AWS ArchiveFindings
Archives specified GuardDuty findings in a regional detector.
T1685: Disable or Modify Tools
T1685: Disable or Modify Tools
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping spec...
View on MITRE ATT&CK →AWS CreateFilter
Creates a GuardDuty finding filter, optionally with an automatic archive action.
AWS CreateIPSet
Creates a GuardDuty trusted IP list and optionally requests activation.
AWS DeleteAlarms
Deletes specified CloudWatch alarms in an account and Region.
AWS DeleteConfigRule
Deletes an AWS Config rule and its evaluation results.
AWS DeleteConfigurationRecorder
Deletes a customer-managed AWS Config recorder in one Region.
AWS DeleteDeliveryChannel
Deletes an AWS Config delivery channel after customer-managed recording is stopped.
AWS DeleteDetector
Deletes a regional GuardDuty detector, disabling GuardDuty for that account and Region.
AWS DeleteMembers
Deletes GuardDuty member records from an administrator’s regional detector.
AWS DisassociateFromMasterAccount
Legacy API for disassociating a GuardDuty member from its administrator.
AWS DisassociateMembers
Disassociates specified members from a regional GuardDuty administrator.
GCP google.cloud.securitycenter.v1.SecurityCenter.SetMute
Changes the mute state of a Security Command Center finding.
AWS LeaveOrganization
Removes the calling member account from its AWS organization.
Azure Microsoft.HybridCompute/machines/extensions/delete
Requests removal of an extension from an Azure Arc-enabled server.
Azure Microsoft.Insights/activityLogAlerts/delete
Deletes an Azure Monitor activity log alert rule.
Azure Microsoft.Insights/metricAlerts/delete
Deletes an Azure Monitor metric alert rule.
Azure Microsoft.Security/alertsSuppressionRules/write
Creates or updates a Defender for Cloud alert suppression rule.
Azure Microsoft.Security/autoProvisioningSettings/write
Updates the legacy Defender for Cloud agent auto-provisioning setting.
Azure Microsoft.Security/pricings/write
Changes a Microsoft Defender for Cloud plan configuration at a supported scope.
Azure Microsoft.Security/securitySolutions/delete
Deletes a Microsoft.Security security solution resource.
AWS RemoveAccountFromOrganization
Removes a specified member account from an AWS organization.
AWS ScheduleKeyDeletion
Schedules KMS key deletion and makes the pending key unavailable for cryptographic operations.
GCP SecurityCenter.UpdateOrganizationSettings (deprecated)
Updates legacy Security Command Center organization settings through a deprecated API.
AWS StopConfigurationRecorder
Stops the named customer-managed AWS Config recorder from recording its configured resource types.
AWS StopMonitoringMembers
Suspends GuardDuty monitoring for specified member accounts in a Region.
AWS UpdateDetector
Updates a regional GuardDuty detector, including its enabled state and protection features.
AWS UpdateIPSet
Updates a GuardDuty trusted IP list configuration and activation request.