Silent sources
Hear when a source stops sending, for example because someone turned CloudTrail off.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
An attacker who switches off logging leaves no event behind. The only signal is silence. Set silent hours on a source and ShellOrbit raises a finding when nothing arrives for that long.
Set it
On the source’s page, set Alert after this many hours without an event. 0 turns it off. Pick a value comfortably longer than the quietest normal stretch: a busy AWS account may never go an hour without an event, while a small GitHub organization can be quiet all weekend.
| Source | A sensible start |
|---|---|
| AWS with the guide’s event pattern | 24 hours |
| AWS root activity rule alone | Leave off; it is meant to stay silent |
| GitHub organization | 72 hours |
| Okta or Auth0 | 6 hours on a busy tenant, 24 on a quiet one |
| Your app’s sign in events | 1 to 6 hours, by traffic |
What happens
- One medium finding, “No events from the source for N hours”, and the usual alerts.
- No repeats while it stays silent.
- It resolves on its own when events resume, with the gap kept in its history.
The check runs every few minutes, so a finding can arrive a few minutes after the hours you set.