---
cdb_lists:
  - name: 'audit-keys'
    content: |
      audit-wazuh-w:write
      audit-wazuh-r:read
      audit-wazuh-a:attribute
      audit-wazuh-x:execute
      audit-wazuh-c:command
  - name: 'aws-source'
    content: |
      ec2.amazonaws.com:
      elasticloadbalancing.amazonaws.com:
      iam.amazonaws.com:
      signin.amazonaws.com:
      kms.amazonaws.com:
      s3.amazonaws.com:
  - name: 'aws-eventnames'
    content: |
      AddUserToGroup:
      AllocateAddress:
      AssociateAddress:
      AssociateDhcpOptions:
      AssociateRouteTable:
      AttachGroupPolicy:
      AttachNetworkInterface:
      AttachRolePolicy:
      AttachUserPolicy:
      AttachVolume:
      AuthorizeSecurityGroupIngress:
      ConsoleLogin:
      CopySnapshot:
      CreateAccountAlias:
      CreateGroup:
      CreateImage:
      CreateLoadBalancer:
      CreatePlacementGroup:
      CreatePolicy:
      CreateRole:
      CreateRouteTable:
      CreateSecurityGroup:
      CreateSnapshot:
      CreateSubnet:
      CreateTags:
      CreateUser:
      CreateVolume:
      CreateVpc:
      DeleteAccountAlias:
      DeleteLoadBalancer:
      DeletePlacementGroup:
      DeleteSecurityGroup:
      DeleteSnapshot:
      DeleteTags:
      DeleteUser:
      DeleteVolume:
      DeregisterImage:
      DetachGroupPolicy:
      DetachNetworkInterface:
      DetachRolePolicy:
      DetachVolume:
      DisableKey:
      DisassociateAddress:
      DisassociateAddress:
      DisassociateRouteTable:
      GetGroup:
      ListAliases:
      ListGroups:
      ListUsers:
      ModifyImageAttribute:
      ModifyInstanceAttribute:
      ModifyNetworkInterfaceAttribute:
      ModifySnapshotAttribute:
      ModifySubnetAttribute:
      ModifyVolumeAttribute:
      MonitorInstances:
      RebootInstances:
      RegisterImage:
      RemoveUserFromGroup:
      RevokeSecurityGroupIngress:
      RunInstances:
      StartInstances:
      StopInstances:
      TerminateInstances:
      UnmonitorInstances:
      UpdateAccessKey:
      UpdateAccountPasswordPolicy:
      UpdateInstanceAlias: