Get article metadata

Example response

[
  {
    "fingerprint": "c392b42",
    "id": "UybWZO8Gre9MphC4ZSsEQwKCOEGrCNXcYdJXbwlpiMI=_19a0d0d8f78:497f7ef:752f71fa",
    "language": "en",
    "originId": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/",
    "origin": {
      "streamId": "feed/https://detection.fyi/index.xml",
      "title": "Detection.FYI",
      "htmlUrl": "https://detection.fyi/"
    },
    "title": "AWS ConsoleLogin Failed Authentication",
    "published": 1761136602000,
    "crawled": 1761155583864,
    "summary": {
      "content": "Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.",
      "direction": "ltr"
    },
    "alternate": [
      {
        "href": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/",
        "type": "text/html"
      }
    ],
    "canonicalUrl": "https://detection.fyi/sigmahq/sigma/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication/",
    "snippet": "\n<div><div><div><div><div>\n<p>Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.</p>\n<div><pre tabindex=\"0\"><code><span><span> 1</span><span><span>title</span><span>:</span><span> </span><span>AWS ConsoleLogin Failed Authentication</span><span>\n</span></span></span><span><span> 2</span><span><span></span><span>id</span><span>:</span><span> </span><span>6393e346-1977</span>-<span>46ef-8987-ad414a145fad</span><span>\n</span></span></span><span><span> 3</span><span><span></span><span></span></span></span></code></pre></div></div></div></div></div></div>",
    "originContentType": "text/html",
    "fullContent": "\n<div><div><div><div><div>\n<p>Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.</p>\n<div><pre tabindex=\"0\"><code><span><span> 1</span><span><span>title</span><span>:</span><span> </span><span>AWS ConsoleLogin Failed Authentication</span><span>\n</span></span></span><span><span> 2</span><span><span></span><span>id</span><span>:</span><span> </span><span>6393e346-1977</span>-<span>46ef-8987-ad414a145fad</span><span>\n</span></span></span><span><span> 3</span><span><span></span><span>status</span><span>:</span><span> </span><span>experimental</span><span>\n</span></span></span><span><span> 4</span><span><span></span><span>description</span><span>:</span><span> </span><span>|</span><span>\n</span></span></span><span><span> 5</span><span><span> </span><span> </span><span>Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.</span><span>\n</span></span></span><span><span> 6</span><span><span></span><span>references</span><span>:</span><span>\n</span></span></span><span><span> 7</span><span><span> </span>- <span>https://naikordian.github.io/blog/posts/brute-force-aws-console/</span><span>\n</span></span></span><span><span> 8</span><span><span> </span>- <span>https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm</span><span>\n</span></span></span><span><span> 9</span><span><span> </span>- <span>https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json</span><span>\n</span></span></span><span><span>10</span><span><span></span><span>author</span><span>:</span><span> </span><span>Ivan Saakov, Nasreddine Bencherchali</span><span>\n</span></span></span><span><span>11</span><span><span></span><span>date</span><span>:</span><span> </span><span>2025-10-19</span><span>\n</span></span></span><span><span>12</span><span><span></span><span>tags</span><span>:</span><span>\n</span></span></span><span><span>13</span><span><span> </span>- <span>attack.credential-access</span><span>\n</span></span></span><span><span>14</span><span><span> </span>- <span>attack.t1110</span><span>\n</span></span></span><span><span>15</span><span><span></span><span>logsource</span><span>:</span><span>\n</span></span></span><span><span>16</span><span><span> </span><span>product</span><span>:</span><span> </span><span>aws</span><span>\n</span></span></span><span><span>17</span><span><span> </span><span>service</span><span>:</span><span> </span><span>cloudtrail</span><span>\n</span></span></span><span><span>18</span><span><span></span><span>detection</span><span>:</span><span>\n</span></span></span><span><span>19</span><span><span> </span><span>selection</span><span>:</span><span>\n</span></span></span><span><span>20</span><span><span> </span><span>eventName</span><span>:</span><span> </span><span>'ConsoleLogin'</span><span>\n</span></span></span><span><span>21</span><span><span> </span><span>errorMessage</span><span>:</span><span> </span><span>'Failed authentication'</span><span>\n</span></span></span><span><span>22</span><span><span> </span><span>condition</span><span>:</span><span> </span><span>selection</span><span>\n</span></span></span><span><span>23</span><span><span></span><span>falsepositives</span><span>:</span><span>\n</span></span></span><span><span>24</span><span><span> </span>- <span>Legitimate failed login attempts by authorized users. Investigate the source of repeated failed login attempts.</span><span>\n</span></span></span><span><span>25</span><span><span></span><span>level</span><span>:</span><span> </span><span>medium</span><span>\n</span></span></span></code></pre></div>\n</div>\n</div></div></div></div>",
    "unread": true,
    "categories": [
      {
        "id": "enterprise/christeam/category/a1b9d077-7806-4b29-8f1c-d17ebc172ea3",
        "label": "AI: Ad-Hoc Research"
      }
    ],
    "commonTopics": [
      {
        "type": "detectionRule",
        "label": "Sigma rules",
        "id": "nlp/f/topic/7010",
        "score": 1,
        "salienceLevel": "about"
      }
    ],
    "entities": [
      {
        "type": "org",
        "disambiguated": true,
        "label": "Amazon Web Services",
        "id": "nlp/f/entity/gz:org:amazon-web-services",
        "mentions": [
          {
            "text": "AWS"
          }
        ],
        "salienceLevel": "about"
      }
    ],
    "indicatorsOfCompromise": {
      "sigmaRules": {
        "count": 1,
        "url": "https://exports.feedly.com/sigma/sigma-342359ad452d13341f73665ef05c1f60.yaml"
      }
    },
    "attackNavigator": {
      "url": "https://exports.feedly.com/attacks/a322aeb98ff575dbc66b638386190651/feedly-ai-aws-consolelogin-failed-authentication.json",
      "ttpCount": 1
    },
    "sources": [
      {
        "streamId": "feed/https://feedly.com/f/alert/278c354e-67ae-4509-b708-a354b8a41f9c",
        "title": "Detection rules",
        "feedlyFeedType": "WebAlert",
        "searchTerms": {
          "parts": [
            {
              "id": "nlp/f/topic/7010",
              "label": "Sigma rules"
            }
          ],
          "isComplexFilter": true
        }
      }
    ]
  }
]