This rule detects deletion of an AWS GuardDuty threat intelligence set by monitoring CloudTrail (logs-aws.cloudtrail-*) events. It triggers when a DeleteThreatIntelSet action from guardduty.amazonaws.com finishes with success, indicating removal of a custom list of known-malicious IPs or domains that GuardDuty uses to generate findings. Deleting a threat intel set reduces GuardDuty’s ability to detect communication with adversary infrastructure and may enable undetected activity if not authorized. The rule targets the CloudTrail data stream and uses a Kuery filter for: data_stream.dataset: "aws.cloudtrail" AND event.provider: "guardduty.amazonaws.com" AND event.action: "DeleteThreatIntelSet" AND event.outcome: "success". Triage emphasizes identifying the caller (aws.cloudtrail.user_identity.arn, user.name), locating the threat intel set ID and detector ID in request_parameters, and verifying whether any threat intel sets remain active. Analysts should review adjacent guardduty control-plane actions (CreateThreatIntelSet, UpdateThreatIntelSet, CreateIPSet, UpdateIPSet, DeleteDetector, CreateFilter) and assess whether a replacement set was created in a timely manner. Remediation includes recreating/restoring the set if deletion was unauthorized, rotating credentials for the calling identity, and enforcing least-privilege controls (SCP/IAM) to restrict guardduty:DeleteThreatIntelSet to authorized security roles. The rule maps to MITRE ATT&CK TA0005 Defense Evasion, subtechnique T1562.001 (Disable or Modify Tools). Setup note: AWS integration must be ingesting management events into logs-aws.cloudtrail-*. References include AWS documentation and related notes.