Here’s a recent scenario: an organization’s security team receives an alert from the monitoring system on their Slack channel with the content below:
AWS Account : SomeCompany_Development
IAM User : joel.burns@company.com
AWS API : AllowSecurityGroupIngress
Source IP Address : xxx.xxx.xxx.xxx
Security Group ID : sg-4fxxx4dx
Security Group Region : us-east-2
IP Protocol : tcp
From : 22
To : 22
IPRange : 0.0.0.0/0