CloudTrail
Overview
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services (source: AWS CloudTrail Overview).
Related Built-in Rules
The following Sekoia.io built-in rules match the intake AWS CloudTrail. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x AWS CloudTrail on ATT&CK Navigator
AWS CloudTrail Config DeleteConfigurationRecorder
Detects when the Configuration Recorder was deleted. The configuration recorder is used to detect changes in your resource configurations and capture these changes as configuration items.
- Effort: intermediate
AWS CloudTrail Config Disable Channel/Recorder
Detects AWS Config Service disabling channel or recorder
- Effort: elementary
AWS CloudTrail Disable MFA
Detects a user disabling the multi factor authentication mechanism for its account. It could be a sign of malicious activity.
- Effort: intermediate
AWS CloudTrail EC2 CreateKeyPair
Detects when a key pair is created. Usually, SendSSHPublicKey is used afterwards to push the created key to an EC2 instance in order to be able to establish a connection to that instance.
- Effort: advanced
AWS CloudTrail EC2 CreateVPC
Detects when a VPC is created.
- Effort: advanced
AWS CloudTrail EC2 DeleteKeyPair
Detects when a specific key pair is deleted. This means the public key was removed from EC2.
- Effort: advanced
AWS CloudTrail EC2 Instance Connect SendSSHPublicKey
Detects when an attacker is pushing an SSH Public Key to an EC2 instance. Then he can establish a connection to the console using SSH.
- Effort: advanced
AWS CloudTrail EC2 Instance Connect SendSerialConsoleSSHPublicKey
Detects when an attacker is pushing an SSH Public Key to an EC2 instance. Then he can establish a serial connection to the console using SSH.
- Effort: advanced
AWS CloudTrail EC2 Security Group Modified
Detects when an AWS EC2 security group has been modified
- Effort: master
AWS CloudTrail EC2 Startup Script Changed
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM everytime the specific instances are booted up.
- Effort: intermediate
AWS CloudTrail EC2 Subnet Deleted
Detects when an attacker is destroying an EC2 subnet.
- Effort: master
AWS CloudTrail ECS Cluster Deleted
Detects when an attacker is destroying an AWS ECS Cluster
- Effort: intermediate
AWS CloudTrail EventBridge Rule Disabled Or Deleted
Detects when an attacker is trying to evade defenses by deleting or disabling EventBridge rules
- Effort: master
AWS CloudTrail GuardDuty Detector Deleted
Detects when an attacker is trying to evade defenses by deleting a GuardDuty detector
- Effort: intermediate
AWS CloudTrail GuardDuty Detector Suspended
Detects the suspension of the GuardDuty service
- Effort: intermediate
AWS CloudTrail GuardDuty Disruption
Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs
- Effort: intermediate
AWS CloudTrail IAM AWSCompromisedKeyQuarantineV2
Detects when AWS CloudTrail detected an AWS Access Key that was compromised, and then quarantined by AWS. This could indicate for instance that the private key was found on a GitHub public repository.
- Effort: elementary
AWS CloudTrail IAM AddClientIDToOpenIDConnectProvider
Detects the addition of a Client ID to an existing identity provider that supports OpenID Connect.
- Effort: intermediate
AWS CloudTrail IAM ChangePassword
Detects when an IAM user wants to change its password.
- Effort: advanced
AWS CloudTrail IAM CreateOpenIDConnectProvider
Detects the creation of an IAM entity to describe an identity provider that supports OpenID Connect.
- Effort: intermediate
AWS CloudTrail IAM CreateSAMLProvider
Detects when an IAM user creates a SAML provider, which could allow third-party connection and therefore could be used by attackers.
- Effort: intermediate
AWS CloudTrail IAM DeleteOpenIDConnectProvider
Detects the deletion of an IAM entity to describe an identity provider that supports OpenID Connect.
- Effort: intermediate
AWS CloudTrail IAM DeleteSAMLProvider
Detects when an IAM user deletes a SAML provider, which could be performed by attackers to cover their tracks.
- Effort: intermediate
AWS CloudTrail IAM Failed User Creation
Detects an attemp to create a user account where the result is an explicit denied.
- Effort: intermediate
AWS CloudTrail IAM Password Policy Updated
Detects an update to the password policy. This could be an attempt to lower accounts security level.
- Effort: intermediate
AWS CloudTrail IAM Policy Changed
Detects change on AWS IAM Policy
- Effort: master
AWS CloudTrail IAM RemoveClientIDFromOpenIDConnectProvider
Detects when a Client ID is removed from an identity provider that supports OpenID Connect. Could be used by attackers for sabotage or to cover their tracks.
- Effort: intermediate
AWS CloudTrail IAM UpdateOpenIDConnectProviderThumbprint
Detects the update of a ThumbPrint from an identity provider that supports OpenID Connect. This could be a sign of an attacker adding a trusted certificate.
- Effort: intermediate
AWS CloudTrail IAM UpdateSAMLProvider
Detects when an IAM user updates a SAML provider. Attackers could perform that to be stealthy by adding a third-party connection into an existing SAML provider.
- Effort: intermediate
AWS CloudTrail Important Change
Detects disabling, deleting and updating of a Trail source which could be done by some attackers trying to masquerade their activity.
- Effort: advanced
AWS CloudTrail KMS CMK Key Deleted
Detects when a CMK is deleted or scheduled for deletion
- Effort: advanced
AWS CloudTrail RDS Change Master Password
Detects the change of database master password. It may be a part of data exfiltration.
- Effort: intermediate
AWS CloudTrail RDS DB Cluster/Instance Deleted
Detects when an attacker is destroying a RDS Cluster or Instance
- Effort: advanced
AWS CloudTrail RDS Public DB Restore
Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.
- Effort: intermediate
AWS CloudTrail Remove Flow logs
Detects when an attacker is removing Flow Logs to cover their tracks
- Effort: advanced
AWS CloudTrail Root ConsoleLogin
Detects a login with a root account on AWS portal. It is a best practice to avoid root account usage for daily tasks and to create an IAM admin user.
- Effort: intermediate
AWS CloudTrail Route 53 Domain Transfer Attempt
Detects when a request in success or failure is made to transfer a domain name to an other AWS account
- Effort: intermediate
AWS CloudTrail Route 53 Domain Transfer Lock Disabled
Detects when the transfer lock feature is disabled on a domain name handled by AWS Route 53 service.
- Effort: elementary
Nimbo-C2 User Agent
Nimbo-C2 Uses an unusual User-Agent format in its implants.
- Effort: intermediate
Potential Bazar Loader User-Agents
Detects potential Bazar loader communications through the user-agent
- Effort: elementary
Potential Lemon Duck User-Agent
Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".
- Effort: elementary
SEKOIA.IO Intelligence Feed
Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.
- Effort: elementary
Event Categories
The following table lists the data source offered by this integration.
Data Source | Description |
---|---|
AWS CloudTrail logs |
Cloudtrail events are analyzed in detail |
Services |
CloudTrail logs activities from all AWS Services |
In details, the following table denotes the type of events produced by this integration.
Name | Values |
---|---|
Kind | event |
Category | authentication , iam , network |
Type | access , change |
Event Samples
Find below few samples of events and how they are normalized by Sekoia.io.
{
"message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"accountId\":\"1111111111\",\"accessKeyId\":\"ASIA1111111111111\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-08-31T07:20:10Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-08-31T09:48:47Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"ModifyInstanceAttribute\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"aws.internal\",\"userAgent\":\"aws.internal\",\"requestParameters\":{\"instanceId\":\"i-00000000000000000\",\"userData\":\"<sensitiveDataRemoved>\"},\"responseElements\":{\"requestId\":\"5fcae0f1-790c-4a86-85aa-0b3fd120e341\",\"_return\":true},\"requestID\":\"5fcae0f1-790c-4a86-85aa-0b3fd120e341\",\"eventID\":\"8311ce18-5d58-40f1-a4b3-a757df7cbe47\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"1111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}",
"event": {
"action": "ModifyInstanceAttribute",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "ec2.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2022-08-31T09:48:47Z",
"action": {
"name": "ModifyInstanceAttribute",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"requestParameters": {
"userData": "<sensitiveDataRemoved>"
},
"userIdentity": {
"accessKeyId": "ASIA1111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-08-31T07:20:10Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"flattened": {
"request_parameters": "{\"instanceId\": \"i-00000000000000000\", \"userData\": \"<sensitiveDataRemoved>\"}",
"response_elements": "{\"_return\": true, \"requestId\": \"5fcae0f1-790c-4a86-85aa-0b3fd120e341\"}"
},
"recipient_account_id": "1111111111",
"request_parameters": {
"userData": "<sensitiveDataRemoved>"
},
"user_identity": {
"accessKeyId": "ASIA1111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-08-31T07:20:10Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"instance": {
"id": "i-00000000000000000"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"hosts": [
"aws.internal"
]
},
"source": {
"address": "aws.internal",
"domain": "aws.internal",
"subdomain": "aws"
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "aws.internal",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"6ffb6978-7b42-47d1-9aa1-1838ec08b514\",\"eventName\":\"LookupEvents\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventTime\":\"2020-08-12T12:26:51Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"readOnly\":true,\"recipientAccountId\":\"1111111111\",\"requestID\":\"5b8387cf-59e8-4e6e-ba6d-5fe417820c13\",\"requestParameters\":{\"eventCategory\":\"insight\",\"maxResults\":50},\"responseElements\":null,\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"console.amazonaws.com\",\"userIdentity\":{\"accessKeyId\":\"ASIA1111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"sessionContext\":{\"attributes\":{\"creationDate\":\"2020-08-12T07:04:40Z\",\"mfaAuthenticated\":\"false\"},\"sessionIssuer\":{},\"webIdFederationData\":{}},\"type\":\"Root\"}}",
"event": {
"action": "LookupEvents",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "cloudtrail.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2020-08-12T12:26:51Z",
"action": {
"name": "LookupEvents",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"userIdentity": {
"accessKeyId": "ASIA1111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"sessionContext": {
"attributes": {
"creationDate": "2020-08-12T07:04:40Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"eventCategory\": \"insight\", \"maxResults\": 50}"
},
"recipient_account_id": "1111111111",
"user_identity": {
"accessKeyId": "ASIA1111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"sessionContext": {
"attributes": {
"creationDate": "2020-08-12T07:04:40Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "console.amazonaws.com",
"os": {
"name": "Other"
}
}
}
{
"message": "{\n \"eventVersion\": \"1.08\",\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"principalId\": \"demo\",\n \"arn\": \"arn:aws:iam::0:user/demo\",\n \"accountId\": \"00000\",\n \"accessKeyId\": \"AAAAAAAAA\",\n \"userName\": \"AAAAAAAAAAAA\"\n },\n \"eventTime\": \"2023-09-29T15:06:45Z\",\n \"eventSource\": \"ecs.amazonaws.com\",\n \"eventName\": \"PutClusterCapacityProviders\",\n \"awsRegion\": \"eu-west-1\",\n \"sourceIPAddress\": \"00.000.000.00\",\n \"userAgent\": \"APN/1.0 HashiCorp/1.0 Terraform/1.4.7 (+https://www.terraform.io) terraform-provider-aws/4.59.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.221 (go1.19.6; linux; amd64)\",\n \"requestParameters\": {\n \"cluster\": \"cluster_name\",\n \"capacityProviders\": [\n \"DEMO\"\n ],\n \"defaultCapacityProviderStrategy\": [\n {\n \"capacityProvider\": \"DEMO\",\n \"weight\": 0,\n \"base\": 0\n }\n ]\n },\n \"responseElements\": {\n \"cluster\": {\n \"clusterArn\": \"arn:aws:ecs:eu-west-1:00000000:cluster/cluster_name\",\n \"clusterName\": \"cluster_name\",\n \"configuration\": {\n \"executeCommandConfiguration\": {\n \"logging\": \"OVERRIDE\",\n \"logConfiguration\": {\n \"cloudWatchLogGroupName\": \"/ecs/cluster/cluster_name\",\n \"cloudWatchEncryptionEnabled\": true,\n \"s3EncryptionEnabled\": false\n }\n }\n },\n \"status\": \"ACTIVE\",\n \"registeredContainerInstancesCount\": 0,\n \"runningTasksCount\": 0,\n \"pendingTasksCount\": 0,\n \"activeServicesCount\": 0,\n \"statistics\": [],\n \"tags\": [],\n \"settings\": [\n {\n \"name\": \"containerInsights\",\n \"value\": \"enabled\"\n }\n ],\n \"capacityProviders\": [\n \"DEMO\"\n ],\n \"defaultCapacityProviderStrategy\": [\n {\n \"capacityProvider\": \"DEMO\",\n \"weight\": 0,\n \"base\": 0\n }\n ],\n \"attachments\": [],\n \"attachmentsStatus\": \"UPDATE_IN_PROGRESS\"\n }\n },\n \"readOnly\": false,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": true,\n \"recipientAccountId\": \"007\",\n \"eventCategory\": \"Management\",\n \"tlsDetails\": {\n \"tlsVersion\": \"TLSv1.3\",\n \"cipherSuite\": \"TLS_AES_128_GCM_SHA256\",\n \"clientProvidedHostHeader\": \"sekoia.eu-west-1.amazonaws.com\"\n }\n}",
"event": {
"kind": "event",
"category": [
"network"
],
"type": [
"access"
],
"dataset": "cloudtrail",
"action": "PutClusterCapacityProviders",
"provider": "ecs.amazonaws.com",
"outcome": "success"
},
"@timestamp": "2023-09-29T15:06:45Z",
"cloud": {
"provider": "aws",
"service": {
"name": "cloudtrail"
},
"region": "eu-west-1",
"account": {
"id": "00000"
}
},
"action": {
"type": "AwsApiCall",
"name": "PutClusterCapacityProviders",
"outcome": "success",
"target": "network-traffic",
"properties": {
"recipientAccountId": "007",
"userIdentity": {
"type": "IAMUser",
"principalId": "demo",
"arn": "arn:aws:iam::0:user/demo",
"accountId": "00000",
"accessKeyId": "AAAAAAAAA",
"userName": "AAAAAAAAAAAA"
}
}
},
"user_agent": {
"original": "APN/1.0 HashiCorp/1.0 Terraform/1.4.7 (+https://www.terraform.io) terraform-provider-aws/4.59.0 (+https://registry.terraform.io/providers/hashicorp/aws) aws-sdk-go/1.44.221 (go1.19.6; linux; amd64)",
"device": {
"name": "Other"
},
"name": "aws-sdk-go",
"version": "1.44.221",
"os": {
"name": "Linux"
}
},
"user": {
"id": "00000"
},
"tls": {
"cipher": "TLS_AES_128_GCM_SHA256",
"version": "TLSv1.3"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"recipient_account_id": "007",
"user_identity": {
"type": "IAMUser",
"principalId": "demo",
"arn": "arn:aws:iam::0:user/demo",
"accountId": "00000",
"accessKeyId": "AAAAAAAAA"
},
"cluster_name": "cluster_name",
"flattened": {
"response_elements": "{\"cluster\": {\"activeServicesCount\": 0, \"attachments\": [], \"attachmentsStatus\": \"UPDATE_IN_PROGRESS\", \"capacityProviders\": [\"DEMO\"], \"clusterArn\": \"arn:aws:ecs:eu-west-1:00000000:cluster/cluster_name\", \"clusterName\": \"cluster_name\", \"configuration\": {\"executeCommandConfiguration\": {\"logConfiguration\": {\"cloudWatchEncryptionEnabled\": true, \"cloudWatchLogGroupName\": \"/ecs/cluster/cluster_name\", \"s3EncryptionEnabled\": false}, \"logging\": \"OVERRIDE\"}}, \"defaultCapacityProviderStrategy\": [{\"base\": 0, \"capacityProvider\": \"DEMO\", \"weight\": 0}], \"pendingTasksCount\": 0, \"registeredContainerInstancesCount\": 0, \"runningTasksCount\": 0, \"settings\": [{\"name\": \"containerInsights\", \"value\": \"enabled\"}], \"statistics\": [], \"status\": \"ACTIVE\", \"tags\": []}}",
"request_parameters": "{\"capacityProviders\": [\"DEMO\"], \"cluster\": \"cluster_name\", \"defaultCapacityProviderStrategy\": [{\"base\": 0, \"capacityProvider\": \"DEMO\", \"weight\": 0}]}"
}
}
}
}
{
"message": "{\"eventVersion\": \"1.05\", \"userIdentity\": {\"type\": \"Root\", \"principalId\": \"1111111111\", \"arn\": \"arn:aws:iam::1111111111:root\", \"accountId\": \"1111111111\", \"accessKeyId\": \"AKIA1111111111\"}, \"eventTime\": \"2020-09-22T15:05:22Z\", \"eventSource\": \"ec2.amazonaws.com\", \"eventName\": \"CreateInstanceExportTask\", \"awsRegion\": \"eu-west-3\", \"sourceIPAddress\": \"1.2.3.4\", \"userAgent\": \"aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30\", \"errorCode\": \"Client.AuthFailure\", \"errorMessage\": \"vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.\", \"requestParameters\": {\"instanceId\": \"i-00000000000000\", \"targetEnvironment\": \"vmware\", \"exportToS3\": {\"diskImageFormat\": \"VMDK\", \"containerFormat\": \"ova\", \"s3Bucket\": \"qbo-export-instance-bucket\", \"s3Prefix\": \"vms\"}}, \"responseElements\": null, \"requestID\": \"5d1c2af1-f216-4771-9922-5a032e2826f5\", \"eventID\": \"249e3b13-41d4-4007-8f04-ef4b4f4341ed\", \"eventType\": \"AwsApiCall\", \"recipientAccountId\": \"1111111111\"}",
"event": {
"action": "CreateInstanceExportTask",
"category": [
"network"
],
"code": "Client.AuthFailure",
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "ec2.amazonaws.com",
"reason": "vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.",
"type": [
"access"
]
},
"@timestamp": "2020-09-22T15:05:22Z",
"action": {
"name": "CreateInstanceExportTask",
"outcome": "success",
"properties": {
"errorCode": "Client.AuthFailure",
"errorMessage": "vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.",
"recipientAccountId": "1111111111",
"userIdentity": {
"accessKeyId": "AKIA1111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"exportToS3\": {\"containerFormat\": \"ova\", \"diskImageFormat\": \"VMDK\", \"s3Bucket\": \"qbo-export-instance-bucket\", \"s3Prefix\": \"vms\"}, \"instanceId\": \"i-00000000000000\", \"targetEnvironment\": \"vmware\"}"
},
"recipient_account_id": "1111111111",
"user_identity": {
"accessKeyId": "AKIA1111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"instance": {
"id": "i-00000000000000"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Spider"
},
"name": "aws-cli",
"original": "aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30",
"os": {
"name": "Linux",
"version": "4.19.0"
},
"version": "1.18.87"
}
}
{
"message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"111111111111\",\"arn\":\"arn:aws:iam::111111111111:root\",\"accountId\":\"111111111111\",\"accessKeyId\":\"ASI00000000000000000\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-01T06:46:50Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-09-01T13:09:23Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"ModifyInstanceAttribute\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"AWS Internal\",\"requestParameters\":{\"instanceId\":\"i-00000000000000000\",\"userData\":\"<sensitiveDataRemoved>\"},\"responseElements\":{\"requestId\":\"190dc310-2b3e-41bc-ad3f-970f95f24c1b\",\"_return\":true},\"requestID\":\"190dc310-2b3e-41bc-ad3f-970f95f24c1b\",\"eventID\":\"f832abd6-9496-4f3e-9112-796f64b786e3\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"111111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}\n",
"event": {
"action": "ModifyInstanceAttribute",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "ec2.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2022-09-01T13:09:23Z",
"action": {
"name": "ModifyInstanceAttribute",
"outcome": "success",
"properties": {
"recipientAccountId": "111111111111",
"requestParameters": {
"userData": "<sensitiveDataRemoved>"
},
"userIdentity": {
"accessKeyId": "ASI00000000000000000",
"accountId": "111111111111",
"arn": "arn:aws:iam::111111111111:root",
"principalId": "111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-01T06:46:50Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"flattened": {
"request_parameters": "{\"instanceId\": \"i-00000000000000000\", \"userData\": \"<sensitiveDataRemoved>\"}",
"response_elements": "{\"_return\": true, \"requestId\": \"190dc310-2b3e-41bc-ad3f-970f95f24c1b\"}"
},
"recipient_account_id": "111111111111",
"request_parameters": {
"userData": "<sensitiveDataRemoved>"
},
"user_identity": {
"accessKeyId": "ASI00000000000000000",
"accountId": "111111111111",
"arn": "arn:aws:iam::111111111111:root",
"principalId": "111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-01T06:46:50Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "111111111111"
},
"instance": {
"id": "i-00000000000000000"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"user": {
"id": "111111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "AWS Internal",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"awsRegion\":\"us-east-1\",\"eventID\":\"76a4c7d1-1f00-4ceb-b7ad-3d355a3515cd\",\"eventName\":\"CreateUser\",\"eventSource\":\"iam.amazonaws.com\",\"eventTime\":\"2020-08-12T12:16:24Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"4ba495c6-03b8-4eb9-a812-95f89835f68c\",\"requestParameters\":{\"userName\":\"user\"},\"responseElements\":{\"user\":{\"arn\":\"arn:aws:iam::1111111111:user/user\",\"createDate\":\"Aug 12, 2020 12:16:24 PM\",\"path\":\"/\",\"userId\":\"AIDA11111111111111\",\"userName\":\"user\"}},\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30\",\"userIdentity\":{\"accessKeyId\":\"AKIA11111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"type\":\"Root\"}}",
"event": {
"action": "CreateUser",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "iam.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2020-08-12T12:16:24Z",
"action": {
"name": "CreateUser",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"userIdentity": {
"accessKeyId": "AKIA11111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"userName\": \"user\"}",
"response_elements": "{\"user\": {\"arn\": \"arn:aws:iam::1111111111:user/user\", \"createDate\": \"Aug 12, 2020 12:16:24 PM\", \"path\": \"/\", \"userId\": \"AIDA11111111111111\", \"userName\": \"user\"}}"
},
"recipient_account_id": "1111111111",
"request_parameters": {
"userName": "user"
},
"response_elements": {
"user": {
"arn": "arn:aws:iam::1111111111:user/user",
"userName": "user"
}
},
"user_identity": {
"accessKeyId": "AKIA11111111111111",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"provider": "aws",
"region": "us-east-1",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
],
"user": [
"AIDA11111111111111"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "1111111111",
"name": "AIDA11111111111111"
},
"user_agent": {
"device": {
"name": "Spider"
},
"name": "aws-cli",
"original": "aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30",
"os": {
"name": "Linux",
"version": "4.19.0"
},
"version": "1.18.87"
}
}
{
"message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"6a957c22-7dd9-4d2e-a9ba-7c869d726293\",\"eventName\":\"Decrypt\",\"eventSource\":\"kms.amazonaws.com\",\"eventTime\":\"2020-08-12T12:48:09Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"readOnly\":true,\"recipientAccountId\":\"1111111111\",\"requestID\":\"3d03af66-1431-4911-b809-ab08b9bd604a\",\"requestParameters\":{\"encryptionAlgorithm\":\"SYMMETRIC_DEFAULT\",\"encryptionContext\":{\"aws:lambda:FunctionArn\":\"arn:aws:lambda:eu-west-3:1111111111:function:ctstreamer-dev-s3\"}},\"resources\":[{\"ARN\":\"arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c\",\"accountId\":\"1111111111\",\"type\":\"AWS::KMS::Key\"}],\"responseElements\":null,\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"aws-internal/3 aws-sdk-java/1.11.802 Linux/4.14.181-108.257.amzn1.x86_64 OpenJDK_64-Bit_Server_VM/11.0.7+10-LTS java/11.0.7 vendor/Amazon.com_Inc.\",\"userIdentity\":{\"accessKeyId\":\"ASIA11111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3\",\"principalId\":\"AROA11111111111111:ctstreamer-dev-s3\",\"sessionContext\":{\"attributes\":{\"creationDate\":\"2020-08-12T12:03:12Z\",\"mfaAuthenticated\":\"false\"},\"sessionIssuer\":{\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:role/user\",\"principalId\":\"AROA11111111111111\",\"type\":\"Role\",\"userName\":\"user\"},\"webIdFederationData\":{}},\"type\":\"AssumedRole\"}}",
"event": {
"action": "Decrypt",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "kms.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2020-08-12T12:48:09Z",
"action": {
"name": "Decrypt",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"resources": [
{
"ARN": "arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c",
"accountId": "1111111111",
"type": "AWS::KMS::Key"
}
],
"userIdentity": {
"accessKeyId": "ASIA11111111111111",
"accountId": "1111111111",
"arn": "arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3",
"principalId": "AROA11111111111111:ctstreamer-dev-s3",
"sessionContext": {
"attributes": {
"creationDate": "2020-08-12T12:03:12Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:role/user",
"principalId": "AROA11111111111111",
"type": "Role",
"userName": "user"
},
"webIdFederationData": {}
},
"type": "AssumedRole"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"encryptionAlgorithm\": \"SYMMETRIC_DEFAULT\", \"encryptionContext\": {\"aws:lambda:FunctionArn\": \"arn:aws:lambda:eu-west-3:1111111111:function:ctstreamer-dev-s3\"}}"
},
"recipient_account_id": "1111111111",
"resources": [
{
"ARN": "arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c",
"accountId": "1111111111",
"type": "AWS::KMS::Key"
}
],
"user_identity": {
"accessKeyId": "ASIA11111111111111",
"accountId": "1111111111",
"arn": "arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3",
"principalId": "AROA11111111111111:ctstreamer-dev-s3",
"sessionContext": {
"attributes": {
"creationDate": "2020-08-12T12:03:12Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:role/user",
"principalId": "AROA11111111111111",
"type": "Role",
"userName": "user"
},
"webIdFederationData": {}
},
"type": "AssumedRole"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "aws-sdk-java",
"original": "aws-internal/3 aws-sdk-java/1.11.802 Linux/4.14.181-108.257.amzn1.x86_64 OpenJDK_64-Bit_Server_VM/11.0.7+10-LTS java/11.0.7 vendor/Amazon.com_Inc.",
"os": {
"name": "Linux",
"version": "4.14.181"
},
"version": "1.11.802"
}
}
{
"message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"111111111111\",\"arn\":\"arn:aws:iam::111111111111:root\",\"accountId\":\"111111111111\",\"accessKeyId\":\"ASI00000000000000000\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-01T06:46:50Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-09-01T14:13:11Z\",\"eventSource\":\"rds.amazonaws.com\",\"eventName\":\"ModifyDBInstance\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"AWS Internal\",\"requestParameters\":{\"dBInstanceIdentifier\":\"database-1\",\"applyImmediately\":true,\"masterUserPassword\":\"****\",\"allowMajorVersionUpgrade\":false,\"maxAllocatedStorage\":1000},\"responseElements\":{\"dBInstanceIdentifier\":\"database-1\",\"dBInstanceClass\":\"db.m6g.large\",\"engine\":\"postgres\",\"dBInstanceStatus\":\"available\",\"masterUsername\":\"postgres\",\"endpoint\":{\"address\":\"x.rds.amazonaws.com\",\"port\":5432,\"hostedZoneId\":\"ZMESEXB7ZGGQ3\"},\"allocatedStorage\":100,\"instanceCreateTime\":\"Sep 1, 2022 12:47:35 PM\",\"preferredBackupWindow\":\"10:10-10:40\",\"backupRetentionPeriod\":7,\"dBSecurityGroups\":[],\"vpcSecurityGroups\":[{\"vpcSecurityGroupId\":\"sg-00000000000000000\",\"status\":\"active\"}],\"dBParameterGroups\":[{\"dBParameterGroupName\":\"default.postgres13\",\"parameterApplyStatus\":\"in-sync\"}],\"availabilityZone\":\"eu-west-3b\",\"dBSubnetGroup\":{\"dBSubnetGroupName\":\"default-vpc-00000000000000000\",\"dBSubnetGroupDescription\":\"Created from the RDS Management Console\",\"vpcId\":\"vpc-00000000000000000\",\"subnetGroupStatus\":\"Complete\",\"subnets\":[{\"subnetIdentifier\":\"subnet-00000000000000000\",\"subnetAvailabilityZone\":{\"name\":\"eu-west-3a\"},\"subnetOutpost\":{},\"subnetStatus\":\"Active\"}]},\"preferredMaintenanceWindow\":\"thu:04:33-thu:05:03\",\"pendingModifiedValues\":{\"masterUserPassword\":\"****\"},\"latestRestorableTime\":\"Sep 1, 2022 2:07:11 PM\",\"multiAZ\":true,\"engineVersion\":\"13.7\",\"autoMinorVersionUpgrade\":true,\"readReplicaDBInstanceIdentifiers\":[],\"licenseModel\":\"postgresql-license\",\"iops\":3000,\"storageThroughput\":0,\"optionGroupMemberships\":[{\"optionGroupName\":\"default:postgres-13\",\"status\":\"in-sync\"}],\"secondaryAvailabilityZone\":\"eu-west-3c\",\"publiclyAccessible\":false,\"storageType\":\"io1\",\"dbInstancePort\":0,\"storageEncrypted\":true,\"kmsKeyId\":\"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\",\"dbiResourceId\":\"db-00000000000000000000000000\",\"cACertificateIdentifier\":\"rds-ca-2019\",\"domainMemberships\":[],\"copyTagsToSnapshot\":true,\"monitoringInterval\":60,\"enhancedMonitoringResourceArn\":\"arn:aws:logs:eu-west-3:111111111111:group:schema:stream:db-00000000000000000000000000\",\"monitoringRoleArn\":\"arn:aws:iam::111111111111:role/role\",\"dBInstanceArn\":\"arn:aws:rds:eu-west-3:111111111111:db:database-1\",\"iAMDatabaseAuthenticationEnabled\":false,\"performanceInsightsEnabled\":true,\"performanceInsightsKMSKeyId\":\"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\",\"performanceInsightsRetentionPeriod\":7,\"deletionProtection\":true,\"associatedRoles\":[],\"httpEndpointEnabled\":false,\"maxAllocatedStorage\":1000,\"tagList\":[],\"customerOwnedIpEnabled\":false,\"networkType\":\"IPV4\",\"backupTarget\":\"region\"},\"requestID\":\"fc070739-07b9-4533-9652-eec872b5ad3d\",\"eventID\":\"eee4217d-4a93-4ad3-89ff-108b25c4c9ab\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"111111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}\n",
"event": {
"action": "ModifyDBInstance",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "rds.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2022-09-01T14:13:11Z",
"action": {
"name": "ModifyDBInstance",
"outcome": "success",
"properties": {
"recipientAccountId": "111111111111",
"responseElements": {
"publiclyAccessible": false
},
"userIdentity": {
"accessKeyId": "ASI00000000000000000",
"accountId": "111111111111",
"arn": "arn:aws:iam::111111111111:root",
"principalId": "111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-01T06:46:50Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"flattened": {
"request_parameters": "{\"allowMajorVersionUpgrade\": false, \"applyImmediately\": true, \"dBInstanceIdentifier\": \"database-1\", \"masterUserPassword\": \"****\", \"maxAllocatedStorage\": 1000}",
"response_elements": "{\"allocatedStorage\": 100, \"associatedRoles\": [], \"autoMinorVersionUpgrade\": true, \"availabilityZone\": \"eu-west-3b\", \"backupRetentionPeriod\": 7, \"backupTarget\": \"region\", \"cACertificateIdentifier\": \"rds-ca-2019\", \"copyTagsToSnapshot\": true, \"customerOwnedIpEnabled\": false, \"dBInstanceArn\": \"arn:aws:rds:eu-west-3:111111111111:db:database-1\", \"dBInstanceClass\": \"db.m6g.large\", \"dBInstanceIdentifier\": \"database-1\", \"dBInstanceStatus\": \"available\", \"dBParameterGroups\": [{\"dBParameterGroupName\": \"default.postgres13\", \"parameterApplyStatus\": \"in-sync\"}], \"dBSecurityGroups\": [], \"dBSubnetGroup\": {\"dBSubnetGroupDescription\": \"Created from the RDS Management Console\", \"dBSubnetGroupName\": \"default-vpc-00000000000000000\", \"subnetGroupStatus\": \"Complete\", \"subnets\": [{\"subnetAvailabilityZone\": {\"name\": \"eu-west-3a\"}, \"subnetIdentifier\": \"subnet-00000000000000000\", \"subnetOutpost\": {}, \"subnetStatus\": \"Active\"}], \"vpcId\": \"vpc-00000000000000000\"}, \"dbInstancePort\": 0, \"dbiResourceId\": \"db-00000000000000000000000000\", \"deletionProtection\": true, \"domainMemberships\": [], \"endpoint\": {\"address\": \"x.rds.amazonaws.com\", \"hostedZoneId\": \"ZMESEXB7ZGGQ3\", \"port\": 5432}, \"engine\": \"postgres\", \"engineVersion\": \"13.7\", \"enhancedMonitoringResourceArn\": \"arn:aws:logs:eu-west-3:111111111111:group:schema:stream:db-00000000000000000000000000\", \"httpEndpointEnabled\": false, \"iAMDatabaseAuthenticationEnabled\": false, \"instanceCreateTime\": \"Sep 1, 2022 12:47:35 PM\", \"iops\": 3000, \"kmsKeyId\": \"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\", \"latestRestorableTime\": \"Sep 1, 2022 2:07:11 PM\", \"licenseModel\": \"postgresql-license\", \"masterUsername\": \"postgres\", \"maxAllocatedStorage\": 1000, \"monitoringInterval\": 60, \"monitoringRoleArn\": \"arn:aws:iam::111111111111:role/role\", \"multiAZ\": true, \"networkType\": \"IPV4\", \"optionGroupMemberships\": [{\"optionGroupName\": \"default:postgres-13\", \"status\": \"in-sync\"}], \"pendingModifiedValues\": {\"masterUserPassword\": \"****\"}, \"performanceInsightsEnabled\": true, \"performanceInsightsKMSKeyId\": \"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\", \"performanceInsightsRetentionPeriod\": 7, \"preferredBackupWindow\": \"10:10-10:40\", \"preferredMaintenanceWindow\": \"thu:04:33-thu:05:03\", \"publiclyAccessible\": false, \"readReplicaDBInstanceIdentifiers\": [], \"secondaryAvailabilityZone\": \"eu-west-3c\", \"storageEncrypted\": true, \"storageThroughput\": 0, \"storageType\": \"io1\", \"tagList\": [], \"vpcSecurityGroups\": [{\"status\": \"active\", \"vpcSecurityGroupId\": \"sg-00000000000000000\"}]}"
},
"recipient_account_id": "111111111111",
"response_elements": {
"pendingModifiedValues": {
"masterUserPassword": "****"
},
"publiclyAccessible": false
},
"user_identity": {
"accessKeyId": "ASI00000000000000000",
"accountId": "111111111111",
"arn": "arn:aws:iam::111111111111:root",
"principalId": "111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-01T06:46:50Z",
"mfaAuthenticated": "true"
},
"sessionIssuer": {},
"webIdFederationData": {}
},
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "111111111111"
},
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"user": {
"id": "111111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "AWS Internal",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"bcf6f457-76bc-4e8c-8a7b-8a2451481675\",\"eventName\":\"AssumeRole\",\"eventSource\":\"sts.amazonaws.com\",\"eventTime\":\"2020-08-12T12:03:12Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"34c3d58a-83f5-42cc-9e4d-1beeb85f809c\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::1111111111:role/user\",\"roleSessionName\":\"session-name\"},\"resources\":[{\"ARN\":\"arn:aws:iam::1111111111:role/user\",\"accountId\":\"1111111111\",\"type\":\"AWS::IAM::Role\"}],\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIA11111111111111\",\"expiration\":\"Aug 13, 2020, 12:03:12 AM\",\"sessionToken\":\"11111111111111111111111111111111111111111\"}},\"sharedEventID\":\"e0b224e9-a818-452c-87e3-a1d4078bb102\",\"sourceIPAddress\":\"lambda.amazonaws.com\",\"userAgent\":\"lambda.amazonaws.com\",\"userIdentity\":{\"invokedBy\":\"lambda.amazonaws.com\",\"type\":\"AWSService\"}}",
"event": {
"action": "AssumeRole",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "sts.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2020-08-12T12:03:12Z",
"action": {
"name": "AssumeRole",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"resources": [
{
"ARN": "arn:aws:iam::1111111111:role/user",
"accountId": "1111111111",
"type": "AWS::IAM::Role"
}
],
"userIdentity": {
"invokedBy": "lambda.amazonaws.com",
"type": "AWSService"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"roleArn\": \"arn:aws:iam::1111111111:role/user\", \"roleSessionName\": \"session-name\"}",
"response_elements": "{\"credentials\": {\"accessKeyId\": \"ASIA11111111111111\", \"expiration\": \"Aug 13, 2020, 12:03:12 AM\", \"sessionToken\": \"11111111111111111111111111111111111111111\"}}"
},
"recipient_account_id": "1111111111",
"resources": [
{
"ARN": "arn:aws:iam::1111111111:role/user",
"accountId": "1111111111",
"type": "AWS::IAM::Role"
}
],
"user_identity": {
"type": "AWSService"
}
}
},
"cloud": {
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"hosts": [
"lambda.amazonaws.com"
]
},
"source": {
"address": "lambda.amazonaws.com",
"domain": "lambda.amazonaws.com",
"registered_domain": "amazonaws.com",
"subdomain": "lambda",
"top_level_domain": "com"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "lambda.amazonaws.com",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"additionalEventData\":{\"LoginTo\":\"https://console.aws.amazon.com/billing/home?region=eu-west-3&state=hashArgs%23%2F&isauthcode=true\",\"MFAUsed\":\"No\",\"MobileVersion\":\"No\"},\"awsRegion\":\"us-east-1\",\"eventID\":\"9d4ca355-a7d3-4422-96ae-dbe2c3431609\",\"eventName\":\"ConsoleLogin\",\"eventSource\":\"signin.amazonaws.com\",\"eventTime\":\"2020-08-19T15:33:43Z\",\"eventType\":\"AwsConsoleSignIn\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestParameters\":null,\"responseElements\":{\"ConsoleLogin\":\"Success\"},\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\",\"userIdentity\":{\"accessKeyId\":\"\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"type\":\"Root\"}}",
"event": {
"action": "ConsoleLogin",
"category": [
"authentication"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "signin.amazonaws.com",
"type": [
"allowed"
]
},
"@timestamp": "2020-08-19T15:33:43Z",
"action": {
"name": "ConsoleLogin",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"userIdentity": {
"accessKeyId": "",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
},
"target": "network-traffic",
"type": "AwsConsoleSignIn"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"response_elements": "{\"ConsoleLogin\": \"Success\"}"
},
"recipient_account_id": "1111111111",
"user_identity": {
"accessKeyId": "",
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:root",
"principalId": "1111111111",
"type": "Root"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"provider": "aws",
"region": "us-east-1",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Firefox",
"original": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0",
"os": {
"name": "Linux"
},
"version": "68.0"
}
}
{
"message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"bcf6f457-76bc-4e8c-8a7b-8a2451481675\",\"eventName\":\"AssumeRole\",\"eventSource\":\"sts.amazonaws.com\",\"eventTime\":\"2020-08-12T12:03:12Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"34c3d58a-83f5-42cc-9e4d-1beeb85f809c\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::1111111111:role/user\",\"roleSessionName\":\"session-name\"},\"resources\":[{\"ARN\":\"arn:aws:iam::1111111111:role/user\",\"accountId\":\"1111111111\",\"type\":\"AWS::IAM::Role\"}],\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIA11111111111111\",\"expiration\":\"Aug 13, 2020, 12:03:12 AM\",\"sessionToken\":\"1111111111111111111111111111111111111111111111111111111111111111111111111\"}},\"sharedEventID\":\"e0b224e9-a818-452c-87e3-a1d4078bb102\",\"sourceIPAddress\":\"lambda.amazonaws.com\",\"userAgent\":\"lambda.amazonaws.com\",\"userIdentity\":{\"invokedBy\":\"lambda.amazonaws.com\",\"type\":\"AWSService\"}}",
"event": {
"action": "AssumeRole",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "sts.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2020-08-12T12:03:12Z",
"action": {
"name": "AssumeRole",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"resources": [
{
"ARN": "arn:aws:iam::1111111111:role/user",
"accountId": "1111111111",
"type": "AWS::IAM::Role"
}
],
"userIdentity": {
"invokedBy": "lambda.amazonaws.com",
"type": "AWSService"
}
},
"target": "network-traffic",
"type": "AwsApiCall"
},
"aws": {
"cloudtrail": {
"event_version": "1.05",
"flattened": {
"request_parameters": "{\"roleArn\": \"arn:aws:iam::1111111111:role/user\", \"roleSessionName\": \"session-name\"}",
"response_elements": "{\"credentials\": {\"accessKeyId\": \"ASIA11111111111111\", \"expiration\": \"Aug 13, 2020, 12:03:12 AM\", \"sessionToken\": \"1111111111111111111111111111111111111111111111111111111111111111111111111\"}}"
},
"recipient_account_id": "1111111111",
"resources": [
{
"ARN": "arn:aws:iam::1111111111:role/user",
"accountId": "1111111111",
"type": "AWS::IAM::Role"
}
],
"user_identity": {
"type": "AWSService"
}
}
},
"cloud": {
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
},
"related": {
"hosts": [
"lambda.amazonaws.com"
]
},
"source": {
"address": "lambda.amazonaws.com",
"domain": "lambda.amazonaws.com",
"registered_domain": "amazonaws.com",
"subdomain": "lambda",
"top_level_domain": "com"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "lambda.amazonaws.com",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"eventVersion\":\"1.08\",\"eventTime\":\"2022-09-05T07:45:00Z\",\"awsRegion\":\"eu-west-3\",\"eventID\":\"7a9130fc-ca15-49d9-b4aa-685f7a0c182a\",\"eventType\":\"AwsCloudTrailInsight\",\"recipientAccountId\":\"1111111111\",\"sharedEventID\":\"0a771801-c0cc-406d-a080-219de884f089\",\"insightDetails\":{\"state\":\"End\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"GetBucketPolicy\",\"insightType\":\"ApiErrorRateInsight\",\"errorCode\":\"NoSuchBucketPolicy\",\"insightContext\":{\"statistics\":{\"baseline\":{\"average\":0.0021817492},\"insight\":{\"average\":1.3333333333},\"insightDuration\":3,\"baselineDuration\":10542},\"attributions\":[{\"attribute\":\"userIdentityArn\",\"insight\":[{\"value\":\"arn:aws:iam::1111111111:root\",\"average\":1.3333333333}],\"baseline\":[{\"value\":\"arn:aws:iam::1111111111:root\",\"average\":0.0020868905},{\"value\":\"arn:aws:sts::1111111111:assumed-role/AWSServiceRoleForConfig/AWSConfig-Describe\",\"average\":9.48587e-05}]},{\"attribute\":\"userAgent\",\"insight\":[{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.6666666667},{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.6666666667}],\"baseline\":[{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.0010434453},{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.0009485866},{\"value\":\"AWS Internal\",\"average\":0.0001897173}]}]}},\"eventCategory\":\"Insight\"}\n",
"event": {
"action": "GetBucketPolicy",
"category": [
"network"
],
"code": "NoSuchBucketPolicy",
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "s3.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2022-09-05T07:45:00Z",
"action": {
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111"
},
"target": "network-traffic",
"type": "AwsCloudTrailInsight"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"insight_details": {
"context": "{\"attributions\": [{\"attribute\": \"userIdentityArn\", \"baseline\": [{\"average\": 0.0020868905, \"value\": \"arn:aws:iam::1111111111:root\"}, {\"average\": 9.48587e-05, \"value\": \"arn:aws:sts::1111111111:assumed-role/AWSServiceRoleForConfig/AWSConfig-Describe\"}], \"insight\": [{\"average\": 1.3333333333, \"value\": \"arn:aws:iam::1111111111:root\"}]}, {\"attribute\": \"userAgent\", \"baseline\": [{\"average\": 0.0010434453, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.0009485866, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.0001897173, \"value\": \"AWS Internal\"}], \"insight\": [{\"average\": 0.6666666667, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.6666666667, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}]}], \"statistics\": {\"baseline\": {\"average\": 0.0021817492}, \"baselineDuration\": 10542, \"insight\": {\"average\": 1.3333333333}, \"insightDuration\": 3}}",
"state": "End",
"type": "ApiErrorRateInsight"
},
"recipient_account_id": "1111111111"
}
},
"cloud": {
"provider": "aws",
"region": "eu-west-3",
"service": {
"name": "cloudtrail"
}
}
}
{
"message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AR0000000000000000:1111111111111111111111111\",\"arn\":\"arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111\",\"accountId\":\"1111111111\",\"accessKeyId\":\"AS000000000000000000\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AR0000000000000000\",\"arn\":\"arn:aws:iam::1111111111:role/service-role/username\",\"accountId\":\"1111111111\",\"userName\":\"username\"},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-09T07:45:14Z\",\"mfaAuthenticated\":\"false\"}}},\"eventTime\":\"2022-09-09T09:17:32Z\",\"eventSource\":\"elasticfilesystem.amazonaws.com\",\"eventName\":\"NewClientConnection\",\"awsRegion\":\"eu-central-1\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"elasticfilesystem\",\"requestParameters\":null,\"responseElements\":null,\"eventID\":\"6ff7e265-b0b9-42c0-b4b5-ad140a7f1baa\",\"readOnly\":true,\"resources\":[{\"accountId\":\"1111111111\",\"type\":\"AWS::EFS::FileSystem\",\"ARN\":\"arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000\"},{\"accountId\":\"1111111111\",\"type\":\"AWS::EFS::AccessPoint\",\"ARN\":\"arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000\"}],\"eventType\":\"AwsServiceEvent\",\"managementEvent\":true,\"recipientAccountId\":\"1111111111\",\"serviceEventDetails\":{\"permissions\":{\"ClientRootAccess\":false,\"ClientMount\":true,\"ClientWrite\":true},\"sourceIpAddress\":\"1.2.3.4\"},\"eventCategory\":\"Management\"}\n",
"event": {
"action": "NewClientConnection",
"category": [
"network"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "elasticfilesystem.amazonaws.com",
"type": [
"access"
]
},
"@timestamp": "2022-09-09T09:17:32Z",
"action": {
"name": "NewClientConnection",
"outcome": "success",
"properties": {
"recipientAccountId": "1111111111",
"resources": [
{
"ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000",
"accountId": "1111111111",
"type": "AWS::EFS::FileSystem"
},
{
"ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000",
"accountId": "1111111111",
"type": "AWS::EFS::AccessPoint"
}
],
"userIdentity": {
"accessKeyId": "AS000000000000000000",
"accountId": "1111111111",
"arn": "arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111",
"principalId": "AR0000000000000000:1111111111111111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-09T07:45:14Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:role/service-role/username",
"principalId": "AR0000000000000000",
"type": "Role",
"userName": "username"
},
"webIdFederationData": {}
},
"type": "AssumedRole"
}
},
"target": "network-traffic",
"type": "AwsServiceEvent"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"recipient_account_id": "1111111111",
"resources": [
{
"ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000",
"accountId": "1111111111",
"type": "AWS::EFS::FileSystem"
},
{
"ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000",
"accountId": "1111111111",
"type": "AWS::EFS::AccessPoint"
}
],
"user_identity": {
"accessKeyId": "AS000000000000000000",
"accountId": "1111111111",
"arn": "arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111",
"principalId": "AR0000000000000000:1111111111111111111111111",
"sessionContext": {
"attributes": {
"creationDate": "2022-09-09T07:45:14Z",
"mfaAuthenticated": "false"
},
"sessionIssuer": {
"accountId": "1111111111",
"arn": "arn:aws:iam::1111111111:role/service-role/username",
"principalId": "AR0000000000000000",
"type": "Role",
"userName": "username"
},
"webIdFederationData": {}
},
"type": "AssumedRole"
}
}
},
"cloud": {
"account": {
"id": "1111111111"
},
"provider": "aws",
"region": "eu-central-1",
"service": {
"name": "cloudtrail"
}
},
"user": {
"id": "1111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Other",
"original": "elasticfilesystem",
"os": {
"name": "Other"
}
}
}
{
"message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"A00000000000000000000:user@example.org\",\"arn\":\"arn:aws:sts::111111111:assumed-role/role/user@example.org\",\"accountId\":\"111111111\"},\"eventTime\":\"2022-09-08T15:01:59Z\",\"eventSource\":\"signin.amazonaws.com\",\"eventName\":\"ConsoleLogin\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36\",\"requestParameters\":null,\"responseElements\":{\"ConsoleLogin\":\"Success\"},\"additionalEventData\":{\"LoginTo\":\"https://console.aws.amazon.com/console/home\",\"MobileVersion\":\"No\",\"MFAUsed\":\"No\",\"SamlProviderArn\":\"arn:aws:iam::111111111:saml-provider/provider-name\"},\"eventID\":\"e7dd6d97-2d3a-45dc-bb19-a3ea347091e3\",\"readOnly\":false,\"eventType\":\"AwsConsoleSignIn\",\"managementEvent\":true,\"recipientAccountId\":\"111111111\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.2\",\"cipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"clientProvidedHostHeader\":\"signin.aws.amazon.com\"}}\n",
"event": {
"action": "ConsoleLogin",
"category": [
"authentication"
],
"dataset": "cloudtrail",
"kind": "event",
"outcome": "success",
"provider": "signin.amazonaws.com",
"type": [
"allowed"
]
},
"@timestamp": "2022-09-08T15:01:59Z",
"action": {
"name": "ConsoleLogin",
"outcome": "success",
"properties": {
"recipientAccountId": "111111111",
"userIdentity": {
"accountId": "111111111",
"arn": "arn:aws:sts::111111111:assumed-role/role/user@example.org",
"principalId": "A00000000000000000000:user@example.org",
"type": "AssumedRole"
}
},
"target": "network-traffic",
"type": "AwsConsoleSignIn"
},
"aws": {
"cloudtrail": {
"event_version": "1.08",
"flattened": {
"response_elements": "{\"ConsoleLogin\": \"Success\"}"
},
"recipient_account_id": "111111111",
"user_identity": {
"accountId": "111111111",
"arn": "arn:aws:sts::111111111:assumed-role/role/user@example.org",
"principalId": "A00000000000000000000:user@example.org",
"type": "AssumedRole"
}
}
},
"cloud": {
"account": {
"id": "111111111"
},
"provider": "aws",
"region": "us-east-1",
"service": {
"name": "cloudtrail"
}
},
"related": {
"ip": [
"1.2.3.4"
]
},
"source": {
"address": "1.2.3.4",
"ip": "1.2.3.4"
},
"tls": {
"cipher": "ECDHE-RSA-AES128-GCM-SHA256",
"version": "TLSv1.2"
},
"user": {
"id": "111111111"
},
"user_agent": {
"device": {
"name": "Other"
},
"name": "Chrome",
"original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36",
"os": {
"name": "Windows",
"version": "10"
},
"version": "105.0.0"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
Name | Type | Description |
---|---|---|
@timestamp |
date |
Date/time when the event originated. |
action.properties.errorCode |
keyword |
The code of the error associated to the request |
action.properties.errorMessage |
keyword |
The message of the error associated to the request |
action.properties.recipientAccountId |
keyword |
The account ID that received the event |
action.properties.requestParameters.userData |
keyword |
The userData parameters sent with the request |
action.properties.resources |
list |
A list of resources accessed in the event |
action.properties.responseElements.pendingModifiedValues.masterUserPassword |
keyword |
The new master password for the RDS instance |
action.properties.responseElements.publiclyAccessible |
boolean |
Whether the requested ressource was public |
action.properties.userIdentity |
object |
Information about the user that made the request |
action.target |
keyword |
The target of the action |
aws.cloudtrail.cluster_name |
keyword |
The name of the cluster |
aws.cloudtrail.event_version |
keyword |
The version of the event |
aws.cloudtrail.flattened.request_parameters |
keyword |
The flattened version of the field requestParameters |
aws.cloudtrail.flattened.response_elements |
keyword |
The flattened version of the field responseElements |
aws.cloudtrail.insight_details.context |
keyword |
The context of the insight |
aws.cloudtrail.insight_details.state |
keyword |
The status of the insight |
aws.cloudtrail.insight_details.type |
keyword |
The type of the insight |
aws.cloudtrail.recipient_account_id |
keyword |
The account ID that received the event |
aws.cloudtrail.request_parameters.userData |
keyword |
The userData parameters sent with the request |
aws.cloudtrail.request_parameters.userName |
keyword |
The name of the user sent in the request |
aws.cloudtrail.resources |
list |
A list of resources accessed in the event |
aws.cloudtrail.response_elements.pendingModifiedValues.masterUserPassword |
keyword |
The new master password for the RDS instance |
aws.cloudtrail.response_elements.publiclyAccessible |
boolean |
Whether the requested ressource was public |
aws.cloudtrail.response_elements.user.arn |
keyword |
The arn of the user in the response |
aws.cloudtrail.response_elements.user.userName |
keyword |
The name of the user in the response |
cloud.account.id |
keyword |
The cloud account or organization id. |
cloud.instance.id |
keyword |
Instance ID of the host machine. |
cloud.provider |
keyword |
Name of the cloud provider. |
cloud.region |
keyword |
Region in which this host, resource, or service is located. |
cloud.service.name |
keyword |
The cloud service name. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.code |
keyword |
Identification code for this event. |
event.dataset |
keyword |
Name of the dataset. |
event.kind |
keyword |
The kind of the event. The highest categorization field in the hierarchy. |
event.provider |
keyword |
Source of the event. |
event.reason |
keyword |
Reason why this event happened, according to the source |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
source.address |
keyword |
Source network address. |
source.domain |
keyword |
The domain name of the source. |
source.ip |
ip |
IP address of the source. |
tls.cipher |
keyword |
String indicating the cipher used during the current connection. |
tls.version |
keyword |
Numeric part of the version parsed from the original string. |
user.id |
keyword |
Unique identifier of the user. |
user.name |
keyword |
Short name or login of the user. |
user_agent.original |
keyword |
Unparsed user_agent string. |
Configure
CloudTrail trail
As a prerequisite you need an existing CloudTrail trail and configure it to record activities from services that you want to monitor.
In the AWS console, navigate to: Services > CloudTrail > Trails
. From there, enable the events that you want to record:
- Management events: provide visibility into management operations that are performed on resources in your AWS account
- Insights events: help AWS users identify and respond to unusual activity associated with write API calls by continuously analyzing CloudTrail management events. Insights events are logged when CloudTrail detects unusual write management API activity in your account
- Data events: provide visibility into the resource operations performed on or within a resource
Activate the logging on the trail through the switch button (On/Off) located on the top right hand corner of the trail page.
Prerequisites
- An administator access to the Amazon console with the permission to create SQS queue and S3 notifications.
- A self managed AWS S3 bucket where events will be published prior to be consumed by Sekoia.io.
Create a SQS queue
This integration relies on S3 Event Notifications (SQS) to discover new S3 objects.
To enable the S3 Event Notification:
- Create a queue in the SQS service by following this guide
- In the Access Policy step, choose the advanced configuration and adapt this configuration sample with your own SQS Amazon Resource Name (ARN) (the main change is the Service directive allowing S3 bucket access):
{ "Version": "2008-10-17", "Id": "__default_policy_ID", "Statement": [ { "Sid": "__owner_statement", "Effect": "Allow", "Principal": { "Service": "s3.amazonaws.com" }, "Action": "SQS:*", "Resource": "arn:aws:sqs:XXX:XXX" } ] }
Note
Keep in mind that you have to create the SQS queue in the same region as the S3 bucket you want to watch.
Create a S3 Event Notification
Use the following guide to create S3 Event Notification and then:
- Select the notification for object creation in the Event type section
- As the destination, choose the SQS service
- Select the queue you created in the previous section
Create the intake
Go to the intake page and create a new intake from the format AWS CloudTrail
.
Pull events
Go to the playbook page and create a new playbook with the Fetch new CloudTrail records on S3 connector.
Set up the module configuration with the AWS Access Key, the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created.
Important
In the "Trigger Configuration" settings of your Cloudtrail playbook, we recommand the following configuration by default: chunk_size = 10000
, frequency = 10
and tick the box
"delete_consumed_messages" that will delete S3 notifications of your Amazon Simple Queue Service, avoiding duplicates.
Start the playbook and enjoy your events.