Detect Cloud Instance Metadata API in Sumo Logic CSE

// Cloud Instance Metadata API Access Detection
// Pattern 1: Network connections and syslog references to metadata IP
(_sourceCategory=*linux* OR _sourceCategory=*syslog* OR _sourceCategory=*audit* OR _sourceCategory=*aws* OR _sourceCategory=*cloud*)
(
  "169.254.169.254" OR "metadata.google.internal" OR "imds.azure.com" OR
  "iam/security-credentials" OR "computeMetadata" OR "latest/meta-data" OR
  "instance-identity" OR "metadata/instance"
)
| where !(_raw matches "(?i)(AzureGuestAgent|WindowsAzureGuestAgent|WaAppAgent|amazon-ssm|google_guest_agent|cloud-init|waagent|aws-cfn-bootstrap)")
| parse regex "(?<ProcessName>[\w/.-]+)(?:\[\d+\])?:" nodrop
| parse regex "(?:cmd|command|CommandLine)[=:\s]+(?<CommandLine>[^\n]{10,200})" nodrop
| parse regex "(?:src|sip|sourceip)[=:\s]+(?<SourceIP>[\d.]+)" nodrop
| parse regex "(?:dst|dip|destip|destinationip)[=:\s]+(?<DestinationIP>[\d.]+)" nodrop
| if (DestinationIP = "169.254.169.254", "NetworkAccess",
     if (CommandLine matches "*iam/security-credentials*", "CredentialAccess",
         if (CommandLine matches "*instance-identity*", "IdentityAccess", "MetadataAccess"))) as AlertType
| count as EventCount by _messageTime, _sourceHost, ProcessName, CommandLine, DestinationIP, AlertType
| where EventCount > 0
| sort by _messageTime desc