# This file was created by Stratoshark. Edit with care.
@Errors@ct.error@[4626,10023,11822][63479,34695,34695]
@State Modifying Event@ct.readonly == "false"@[65535,65535,65535][38036,8481,37522]
@Administrative Activity@falcoevents.id == 2 and not (ct.name ~ "^Describe.*" or ct.name ~ "^List.*"  or ct.name ~ "^(Batch|)Get.*")@[38036,8481,37522][0,0,0]
@s3@ct.shortsrc==s3@[53970,57825,62194][0,0,0]
@ec2@ct.shortsrc==ec2@[65535,63993,50372][0,0,0]
@ecs@ct.shortsrc==ecs@[58082,58853,62965][0,0,0]
@elasticloadbalancing@ct.shortsrc==elasticloadbalancing@[65535,59367,47802][0,0,0]
@dynamodb@ct.shortsrc==dynamodb@[57568,61680,65535][0,0,0]
@sts@ct.shortsrc==sts@[65535,58853,59110][0,0,0]
@rds@ct.shortsrc==rds@[61166,61166,61166][0,0,0]
@elasticache@ct.shortsrc==elasticache@[57568,65021,61423][0,0,0]
@ssm@ct.shortsrc==ssm@[65535,52171,58082][0,0,0]
@servicediscovery@ct.shortsrc==servicediscovery@[58082,59624,60652][0,0,0]
@kms@ct.shortsrc==kms@[55255,62965,56540][0,0,0]
@iam@ct.shortsrc==iam@[60395,51400,62451][0,0,0]
@config@ct.shortsrc==config@[55769,62194,63222][0,0,0]
@autoscaling@ct.shortsrc==autoscaling@[62708,65535,47288][0,0,0]
@logs@ct.shortsrc==logs@[60395,57311,63479][0,0,0]
@cloudformation@ct.shortsrc==cloudformation@[53970,57825,62194][0,0,0]
@route53@ct.shortsrc==route53@[65535,63993,50372][0,0,0]
@health@ct.shortsrc==health@[58082,58853,62965][0,0,0]
@codebuild@ct.shortsrc==codebuild@[65535,59367,47802][0,0,0]
@ecr@ct.shortsrc==ecr@[57568,61680,65535][0,0,0]
@lambda@ct.shortsrc==lambda@[65535,58853,59110][0,0,0]
@eks@ct.shortsrc==eks@[61166,61166,61166][0,0,0]
@glue@ct.shortsrc==glue@[57568,65021,61423][0,0,0]
@events@ct.shortsrc==events@[65535,52171,58082][0,0,0]
@athena@ct.shortsrc==athena@[58082,59624,60652][0,0,0]
@guardduty@ct.shortsrc==guardduty@[55255,62965,56540][0,0,0]
@tagging@ct.shortsrc==tagging@[60395,51400,62451][0,0,0]
@monitoring@ct.shortsrc==monitoring@[55769,62194,63222][0,0,0]
@sns@ct.shortsrc==sns@[62708,65535,47288][0,0,0]
@secretsmanager@ct.shortsrc==secretsmanager@[60395,57311,63479][0,0,0]
!@cloudtrail@ct.shortsrc==cloudtrail@[53970,57825,62194][0,0,0]
@ec2-instance-connect@ct.shortsrc==ec2-instance-connect@[65535,63993,50372][0,0,0]
@servicequotas@ct.shortsrc==servicequotas@[58082,58853,62965][0,0,0]
@apigateway@ct.shortsrc==apigateway@[65535,59367,47802][0,0,0]
@resource-groups@ct.shortsrc==resource-groups@[57568,61680,65535][0,0,0]
@cognito-idp@ct.shortsrc==cognito-idp@[65535,58853,59110][0,0,0]
@compute-optimizer@ct.shortsrc==compute-optimizer@[61166,61166,61166][0,0,0]
@signin@ct.shortsrc==signin@[57568,65021,61423][0,0,0]
@inspector@ct.shortsrc==inspector@[65535,52171,58082][0,0,0]
@es@ct.shortsrc==es@[58082,59624,60652][0,0,0]
@cognito-identity@ct.shortsrc==cognito-identity@[55255,62965,56540][0,0,0]
@acm@ct.shortsrc==acm@[60395,51400,62451][0,0,0]
@firehose@ct.shortsrc==firehose@[55769,62194,63222][0,0,0]
@redshift@ct.shortsrc==redshift@[62708,65535,47288][0,0,0]
@workspaces@ct.shortsrc==workspaces@[60395,57311,63479][0,0,0]
@translate@ct.shortsrc==translate@[53970,57825,62194][0,0,0]
@elasticmapreduce@ct.shortsrc==elasticmapreduce@[65535,63993,50372][0,0,0]
@states@ct.shortsrc==states@[58082,58853,62965][0,0,0]
@dms@ct.shortsrc==dms@[65535,59367,47802][0,0,0]
@kinesis@ct.shortsrc==kinesis@[57568,61680,65535][0,0,0]
@access-analyzer@ct.shortsrc==access-analyzer@[65535,58853,59110][0,0,0]
@storagegateway@ct.shortsrc==storagegateway@[61166,61166,61166][0,0,0]
@waf-regional@ct.shortsrc==waf-regional@[57568,65021,61423][0,0,0]
@transfer@ct.shortsrc==transfer@[65535,52171,58082][0,0,0]
@route53domains@ct.shortsrc==route53domains@[58082,59624,60652][0,0,0]
@sagemaker@ct.shortsrc==sagemaker@[55255,62965,56540][0,0,0]
@route53resolver@ct.shortsrc==route53resolver@[60395,51400,62451][0,0,0]
@securityhub@ct.shortsrc==securityhub@[55769,62194,63222][0,0,0]
@organizations@ct.shortsrc==organizations@[62708,65535,47288][0,0,0]
@ram@ct.shortsrc==ram@[60395,57311,63479][0,0,0]
@elasticfilesystem@ct.shortsrc==elasticfilesystem@[53970,57825,62194][0,0,0]
@ds@ct.shortsrc==ds@[65535,63993,50372][0,0,0]
@codedeploy@ct.shortsrc==codedeploy@[58082,58853,62965][0,0,0]
@dax@ct.shortsrc==dax@[65535,59367,47802][0,0,0]
@support@ct.shortsrc==support@[57568,61680,65535][0,0,0]
@application-insights@ct.shortsrc==application-insights@[65535,58853,59110][0,0,0]
@cloudfront@ct.shortsrc==cloudfront@[61166,61166,61166][43690,31097,16962]
