AWS SNS Subscription to External HTTP | HTTPS Endpoint
This rule detects the creation of Amazon SNS (Simple Notification Service) subscriptions that are configured to send notifications to external HTTP or HTTPS endpoints. It specifically looks for `Subscribe` events from the `sns.amazonaws.com` service where the `protocol` is either `http` or `https` and the `endpoint` does not belong to Amazon's own domains (amazon.com, awsapps.com, amazonaws.com). This could indicate data exfiltration or misconfiguration where sensitive information might be sent to an unapproved external service.
Cortex XDR
