---
title: AWS RDS Snapshot Export
description: Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot. Rule type: query Rule indices: filebeat-*, logs-aws*. Rule...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/exfiltration_rds_snapshot_export
products:
  - Elastic Security
---

# AWS RDS Snapshot Export
<warning>
  This rule has been deprecated as of 2021/08/02.
</warning>

Identifies the export of an Amazon Relational Database Service (RDS) Aurora database snapshot.
**Rule type**: query
**Rule indices**:
- filebeat-*
- logs-aws*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 10m
**Searches indices from**: `now-60m`
**Maximum alerts per execution**: 100
**References**:
- [[https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html)](https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_StartExportTask.html)

**Tags**:
- Elastic
- Cloud
- AWS
- Continuous Monitoring
- SecOps
- Asset Visibility

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Config

The AWS Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule.

## Rule Query

```kuery
event.dataset:aws.cloudtrail and event.provider:rds.amazonaws.com and event.action:StartExportTask and event.outcome:success
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Exfiltration
  - Id: TA0010
  - Reference URL: [[https://attack.mitre.org/tactics/TA0010/](https://attack.mitre.org/tactics/TA0010/)](https://attack.mitre.org/tactics/TA0010/)