Researching Through Data Monitored by Amazon Macie Classic

You can use the Research tab in the Macie Classic console to construct and run queries in the query parser and conduct in-depth investigative research of your data and activity that Macie Classic monitors. You can navigate to the Research tab at any time and construct queries in the empty parser. For more information, see Constructing Queries in Macie Classic. You can be redirected to the Research tab from various places throughout the Macie Classic console: for example, any of the Dashboard views (see Viewing Data and Activity that Amazon Macie Classic Monitors) or the Basic alerts list (see Amazon Macie Classic Alerts). When redirected to the Research tab from other places in the console, your data selection is translated into an automatically generated query that appears in the query parser.

Topics

• Constructing Queries in Macie Classic
• Research Filters
• Saving a Query as an Alert
• Favorite Queries
• Researching AWS CloudTrail Data
• Researching S3 Bucket Properties Data
• Researching S3 Objects Data

Constructing Queries in Macie Classic

Macie Classic enables you to construct queries in the query parser in the Research tab. The query parser is a lexer that interprets a string into a Lucene Query using JavaCC. For more information about query syntax, see Apache Lucene - Query Parser Syntax.

The following are example queries for common searches:

• To search for any console login that didn't originate from IP addresses owned by Amazon: eventNameIsp.compound:/ConsoleLogin:~(Amazon.*)/

• To search for PII artifacts inside a public S3 bucket: filesystem_metadata.bucket:"my-public-bucket" AND (pii_impact:"moderate" OR pii_impact:"high")

The following tables contains example queries for the Macie Classic date, integer, and string field types.

Example Queries: Date Field Type

Example Query	Description	Data Repository
objectsRead.key:* AND @timestamp:[2017-08-01 TO 2017-12-31]	Search for S3 objects read in the fourth quarter of 2017.	CloudTrail data
sourceIPAddress.ip_intel.type:"TOR" AND @timestamp:[now-1M TO now]	Search for anonymous accesses to your Macie Classic-monitored data from Tor exit notes over the last month.	CloudTrail data
macieUniqueId:"085924634393\:assumed-role\:malicious_user" AND @timestamp:[2018-01-18 TO *]	Search for AWS activities of an assumed role named "malicious_user" in the AWS account ID 085924634393, starting from January 18, 2018.	CloudTrail data

Example Queries: Integer Field Type

Example Query	Description	Data Repository
dlp_risk>6 AND filesystem_metadata.server_encryption:"none"	Search for S3 objects with a dlp_risk score greater than 6 and without a server-side encryption.	S3 objects
filesystem_metadata.size: [10240 TO 1024000] AND pii_types:*	Search for S3 objects between the sizes of 10 MB to 1 GB that contain potential PII data.	S3 objects

Example Queries: String Field Type

Example Query	Description	Data Repository
dlp_risk>5 AND key: /.*contract.*|.*agreement.*|.*terms.*/ AND @timestamp:[now-1M/M TO now]	Search for S3 object keys (names) that contain the keywords "contract," "agreement," or "terms," with a dlp_risk score higher than 5, and that were last modified less than a month ago. Note Some regex queries might result in long search times. We recommend conducting searches for limited time frames.	S3 objects
mimetypes:"Adobe PDF \(application/pdf\)" AND key: /~(.*\.pdf|.*\.PDF)/	Search for S3 objects containing PDF data but in files with file extensions other than PDF/pdf. Note This query also returns archived objects (zip,7z, etc.) containing PDF documents.	S3 objects
acl.Grants.Grantee.DisplayName: admin	Search for S3 buckets with ACL grantee display names set to "admin."	S3 bucket properties
acl.Grants.Grantee.DisplayName: admi?	Search for S3 buckets with ACL grantee display names set to "admi(?)" (wildcard), including "admin."	S3 bucket properties
bucket: *test*	Search for S3 buckets with keywords "test."	S3 bucket properties

Research Filters

In the Macie Classic Research tab, you can apply the following filters to your searches.

Data Index

The first Research tab filter (dropdown) with the preselected default value of CloudTrail data, enables you to specifying the index (or the data repository) that you want Macie Classic to search through. This filter includes the following options:

• CloudTrail data – A collection of 5-minute aggregates of raw CloudTrail data

• S3 bucket properties – A collection of metadata about the S3 buckets that Macie Classic is monitoring

• S3 objects – A collection of metadata about the S3 objects that are stored in the buckets that Macie Classic is monitoring

Number of Results to Display

The next Research tab filter with the preselected default value of Top 10 enables you to control the number of results to display when you do your initial search and the number of additional results to display if more results are available. This filter includes the following options:

• Top 10

• Top 50

• Top 100

• Top 500

Time Range

The third Research tab filter with the preselected default value of Past 30 days enables you to define a time range that you want to display your search results for. This filter includes the following options:

• Past 7 days

• Past 30 days

• Past 90 days

• Past 365 days

• All

• Custom time range

Saving a Query as an Alert

You can use the following procedure to save a query that appears in the query parser as a basic alert. For more information about basic alerts, see Amazon Macie Classic Alerts.

1. In the Macie Classic console's Research tab, either autogenerate or construct a query in the query parser.

2. Choose the Save query as alert icon.

3. Fill out the Basic alert definition form and choose Save. For more information, see Adding New and Editing Existing Custom Basic Alerts.

Favorite Queries

You can mark queries that you frequently run as favorites and view a list of your favorite queries.

1. In the Macie Classic console's Research tab, either autogenerate or construct a query in the query parser.

2. Choose the Mark query as favorite icon.

3. Fill out the Favorite query definition form by specifying the name and the description for the favorite query and choose Save.

4. To view the list of your favorite queries, in the Macie Classic console's Research tab, choose the Favorite queries icon.