openapi: 3.1.0 info: title: Entries version: '1.0' servers: - url: https://api.feedly.com/v3/entries/ components: securitySchemes: sec0: type: apiKey name: Authorization in: header x-bearer-format: bearer security: - sec0: [] paths: /prediction: post: summary: Ask AI with structured outputs description: The Feedly Ask AI API allows developers to leverage the power of Large Language Models (LLMs) to ask questions and gather insights from a set of articles. operationId: ai-actions-experimental requestBody: content: application/json: schema: type: object properties: entryIds: type: array description: An array of article IDs to perform AI actions on items: type: string prompt: type: string description: The user-generated prompt to ask questions or gather insights from the articles responses: '200': description: '200' content: application/json: examples: Result: value: '{}' schema: type: object properties: {} '400': description: '400' content: application/json: examples: Result: value: '{}' schema: type: object properties: {} deprecated: false /{entryId}: get: summary: Get article metadata description: '' operationId: get-article-metadata parameters: - name: entryId in: path description: entryId of article schema: type: string required: true responses: '200': description: '200' content: application/json: examples: Result: value: "[\n {\n \"fingerprint\": \"c392b42\",\n \"id\": \"UybWZO8Gre9MphC4ZSsEQwKCOEGrCNXcYdJXbwlpiMI=_19a0d0d8f78:497f7ef:752f71fa\"\ ,\n \"language\": \"en\",\n \"originId\": \"https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/\"\ ,\n \"origin\": {\n \"streamId\": \"feed/https://detection.fyi/index.xml\"\ ,\n \"title\": \"Detection.FYI\",\n \"htmlUrl\": \"https://detection.fyi/\"\ \n },\n \"title\": \"AWS ConsoleLogin Failed Authentication\",\n \"published\"\ : 1761136602000,\n \"crawled\": 1761155583864,\n \"summary\": {\n \"content\"\ : \"Detects failed AWS console login attempts due to authentication failures. Monitoring\ \ these events is crucial for identifying potential brute-force attacks or unauthorized\ \ access attempts to AWS accounts.\",\n \"direction\": \"ltr\"\n },\n \"\ alternate\": [\n {\n \"href\": \"https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/\"\ ,\n \"type\": \"text/html\"\n }\n ],\n \"canonicalUrl\": \"https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/\"\ ,\n \"snippet\": \"\\n
Detects failed AWS console\ \ login attempts due to authentication failures. Monitoring these events is crucial\ \ for identifying potential brute-force attacks or unauthorized access attempts to\ \ AWS accounts.
\\n 1title:\
\ AWS ConsoleLogin Failed Authentication\\n\
\ 2id: 6393e346-1977-46ef-8987-ad414a145fad\\\
n 3Detects failed AWS console login attempts due to authentication failures. Monitoring\ \ these events is crucial for identifying potential brute-force attacks or unauthorized\ \ access attempts to AWS accounts.
\\n\
\ 1title: AWS ConsoleLogin\
\ Failed Authentication\\n 2id:\
\ 6393e346-1977-46ef-8987-ad414a145fad\\n\
\ 3status: experimental\\\
n 4description:\
\ |\\n 5\
\ Detects failed AWS console login attempts due to authentication\
\ failures. Monitoring these events is crucial for identifying potential brute-force\
\ attacks or unauthorized access attempts to AWS accounts.\\n\
\ 6references:\\n\
\ 7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/\\\
n 8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\\\
n 9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\\\
n10author:\
\ Ivan Saakov, Nasreddine Bencherchali\\n11date:\
\ 2025-10-19\\n12tags:\\\
n13 - attack.credential-access\\\
n14 - attack.t1110\\\
n15logsource:\\\
n16 product:\
\ aws\\n17\
\ service: cloudtrail\\\
n18detection:\\\
n19 selection:\\\
n20 eventName:\
\ 'ConsoleLogin'\\n21\
\ errorMessage: 'Failed authentication'\\\
n22 condition:\
\ selection\\n23falsepositives:\\\
n24 - Legitimate\
\ failed login attempts by authorized users. Investigate the source of repeated failed\
\ login attempts.\\n25level:\
\ medium\\nDetects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title:
AWS ConsoleLogin Failed Authentication
2id:
6393e346-1977-46ef-8987-ad414a145fad
3Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title:
AWS ConsoleLogin Failed Authentication
2id:
6393e346-1977-46ef-8987-ad414a145fad
3status:
experimental
4description:
|
5 Detects
failed AWS console login attempts due to authentication failures. Monitoring these
events is crucial for identifying potential brute-force attacks or unauthorized
access attempts to AWS accounts.
6references:
7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/
8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
10author:
Ivan Saakov, Nasreddine Bencherchali
11date:
2025-10-19
12tags:
13 - attack.credential-access
14 - attack.t1110
15logsource:
16 product:
aws
17 service:
cloudtrail
18detection:
19 selection:
20 eventName:
''ConsoleLogin''
21 errorMessage:
''Failed authentication''
22 condition:
selection
23falsepositives:
24 - Legitimate
failed login attempts by authorized users. Investigate the source of repeated
failed login attempts.
25level:
medium
Detects failed AWS console\ \ login attempts due to authentication failures. Monitoring these events is crucial\ \ for identifying potential brute-force attacks or unauthorized access attempts to\ \ AWS accounts.
\\n 1title:\
\ AWS ConsoleLogin Failed Authentication\\n\
\ 2id: 6393e346-1977-46ef-8987-ad414a145fad\\\
n 3Detects failed AWS console login attempts due to authentication failures. Monitoring\ \ these events is crucial for identifying potential brute-force attacks or unauthorized\ \ access attempts to AWS accounts.
\\n\
\ 1title: AWS ConsoleLogin\
\ Failed Authentication\\n 2id:\
\ 6393e346-1977-46ef-8987-ad414a145fad\\n\
\ 3status: experimental\\\
n 4description:\
\ |\\n 5\
\ Detects failed AWS console login attempts due to authentication\
\ failures. Monitoring these events is crucial for identifying potential brute-force\
\ attacks or unauthorized access attempts to AWS accounts.\\n\
\ 6references:\\n\
\ 7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/\\\
n 8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm\\\
n 9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json\\\
n10author:\
\ Ivan Saakov, Nasreddine Bencherchali\\n11date:\
\ 2025-10-19\\n12tags:\\\
n13 - attack.credential-access\\\
n14 - attack.t1110\\\
n15logsource:\\\
n16 product:\
\ aws\\n17\
\ service: cloudtrail\\\
n18detection:\\\
n19 selection:\\\
n20 eventName:\
\ 'ConsoleLogin'\\n21\
\ errorMessage: 'Failed authentication'\\\
n22 condition:\
\ selection\\n23falsepositives:\\\
n24 - Legitimate\
\ failed login attempts by authorized users. Investigate the source of repeated failed\
\ login attempts.\\n25level:\
\ medium\\nA BreachForums user under the alias IntelBroker\ \ claims to have posted the customer data of Verizon Communications on the forum.\ \ The threat actor has claimed to have access to a database of 7.5 million Verizon\ \ customer records. Verizon has verified the data on the request from The Cyber Express.
\\\ n\\nAccording to their initial review of this matter, the data appears\ \ to be obtained approximately two weeks ago when a Verizon vendor experienced a security\ \ breach, Verizon spokesperson Richard Young told The Cyber Express.
\\\ n“This vendor creates videos for Verizon to assist customers with billing-related\ \ questions. The vendor had access to customer first names, device types, and service\ \ plans. The vendor did not have access to Social Security numbers, credit card numbers, or other personally\ \ identifiable customer information,” Young said.
\\nWe have severed this vendor’s\ \ access to our systems and suspended use of their services. Our review of this\ \ matter continues.”
Commonly known as Verizon, the American\ \ multinational telecommunications conglomerate is a corporate component of the Dow\ \ Jones Industrial Average. According to Statista, Verizon has a retail customer\ \ base of approximately 143 million subscribers in 2021.
\\n“In January 2023,\ \ a database of 7.5 million customers belonging to the Verizon was stolen by hackers,”\ \ claimed the post by IntelBroker. A sample of the hashed data posted indicates mobile and online subscription details.
\\nThe\ \ post, made on Friday, had the link to download the entire data tranche. IntelBroker’s\ \ present avatar has been active on the forum since October 2022. Its previous targets\ \ include Autotrader, Volvo, Hilton Hotels, and AT&T.
\\n
Independent researchers\ \ were analysing the sample data at the time of publishing this report. If the tranche turns out to be\ \ authentic, this would be the company’s second major data breach in the past 12 months.
\\nVerizon in May 2022 confirmed a\ \ data breach where the full names, email addresses, corporate ID numbers, and phone\ \ numbers of Verizon employees were compromised. According to a report from Motherboard, the data was shared with the\ \ publication by the hacker who reached out to them.
\\nThe company popped up\ \ in cybersecurity news over a data\ \ breach five years before that.
\\nIn 2017, the telecommunication company conceded that the personal data of 6 million customers\ \ had been leaked online. The leak was caused by a misconfigured security setting on a cloud server, which was the result of “human error.
\\\ nThe data, which included customer phone numbers, names, and some PIN codes, was publicly available online due\ \ to a mistake made by NICE Systems, an Israel-based company that Verizon was working\ \ with to facilitate customer service calls.
\\nThe data of telecommunication users was collected over a period of six months,\ \ and Verizon closed the security hole on June 22.
\\nDetects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title:
AWS ConsoleLogin Failed Authentication
2id:
6393e346-1977-46ef-8987-ad414a145fad
3Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.
1title:
AWS ConsoleLogin Failed Authentication
2id:
6393e346-1977-46ef-8987-ad414a145fad
3status:
experimental
4description:
|
5 Detects
failed AWS console login attempts due to authentication failures. Monitoring these
events is crucial for identifying potential brute-force attacks or unauthorized
access attempts to AWS accounts.
6references:
7 - https://naikordian.github.io/blog/posts/brute-force-aws-console/
8 - https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
9 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
10author:
Ivan Saakov, Nasreddine Bencherchali
11date:
2025-10-19
12tags:
13 - attack.credential-access
14 - attack.t1110
15logsource:
16 product:
aws
17 service:
cloudtrail
18detection:
19 selection:
20 eventName:
''ConsoleLogin''
21 errorMessage:
''Failed authentication''
22 condition:
selection
23falsepositives:
24 - Legitimate
failed login attempts by authorized users. Investigate the source of repeated
failed login attempts.
25level:
medium