prompt
user_prompt = """## Data ##
  ```
  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100
  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf
  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com
  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50
  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL
  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)
  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com
  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com
  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe
  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75
  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task
  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42
  ```

  ## Detection Criteria ##
  Identify and analyze:
  - Brute force attacks
  - Insider threat indicators
  - Malware/suspicious file activity
  - Data exfiltration attempts
  - Network anomalies
  - Account compromise indicators

  For each detected event, provide:
  - Event classification and severity
  - Timeline and affected systems/users
  - Potential impact assessment
  - Recommended immediate actions
  - Investigation priorities

  Ask clarifying questions if needed."""

# Prepare the request
request_body = {
    "system": [
        {
            "text": system_prompt
        }
    ],
    "messages": [
        {
            "role": "user",
            "content": [
                {
                    "text": user_prompt
                }
            ]
        }
    ],
    "toolConfig": {
        "tools": [
            {
                "systemTool": {
                    "name": "nova_grounding"
                }
            },
            {
                "systemTool": {
                    "name": "nova_code_interpreter"
                }
            }
        ]
    },
    "additionalModelRequestFields": {
        "reasoningConfig": {
            "type": "enabled",
            "maxReasoningEffort": "low"
        }
    },
    "inferenceConfig": {
        "temperature": 0.3,
        "topP": 0.9,
        "maxTokens": 10000
    }
}

# Make the API call
response = bedrock_runtime.converse(
    modelId="amazon.nova-2-lite-v1:0",
    **request_body
)

# Print the response
print(json.dumps(response, indent=2, default=str))

aws bedrock-runtime converse \
  --model-id "amazon.nova-2-lite-v1:0" \
  --system '[
    {
      "text": "You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs. Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions."
    }
  ]' \
  --messages '[
    {
      "role": "user",
      "content": [
        {
          "text": "## Data ##\n```\n2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100\n2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf\n2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com\n2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50\n2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL\n2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)\n2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com\n2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com\n2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe\n2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75\n2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task\n2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42\n```\n\n## Detection Criteria ##\nIdentify and analyze:\n- Brute force attacks\n- Insider threat indicators\n- Malware/suspicious file activity\n- Data exfiltration attempts\n- Network anomalies\n- Account compromise indicators\n\nFor each detected event, provide:\n- Event classification and severity\n- Timeline and affected systems/users\n- Potential impact assessment\n- Recommended immediate actions\n- Investigation priorities\n\nAsk clarifying questions if needed."
        }
      ]
    }
  ]' \
  --additional-model-request-fields '{
    "reasoningConfig": {
      "type": "enabled",
      "maxReasoningEffort": "low"
    }
  }' \
  --region us-west-2

{
 "system": "You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs.\n  Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions.",
 "messages": [
  {
   "role": "user",
   "content": [
    {
     "text": "## Data ##\n  ```\n  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100\n  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf\n  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com\n  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50\n  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL\n  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)\n  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com\n  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com\n  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe\n  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75\n  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task\n  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42\n  ```\n  \n  ## Detection Criteria ##\n  Identify and analyze:\n  - Brute force attacks\n  - Insider threat indicators\n  - Malware/suspicious file activity\n  - Data exfiltration attempts\n  - Network anomalies\n  - Account compromise indicators\n  \n  For each detected event, provide:\n  - Event classification and severity\n  - Timeline and affected systems/users\n  - Potential impact assessment\n  - Recommended immediate actions\n  - Investigation priorities\n  \n  Ask clarifying questions if needed."
    }
   ]
  }
 ],
 "additionalModelRequestFields": {
  "reasoningConfig": {
   "type": "enabled",
   "maxReasoningEffort": "high"
  }
 }
}

Amazon Nova 2 Lite User Prompt

  ## Data ##
  ```
  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100
  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf
  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com
  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50
  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL
  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)
  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com
  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com
  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe
  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75
  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task
  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42
  ```

  ## Detection Criteria ##
  Identify and analyze:
  - Brute force attacks
  - Insider threat indicators
  - Malware/suspicious file activity
  - Data exfiltration attempts
  - Network anomalies
  - Account compromise indicators

  For each detected event, provide:
  - Event classification and severity
  - Timeline and affected systems/users
  - Potential impact assessment
  - Recommended immediate actions
  - Investigation priorities

  Ask clarifying questions if needed.

Amazon Nova 2 Lite Sample Response

Response

Security Incident Analysis Report

Executive Summary

The provided log data contains several security events that warrant immediate attention. These include brute force attacks, insider threat indicators, malware/suspicious file activity, data exfiltration attempts, network anomalies, and account compromise indicators. Each event is classified, analyzed for severity, timeline, impact, and recommended actions are provided.

1. Brute Force Attack

Event Classification & Severity

  • Classification: Brute Force Attack
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:24:12 – 2024-03-19 14:24:31
  • User: admin@company.com
  • Source IP: 203.0.113.45
  • Action: Three consecutive failed login attempts followed by an account lockout.

Potential Impact

  • Account Compromise: The admin@company.com account was locked out, preventing legitimate access.
  • Privilege Escalation Risk: If the attacker had succeeded, they could have gained administrative privileges.
  • Lateral Movement: Admin credentials could be used to access other systems or sensitive data.
  1. Unlock the Account: After confirming no malicious activity is ongoing, unlock the admin@company.com account.
  2. Reset Password: Force a password reset for the admin@company.com account and ensure it meets strong complexity requirements.
  3. Review Recent Activity: Check for any actions performed by admin@company.com prior to the lockout.
  4. Block Malicious IP: Add 203.0.113.45 to the denylist/firewall blocklist.
  5. Enable MFA: If not already enabled, enforce Multi-Factor Authentication (MFA) for the admin account.

Investigation Priorities

  • Review all authentication logs for admin@company.com over the past 7 days.
  • Check for any other IPs or locations attempting to access the admin account.
  • Determine if the attacker used any known credential stuffing lists.

2. Insider Threat Indicators

Event Classification & Severity

  • Classification: Insider Threat / Data Misuse
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:25:15 – 2024-03-19 14:25:22
  • User: sarah.smith@company.com
  • Action:
  • Executed a database query filtering for records where ssn IS NOT NULL.
  • Initiated a large data export of 50,000 records.

Potential Impact

  • Data Exposure: Potential exposure of Sensitive Personal Information (SPI) — specifically Social Security Numbers (SSNs).
  • Data Exfiltration Risk: Large-scale export of sensitive data may indicate preparation for data exfiltration or insider misuse.
  • Regulatory Violations: Breach of data protection laws (e.g., GDPR, HIPAA) if SSNs are exported unauthorized.
  1. Quarantine Export: Prevent the data export from completing or being downloaded.
  2. Review Export Destination: Determine where the exported data was sent (e.g., local drive, cloud, external device).
  3. Audit User Activity: Review all actions performed by sarah.smith@company.com before and after the export.
  4. Interview User: Conduct a formal interview with Sarah Smith to understand the purpose of the query and export.
  5. Access Control Review: Ensure that sarah.smith@company.com has appropriate access rights and no excessive permissions.

Investigation Priorities

  • Analyze database access logs for any other suspicious queries by Sarah or others.
  • Check for any anomalies in network traffic or file transfers from her workstation.
  • Review recent changes to data access policies or permissions.

3. Malware / Suspicious File Activity

Event Classification & Severity

  • Classification: Malware / Suspicious File Detection
  • Severity: Critical

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:27:30
  • User: mike.wilson@company.com
  • Action: Antivirus alert for a suspicious file detected at /tmp/update.exe.

Potential Impact

  • Malware Infection: The file could be malware (e.g., ransomware, trojan, downloader).
  • Lateral Movement: If executed, it may attempt to spread to other systems or exfiltrate data.
  • Persistence Mechanism: Could establish a backdoor or scheduled task for future access.
  1. Isolate the System: Disconnect the affected workstation from the network immediately.
  2. Quarantine the File: Prevent /tmp/update.exe from executing.
  3. Scan System: Perform a full antivirus/anti-malware scan on the system.
  4. Analyze File: Submit the file to a sandbox or malware analysis tool to determine its behavior.
  5. Check for Execution: Determine whether the file was executed or just detected.

Investigation Priorities

  • Review process monitoring logs to see if the file was executed.
  • Examine recent downloads, USB devices, or email attachments related to the user.
  • Check for any changes to system settings, scheduled tasks, or services.
  • Review network traffic for any outbound connections from the affected system.

4. Data Exfiltration Attempt

Event Classification & Severity

  • Classification: Data Exfiltration Attempt
  • Severity: High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:25:22
  • User: sarah.smith@company.com
  • Action: Initiated export of 50,000 records — likely sensitive customer data.

Potential Impact

  • Data Theft: If completed, this could lead to massive data breach.
  • Financial Loss: Fines, legal liabilities, and reputational damage.
  • Identity Theft: Exposure of customer SSNs could enable identity theft.
  1. Stop Export Process: If still in progress, halt the export immediately.
  2. Check Export Status: Determine whether the data was successfully exported and where it was sent.
  3. Review Network Traffic: Look for large outbound transfers or connections to external IPs/domains.
  4. Preserve Logs: Retain all logs related to this export for forensic analysis and potential legal action.

Investigation Priorities

  • Correlate with the database query (SELECT * FROM customer_data WHERE ssn IS NOT NULL) to confirm the data exported contains SSNs.
  • Check for any encryption or compression of the exported data.
  • Determine if the export was triggered via an application, SQL client, or script.

5. Network Anomaly

Event Classification & Severity

  • Classification: Network Anomaly / Potential Exfiltration
  • Severity: Medium to High

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:29:33
  • Source IP: 185.220.101.42
  • Action: Unusual outbound traffic detected.

Potential Impact

  • Data Exfiltration: Traffic could be carrying sensitive data to an external IP.
  • Command & Control (C2): Could indicate a compromised system beaconing to a C2 server.
  • Lateral Movement: Could be part of an attacker's reconnaissance or data movement phase.
  1. Block Destination IP: Add 185.220.101.42 to the firewall denylist.
  2. Inspect Traffic: Review packet captures (PCAPs) or NetFlow logs for details on the traffic (port, protocol, size, timing).
  3. Identify Source System: Determine which internal system initiated the connection to 185.220.101.42.
  4. Scan Source System: If identified, scan the source system for malware or unauthorized software.

Investigation Priorities

  • Determine if 185.220.101.42 is known malicious (e.g., via threat intelligence feeds).
  • Correlate with other logs (e.g., endpoint logs) to see if any system contacted this IP around the same time.
  • Check for any DNS lookups or HTTP requests to known malicious domains.

6. Account Compromise Indicators

Event Classification & Severity

  • Classification: Account Compromise / Suspicious Login
  • Severity: Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:27:12
  • User: mike.wilson@company.com
  • Action: Unusual file access pattern detected.

Potential Impact

  • Unauthorized Data Access: The user may have accessed files they shouldn't have, indicating compromise or insider misuse.
  • Privilege Abuse: If Mike's account is compromised, attacker may abuse privileges.
  1. Review File Access Logs: Identify which files were accessed and by what process/user.
  2. Check for Anomalies: Look for access to sensitive directories (e.g., /etc/passwd, /home/*, /tmp).
  3. Reset Credentials: Force password reset for mike.wilson@company.com.
  4. Enable MFA: If not already enabled, enforce MFA for this account.

Investigation Priorities

  • Correlate with the suspicious file detection (/tmp/update.exe) — could be related.
  • Review recent login history and IP addresses for mike.wilson@company.com.
  • Check for any unusual processes or scheduled tasks running under his account.

7. Additional Suspicious Activity

Multiple Failed SSH Attempts

Event Classification & Severity

  • Classification: Brute Force / Reconnaissance
  • Severity: Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:28:01
  • Source IP: 198.51.100.75
  • Action: Multiple failed SSH attempts.

Potential Impact

  • Privilege Escalation Attempt: SSH access often provides high-level system access.
  • Reconnaissance: Attacker may be probing for vulnerabilities.
  1. Block IP: Add 198.51.100.75 to the firewall denylist.
  2. Review SSH Logs: Check for successful logins from this IP or others.
  3. Enforce Strong SSH Policies: Disable root login, use key-based authentication, limit SSH users.

Investigation Priorities

  • Check if any successful logins occurred from this IP or related IPs.
  • Determine if any brute force tools (e.g., Hydra) were used.

VPN Connection Established

Event Classification & Severity

  • Classification: Normal Activity / Potential Risk
  • Severity: Low to Medium

Timeline & Affected Systems/Users

  • Time: 2024-03-19 14:26:45
  • User: mike.wilson@company.com
  • Source IP: 198.51.100.75

Potential Impact

  • Legitimate Access: Could be a legitimate remote user connecting in.
  • Risk: If the user's device is compromised, the attacker now has access via VPN.
  1. Verify User Location: Confirm if Mike Wilson was legitimately working remotely.
  2. Review Device Security Posture: Ensure the device used to connect is secure and up to date.
  3. Monitor Session: Log all actions performed during the VPN session for anomalies.

Investigation Priorities

  • Correlate with other logs (e.g., endpoint logs) during the time of the VPN connection.
  • Check if any suspicious processes or file modifications occurred during the session.

Summary of Immediate Actions

Incident Action
Brute Force on Admin Account Unlock, reset password, enable MFA, block IP
Insider Data Export Stop export, audit user, preserve logs
Suspicious File Detection Isolate system, scan, analyze file
Network Anomaly Block IP, inspect traffic, identify source
Unusual File Access Review logs, reset password, enable MFA
Failed SSH Attempts Block IP, review SSH logs
VPN Connection Verify legitimacy, monitor session

Next Steps / Investigation Roadmap

  1. Forensic Imaging: Perform forensic imaging of systems involved (especially Mike Wilson's workstation).
  2. Threat Intelligence Lookup: Query 203.0.113.45, 198.51.100.75, and 185.220.101.42 in threat intelligence platforms (e.g., VirusTotal, AlienVault, Mandiant).
  3. User Interviews: Conduct interviews with Sarah Smith and Mike Wilson.
  4. Access Review: Conduct a full access control review for all users involved.
  5. Incident Response Plan Activation: If not already active, initiate the Incident Response Plan.
  6. Regulatory Reporting: If customer data was exposed, prepare for potential regulatory reporting (e.g., GDPR, HIPAA).

Clarifying Questions (if needed)

To further enhance the analysis, the following information would be helpful:

  1. What type of system is being logged? (e.g., SIEM, web app, endpoint, firewall)
  2. Is Multi-Factor Authentication (MFA) enabled for admin or other accounts?
  3. What are the access controls and permissions for the customer_data database?
  4. Do you have endpoint detection and response (EDR) tools deployed?
  5. Are there any existing security policies regarding large data exports or SSN access?
  6. What is the typical user behavior for mike.wilson@company.com?
  7. Is there a SOAR or automated response system in place?

If you can provide any of this context, I can refine the analysis and recommendations accordingly.

API Request

import boto3
import json

# Initialize the Bedrock Runtime client
bedrock_runtime = boto3.client('bedrock-runtime', region_name='us-west-2')

# Define the system prompt
system_prompt = """You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs.
  Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions."""

# Define the user prompt
user_prompt = """## Data ##
  ```
  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100
  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf
  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45
  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com
  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50
  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL
  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)
  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com
  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com
  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe
  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75
  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task
  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42
  ```

  ## Detection Criteria ##
  Identify and analyze:
  - Brute force attacks
  - Insider threat indicators
  - Malware/suspicious file activity
  - Data exfiltration attempts
  - Network anomalies
  - Account compromise indicators

  For each detected event, provide:
  - Event classification and severity
  - Timeline and affected systems/users
  - Potential impact assessment
  - Recommended immediate actions
  - Investigation priorities

  Ask clarifying questions if needed."""

# Prepare the request
request_body = {
    "system": [
        {
            "text": system_prompt
        }
    ],
    "messages": [
        {
            "role": "user",
            "content": [
                {
                    "text": user_prompt
                }
            ]
        }
    ],
    "toolConfig": {
        "tools": [
            {
                "systemTool": {
                    "name": "nova_grounding"
                }
            },
            {
                "systemTool": {
                    "name": "nova_code_interpreter"
                }
            }
        ]
    },
    "additionalModelRequestFields": {
        "reasoningConfig": {
            "type": "enabled",
            "maxReasoningEffort": "low"
        }
    },
    "inferenceConfig": {
        "temperature": 0.3,
        "topP": 0.9,
        "maxTokens": 10000
    }
}

# Make the API call
response = bedrock_runtime.converse(
    modelId="amazon.nova-2-lite-v1:0",
    **request_body
)

# Print the response
print(json.dumps(response, indent=2, default=str))

aws bedrock-runtime converse \
  --model-id "amazon.nova-2-lite-v1:0" \
  --system '[
    {
      "text": "You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs. Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions."
    }
  ]' \
  --messages '[
    {
      "role": "user",
      "content": [
        {
          "text": "## Data ##\n```\n2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100\n2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf\n2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com\n2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50\n2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL\n2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)\n2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com\n2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com\n2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe\n2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75\n2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task\n2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42\n```\n\n## Detection Criteria ##\nIdentify and analyze:\n- Brute force attacks\n- Insider threat indicators\n- Malware/suspicious file activity\n- Data exfiltration attempts\n- Network anomalies\n- Account compromise indicators\n\nFor each detected event, provide:\n- Event classification and severity\n- Timeline and affected systems/users\n- Potential impact assessment\n- Recommended immediate actions\n- Investigation priorities\n\nAsk clarifying questions if needed."
        }
      ]
    }
  ]' \
  --additional-model-request-fields '{
    "reasoningConfig": {
      "type": "enabled",
      "maxReasoningEffort": "low"
    }
  }' \
  --region us-west-2

{
 "system": "You are an expert cybersecurity analyst who specializes in detecting and analyzing security incidents from system logs.\n  Identify relevant security events from the provided log data and provide detailed threat analysis with recommended actions.",
 "messages": [
  {
   "role": "user",
   "content": [
    {
     "text": "## Data ##\n  ```\n  2024-03-19 14:23:15 [INFO] User john.doe@company.com logged in from IP 192.168.1.100\n  2024-03-19 14:23:45 [INFO] File access: /home/john.doe/documents/project_alpha.pdf\n  2024-03-19 14:24:12 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:18 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:25 [WARN] Failed login attempt for admin@company.com from IP 203.0.113.45\n  2024-03-19 14:24:31 [ERROR] Account locked: admin@company.com\n  2024-03-19 14:25:02 [INFO] User sarah.smith@company.com logged in from IP 10.0.0.50\n  2024-03-19 14:25:15 [INFO] Database query executed: SELECT * FROM customer_data WHERE ssn IS NOT NULL\n  2024-03-19 14:25:22 [WARN] Large data export initiated by sarah.smith@company.com (50,000 records)\n  2024-03-19 14:26:45 [INFO] VPN connection established from IP 198.51.100.75 for user mike.wilson@company.com\n  2024-03-19 14:27:12 [WARN] Unusual file access pattern detected for user mike.wilson@company.com\n  2024-03-19 14:27:30 [ERROR] Antivirus alert: Suspicious file detected in /tmp/update.exe\n  2024-03-19 14:28:01 [WARN] Multiple failed SSH attempts from IP 198.51.100.75\n  2024-03-19 14:28:15 [INFO] System backup initiated by scheduled task\n  2024-03-19 14:29:33 [ERROR] Network anomaly detected: Unusual outbound traffic to IP 185.220.101.42\n  ```\n  \n  ## Detection Criteria ##\n  Identify and analyze:\n  - Brute force attacks\n  - Insider threat indicators\n  - Malware/suspicious file activity\n  - Data exfiltration attempts\n  - Network anomalies\n  - Account compromise indicators\n  \n  For each detected event, provide:\n  - Event classification and severity\n  - Timeline and affected systems/users\n  - Potential impact assessment\n  - Recommended immediate actions\n  - Investigation priorities\n  \n  Ask clarifying questions if needed."
    }
   ]
  }
 ],
 "additionalModelRequestFields": {
  "reasoningConfig": {
   "type": "enabled",
   "maxReasoningEffort": "high"
  }
 }
}