decommissioned_buckets.yml

name: decommissioned_buckets
date: 2025-02-14
version: 1
id: b3a95eff-87cf-40f3-b6e0-5b1a11eed68f
author: Bhavin Patel
lookup_type: kvstore
default_match: false
description: A lookup table of decommissioned S3 buckets created by baseline - Baseline of Open S3 Bucket Decommissioning. This lookup table is used by detections searches to trigger alerts when decommissioned buckets are detected.
min_matches: 1
fields: 
- _key
- bucketName
- hosts
- firstEvent
- lastEvent
- events
- policy_details
- website_details
- accountIds
- userARNs
- awsRegions