Skip to content

CloudTrail

Overview

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services (source: AWS CloudTrail Overview).

Benefit from SEKOIA.IO built-in rules and upgrade AWS CloudTrail with the following detection capabilities out-of-the-box.

SEKOIA.IO x AWS CloudTrail on ATT&CK Navigator

AWS CloudTrail Important Change

Detects disabling, deleting and updating of a Trail source which could be done by some attackers trying to masquerade their activity.

  • Effort: advanced
AWS Config Disable Channel/Recorder

Detects AWS Config Service disabling channel or recorder

  • Effort: elementary
AWS Disable MFA

Detects a user disabling the multi factor authentication mechanism for its account. It could be a sign of malicious activity.

  • Effort: intermediate
AWS EC2 Security Group Modified

Detects when an AWS EC2 security group has been modified

  • Effort: master
AWS EC2 Startup Script Changed

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM everytime the specific instances are booted up.

  • Effort: intermediate
AWS EC2 Subnet Deleted

Detects when an attacker is destroying an EC2 subnet.

  • Effort: master
AWS EC2 VM Export Failure

Detects attempt to export an AWS EC2 instance. A VM Export might indicate an attempt to extract information from an instance.

  • Effort: intermediate
AWS ECS Cluster Deleted

Detects when an attacker is destroying an AWS ECS Cluster

  • Effort: intermediate
AWS EventBridge Rule Disabled Or Deleted

Detects when an attacker is trying to evade defenses by deleting or disabling EventBridge rules

  • Effort: master
AWS GuardDuty Detector Deleted

Detects when an attacker is trying to evade defenses by deleting a GuardDuty detector

  • Effort: elementary
AWS GuardDuty Detector Suspended

Detects the suspension of the GuardDuty service

  • Effort: elementary
AWS GuardDuty Disruption

Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs

  • Effort: intermediate
AWS IAM Failed User Creation

Detects an attemp to create a user account where the result is an explicit denied.

  • Effort: intermediate
AWS IAM Password Policy Updated

Detects an update to the password policy. This could be an attempt to lower accounts security level.

  • Effort: intermediate
AWS IAM Policy Changed

Detects change on AWS IAM Policy

  • Effort: master
AWS KMS CMK Key Deleted

Detects when a CMK is deleted or scheduled for deletion

  • Effort: advanced
AWS RDS Change Master Password

Detects the change of database master password. It may be a part of data exfiltration.

  • Effort: intermediate
AWS RDS DB Cluster/Instance Deleted

Detects when an attacker is destroying a RDS Cluster or Instance

  • Effort: advanced
AWS RDS Public DB Restore

Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.

  • Effort: intermediate
AWS Remove Flow logs

Detects when an attacker is removing Flow Logs to cover their tracks

  • Effort: elementary
AWS Route 53 Domain Transfer Attempt

Detects when a request in success or failure is made to transfer a domain name to an other AWS account

  • Effort: intermediate
AWS Route 53 Domain Transfer Lock Disabled

Detects when the transfer lock feature is disabled on a domain name handled by AWS Route 53 service.

  • Effort: elementary
Audit CVE Event

Detects events generated by Windows to indicate the exploitation of a known vulnerability

  • Effort: elementary
Covenant Default HTTP Beaconing

Detects potential Covenant communications through the user-agent and specific urls

  • Effort: intermediate
Fortinet Firewall Login In Failure

Detects failed login attemps on firewall administration rule. Prerequisites, check that the firewall logs format corresponds to the rule

  • Effort: master
Fortinet Firewall Successful External Login

Detects succesfull access to administration console of firewall from another IP address than 127.0.0.1. Prerequisites, check that the firewall logs format corresponds to the rule

  • Effort: master
Potential Bazar Loader User-Agents

Detects potential Bazar loader communications through the user-agent

  • Effort: elementary
Potential Lemon Duck User-Agent

Detects LemonDuck user agent. The format used two sets of alphabetical characters separated by dashes, for example "User-Agent: Lemon-Duck-[A-Z]-[A-Z]".

  • Effort: elementary
RYUK Ransomeware - martinstevens Username

Detects user name "martinstevens". Wizard Spider is used to add the user name "martinstevens" to the AD of its victims. It was observed in several campaigns; in 2019 and 2020.

  • Effort: elementary
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
TrevorC2 HTTP Communication

Detects TrevorC2 HTTP communication based on the HTTP request URI and the user-agent.

  • Effort: elementary

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
AWS CloudTrail logs Cloudtrail events are analyzed in detail
Services CloudTrail logs activities from all AWS Services

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind event
Category authentication, iam, network
Type access, change

Event Samples

Find below few samples of events and how they are normalized by SEKOIA.IO.

{
    "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"accountId\":\"1111111111\",\"accessKeyId\":\"ASIA1111111111111\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-08-31T07:20:10Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-08-31T09:48:47Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"ModifyInstanceAttribute\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"aws.internal\",\"userAgent\":\"aws.internal\",\"requestParameters\":{\"instanceId\":\"i-00000000000000000\",\"userData\":\"<sensitiveDataRemoved>\"},\"responseElements\":{\"requestId\":\"5fcae0f1-790c-4a86-85aa-0b3fd120e341\",\"_return\":true},\"requestID\":\"5fcae0f1-790c-4a86-85aa-0b3fd120e341\",\"eventID\":\"8311ce18-5d58-40f1-a4b3-a757df7cbe47\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"1111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "ModifyInstanceAttribute",
        "provider": "ec2.amazonaws.com"
    },
    "@timestamp": "2022-08-31T09:48:47.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "1111111111"
        },
        "instance": {
            "id": "i-00000000000000000"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "ModifyInstanceAttribute",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "type": "Root",
                "principalId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "accountId": "1111111111",
                "accessKeyId": "ASIA1111111111111",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-08-31T07:20:10Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "requestParameters": {
                "userData": "<sensitiveDataRemoved>"
            }
        }
    },
    "user_agent": {
        "original": "aws.internal"
    },
    "user": {
        "id": "1111111111"
    },
    "source": {
        "address": "aws.internal",
        "domain": "aws.internal"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "type": "Root",
                "principalId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "accountId": "1111111111",
                "accessKeyId": "ASIA1111111111111",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-08-31T07:20:10Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "request_parameters": {
                "userData": "<sensitiveDataRemoved>"
            },
            "flattened": {
                "response_elements": "{\"_return\": true, \"requestId\": \"5fcae0f1-790c-4a86-85aa-0b3fd120e341\"}",
                "request_parameters": "{\"instanceId\": \"i-00000000000000000\", \"userData\": \"\\u003csensitiveDataRemoved\\u003e\"}"
            }
        }
    },
    "related": {
        "hosts": [
            "aws.internal"
        ]
    }
}
{
    "message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"6ffb6978-7b42-47d1-9aa1-1838ec08b514\",\"eventName\":\"LookupEvents\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventTime\":\"2020-08-12T12:26:51Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"readOnly\":true,\"recipientAccountId\":\"1111111111\",\"requestID\":\"5b8387cf-59e8-4e6e-ba6d-5fe417820c13\",\"requestParameters\":{\"eventCategory\":\"insight\",\"maxResults\":50},\"responseElements\":null,\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"console.amazonaws.com\",\"userIdentity\":{\"accessKeyId\":\"ASIA1111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"sessionContext\":{\"attributes\":{\"creationDate\":\"2020-08-12T07:04:40Z\",\"mfaAuthenticated\":\"false\"},\"sessionIssuer\":{},\"webIdFederationData\":{}},\"type\":\"Root\"}}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "LookupEvents",
        "provider": "cloudtrail.amazonaws.com"
    },
    "@timestamp": "2020-08-12T12:26:51.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "1111111111"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "LookupEvents",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "accessKeyId": "ASIA1111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "sessionContext": {
                    "attributes": {
                        "creationDate": "2020-08-12T07:04:40Z",
                        "mfaAuthenticated": "false"
                    },
                    "sessionIssuer": {},
                    "webIdFederationData": {}
                },
                "type": "Root"
            }
        }
    },
    "user_agent": {
        "original": "console.amazonaws.com"
    },
    "user": {
        "id": "1111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "accessKeyId": "ASIA1111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "sessionContext": {
                    "attributes": {
                        "creationDate": "2020-08-12T07:04:40Z",
                        "mfaAuthenticated": "false"
                    },
                    "sessionIssuer": {},
                    "webIdFederationData": {}
                },
                "type": "Root"
            },
            "flattened": {
                "request_parameters": "{\"eventCategory\": \"insight\", \"maxResults\": 50}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    }
}
{
    "message": "{\"eventVersion\": \"1.05\", \"userIdentity\": {\"type\": \"Root\", \"principalId\": \"1111111111\", \"arn\": \"arn:aws:iam::1111111111:root\", \"accountId\": \"1111111111\", \"accessKeyId\": \"AKIA1111111111\"}, \"eventTime\": \"2020-09-22T15:05:22Z\", \"eventSource\": \"ec2.amazonaws.com\", \"eventName\": \"CreateInstanceExportTask\", \"awsRegion\": \"eu-west-3\", \"sourceIPAddress\": \"1.2.3.4\", \"userAgent\": \"aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30\", \"errorCode\": \"Client.AuthFailure\", \"errorMessage\": \"vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.\", \"requestParameters\": {\"instanceId\": \"i-00000000000000\", \"targetEnvironment\": \"vmware\", \"exportToS3\": {\"diskImageFormat\": \"VMDK\", \"containerFormat\": \"ova\", \"s3Bucket\": \"qbo-export-instance-bucket\", \"s3Prefix\": \"vms\"}}, \"responseElements\": null, \"requestID\": \"5d1c2af1-f216-4771-9922-5a032e2826f5\", \"eventID\": \"249e3b13-41d4-4007-8f04-ef4b4f4341ed\", \"eventType\": \"AwsApiCall\", \"recipientAccountId\": \"1111111111\"}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "CreateInstanceExportTask",
        "code": "Client.AuthFailure",
        "reason": "vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.",
        "provider": "ec2.amazonaws.com"
    },
    "@timestamp": "2020-09-22T15:05:22.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "1111111111"
        },
        "instance": {
            "id": "i-00000000000000"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "CreateInstanceExportTask",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "errorCode": "Client.AuthFailure",
            "errorMessage": "vm-import-export@amazon.com must have WRITE and READ_ACL permission on the S3 bucket.",
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "type": "Root",
                "principalId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "accountId": "1111111111",
                "accessKeyId": "AKIA1111111111"
            }
        }
    },
    "user_agent": {
        "original": "aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30"
    },
    "user": {
        "id": "1111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "type": "Root",
                "principalId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "accountId": "1111111111",
                "accessKeyId": "AKIA1111111111"
            },
            "flattened": {
                "request_parameters": "{\"exportToS3\": {\"containerFormat\": \"ova\", \"diskImageFormat\": \"VMDK\", \"s3Bucket\": \"qbo-export-instance-bucket\", \"s3Prefix\": \"vms\"}, \"instanceId\": \"i-00000000000000\", \"targetEnvironment\": \"vmware\"}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    }
}
{
    "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"111111111111\",\"arn\":\"arn:aws:iam::111111111111:root\",\"accountId\":\"111111111111\",\"accessKeyId\":\"ASI00000000000000000\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-01T06:46:50Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-09-01T13:09:23Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"ModifyInstanceAttribute\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"AWS Internal\",\"requestParameters\":{\"instanceId\":\"i-00000000000000000\",\"userData\":\"<sensitiveDataRemoved>\"},\"responseElements\":{\"requestId\":\"190dc310-2b3e-41bc-ad3f-970f95f24c1b\",\"_return\":true},\"requestID\":\"190dc310-2b3e-41bc-ad3f-970f95f24c1b\",\"eventID\":\"f832abd6-9496-4f3e-9112-796f64b786e3\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"111111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}\n",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "ModifyInstanceAttribute",
        "provider": "ec2.amazonaws.com"
    },
    "@timestamp": "2022-09-01T13:09:23.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "111111111111"
        },
        "instance": {
            "id": "i-00000000000000000"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "ModifyInstanceAttribute",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "111111111111",
            "userIdentity": {
                "type": "Root",
                "principalId": "111111111111",
                "arn": "arn:aws:iam::111111111111:root",
                "accountId": "111111111111",
                "accessKeyId": "ASI00000000000000000",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-01T06:46:50Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "requestParameters": {
                "userData": "<sensitiveDataRemoved>"
            }
        }
    },
    "user_agent": {
        "original": "AWS Internal"
    },
    "user": {
        "id": "111111111111"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "111111111111",
            "user_identity": {
                "type": "Root",
                "principalId": "111111111111",
                "arn": "arn:aws:iam::111111111111:root",
                "accountId": "111111111111",
                "accessKeyId": "ASI00000000000000000",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-01T06:46:50Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "request_parameters": {
                "userData": "<sensitiveDataRemoved>"
            },
            "flattened": {
                "response_elements": "{\"_return\": true, \"requestId\": \"190dc310-2b3e-41bc-ad3f-970f95f24c1b\"}",
                "request_parameters": "{\"instanceId\": \"i-00000000000000000\", \"userData\": \"\\u003csensitiveDataRemoved\\u003e\"}"
            }
        }
    }
}
{
    "message": "{\"awsRegion\":\"us-east-1\",\"eventID\":\"76a4c7d1-1f00-4ceb-b7ad-3d355a3515cd\",\"eventName\":\"CreateUser\",\"eventSource\":\"iam.amazonaws.com\",\"eventTime\":\"2020-08-12T12:16:24Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"4ba495c6-03b8-4eb9-a812-95f89835f68c\",\"requestParameters\":{\"userName\":\"user\"},\"responseElements\":{\"user\":{\"arn\":\"arn:aws:iam::1111111111:user/user\",\"createDate\":\"Aug 12, 2020 12:16:24 PM\",\"path\":\"/\",\"userId\":\"AIDA11111111111111\",\"userName\":\"user\"}},\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30\",\"userIdentity\":{\"accessKeyId\":\"AKIA11111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"type\":\"Root\"}}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "CreateUser",
        "provider": "iam.amazonaws.com"
    },
    "@timestamp": "2020-08-12T12:16:24.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "us-east-1",
        "account": {
            "id": "1111111111"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "CreateUser",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "accessKeyId": "AKIA11111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "type": "Root"
            }
        }
    },
    "user_agent": {
        "original": "aws-cli/1.18.87 Python/3.7.3 Linux/4.19.0-6-amd64 botocore/1.17.30"
    },
    "user": {
        "id": "1111111111",
        "name": "AIDA11111111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "accessKeyId": "AKIA11111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "type": "Root"
            },
            "request_parameters": {
                "userName": "user"
            },
            "response_elements": {
                "user": {
                    "userName": "user",
                    "arn": "arn:aws:iam::1111111111:user/user"
                }
            },
            "flattened": {
                "response_elements": "{\"user\": {\"arn\": \"arn:aws:iam::1111111111:user/user\", \"createDate\": \"Aug 12, 2020 12:16:24 PM\", \"path\": \"/\", \"userId\": \"AIDA11111111111111\", \"userName\": \"user\"}}",
                "request_parameters": "{\"userName\": \"user\"}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "AIDA11111111111111"
        ]
    }
}
{
    "message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"6a957c22-7dd9-4d2e-a9ba-7c869d726293\",\"eventName\":\"Decrypt\",\"eventSource\":\"kms.amazonaws.com\",\"eventTime\":\"2020-08-12T12:48:09Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"readOnly\":true,\"recipientAccountId\":\"1111111111\",\"requestID\":\"3d03af66-1431-4911-b809-ab08b9bd604a\",\"requestParameters\":{\"encryptionAlgorithm\":\"SYMMETRIC_DEFAULT\",\"encryptionContext\":{\"aws:lambda:FunctionArn\":\"arn:aws:lambda:eu-west-3:1111111111:function:ctstreamer-dev-s3\"}},\"resources\":[{\"ARN\":\"arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c\",\"accountId\":\"1111111111\",\"type\":\"AWS::KMS::Key\"}],\"responseElements\":null,\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"aws-internal/3 aws-sdk-java/1.11.802 Linux/4.14.181-108.257.amzn1.x86_64 OpenJDK_64-Bit_Server_VM/11.0.7+10-LTS java/11.0.7 vendor/Amazon.com_Inc.\",\"userIdentity\":{\"accessKeyId\":\"ASIA11111111111111\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3\",\"principalId\":\"AROA11111111111111:ctstreamer-dev-s3\",\"sessionContext\":{\"attributes\":{\"creationDate\":\"2020-08-12T12:03:12Z\",\"mfaAuthenticated\":\"false\"},\"sessionIssuer\":{\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:role/user\",\"principalId\":\"AROA11111111111111\",\"type\":\"Role\",\"userName\":\"user\"},\"webIdFederationData\":{}},\"type\":\"AssumedRole\"}}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "Decrypt",
        "provider": "kms.amazonaws.com"
    },
    "@timestamp": "2020-08-12T12:48:09.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "1111111111"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "Decrypt",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "accessKeyId": "ASIA11111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3",
                "principalId": "AROA11111111111111:ctstreamer-dev-s3",
                "sessionContext": {
                    "attributes": {
                        "creationDate": "2020-08-12T12:03:12Z",
                        "mfaAuthenticated": "false"
                    },
                    "sessionIssuer": {
                        "accountId": "1111111111",
                        "arn": "arn:aws:iam::1111111111:role/user",
                        "principalId": "AROA11111111111111",
                        "type": "Role",
                        "userName": "user"
                    },
                    "webIdFederationData": {}
                },
                "type": "AssumedRole"
            },
            "resources": [
                {
                    "ARN": "arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c",
                    "accountId": "1111111111",
                    "type": "AWS::KMS::Key"
                }
            ]
        }
    },
    "user_agent": {
        "original": "aws-internal/3 aws-sdk-java/1.11.802 Linux/4.14.181-108.257.amzn1.x86_64 OpenJDK_64-Bit_Server_VM/11.0.7+10-LTS java/11.0.7 vendor/Amazon.com_Inc."
    },
    "user": {
        "id": "1111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "accessKeyId": "ASIA11111111111111",
                "accountId": "1111111111",
                "arn": "arn:aws:sts::1111111111:assumed-role/user/ctstreamer-dev-s3",
                "principalId": "AROA11111111111111:ctstreamer-dev-s3",
                "sessionContext": {
                    "attributes": {
                        "creationDate": "2020-08-12T12:03:12Z",
                        "mfaAuthenticated": "false"
                    },
                    "sessionIssuer": {
                        "accountId": "1111111111",
                        "arn": "arn:aws:iam::1111111111:role/user",
                        "principalId": "AROA11111111111111",
                        "type": "Role",
                        "userName": "user"
                    },
                    "webIdFederationData": {}
                },
                "type": "AssumedRole"
            },
            "resources": [
                {
                    "ARN": "arn:aws:kms:eu-west-3:1111111111:key/14eb3a8a-ffec-4b0e-a6da-e901d5e6ee9c",
                    "accountId": "1111111111",
                    "type": "AWS::KMS::Key"
                }
            ],
            "flattened": {
                "request_parameters": "{\"encryptionAlgorithm\": \"SYMMETRIC_DEFAULT\", \"encryptionContext\": {\"aws:lambda:FunctionArn\": \"arn:aws:lambda:eu-west-3:1111111111:function:ctstreamer-dev-s3\"}}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    }
}
{
    "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"111111111111\",\"arn\":\"arn:aws:iam::111111111111:root\",\"accountId\":\"111111111111\",\"accessKeyId\":\"ASI00000000000000000\",\"sessionContext\":{\"sessionIssuer\":{},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-01T06:46:50Z\",\"mfaAuthenticated\":\"true\"}}},\"eventTime\":\"2022-09-01T14:13:11Z\",\"eventSource\":\"rds.amazonaws.com\",\"eventName\":\"ModifyDBInstance\",\"awsRegion\":\"eu-west-3\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"AWS Internal\",\"requestParameters\":{\"dBInstanceIdentifier\":\"database-1\",\"applyImmediately\":true,\"masterUserPassword\":\"****\",\"allowMajorVersionUpgrade\":false,\"maxAllocatedStorage\":1000},\"responseElements\":{\"dBInstanceIdentifier\":\"database-1\",\"dBInstanceClass\":\"db.m6g.large\",\"engine\":\"postgres\",\"dBInstanceStatus\":\"available\",\"masterUsername\":\"postgres\",\"endpoint\":{\"address\":\"x.rds.amazonaws.com\",\"port\":5432,\"hostedZoneId\":\"ZMESEXB7ZGGQ3\"},\"allocatedStorage\":100,\"instanceCreateTime\":\"Sep 1, 2022 12:47:35 PM\",\"preferredBackupWindow\":\"10:10-10:40\",\"backupRetentionPeriod\":7,\"dBSecurityGroups\":[],\"vpcSecurityGroups\":[{\"vpcSecurityGroupId\":\"sg-00000000000000000\",\"status\":\"active\"}],\"dBParameterGroups\":[{\"dBParameterGroupName\":\"default.postgres13\",\"parameterApplyStatus\":\"in-sync\"}],\"availabilityZone\":\"eu-west-3b\",\"dBSubnetGroup\":{\"dBSubnetGroupName\":\"default-vpc-00000000000000000\",\"dBSubnetGroupDescription\":\"Created from the RDS Management Console\",\"vpcId\":\"vpc-00000000000000000\",\"subnetGroupStatus\":\"Complete\",\"subnets\":[{\"subnetIdentifier\":\"subnet-00000000000000000\",\"subnetAvailabilityZone\":{\"name\":\"eu-west-3a\"},\"subnetOutpost\":{},\"subnetStatus\":\"Active\"}]},\"preferredMaintenanceWindow\":\"thu:04:33-thu:05:03\",\"pendingModifiedValues\":{\"masterUserPassword\":\"****\"},\"latestRestorableTime\":\"Sep 1, 2022 2:07:11 PM\",\"multiAZ\":true,\"engineVersion\":\"13.7\",\"autoMinorVersionUpgrade\":true,\"readReplicaDBInstanceIdentifiers\":[],\"licenseModel\":\"postgresql-license\",\"iops\":3000,\"storageThroughput\":0,\"optionGroupMemberships\":[{\"optionGroupName\":\"default:postgres-13\",\"status\":\"in-sync\"}],\"secondaryAvailabilityZone\":\"eu-west-3c\",\"publiclyAccessible\":false,\"storageType\":\"io1\",\"dbInstancePort\":0,\"storageEncrypted\":true,\"kmsKeyId\":\"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\",\"dbiResourceId\":\"db-00000000000000000000000000\",\"cACertificateIdentifier\":\"rds-ca-2019\",\"domainMemberships\":[],\"copyTagsToSnapshot\":true,\"monitoringInterval\":60,\"enhancedMonitoringResourceArn\":\"arn:aws:logs:eu-west-3:111111111111:group:schema:stream:db-00000000000000000000000000\",\"monitoringRoleArn\":\"arn:aws:iam::111111111111:role/role\",\"dBInstanceArn\":\"arn:aws:rds:eu-west-3:111111111111:db:database-1\",\"iAMDatabaseAuthenticationEnabled\":false,\"performanceInsightsEnabled\":true,\"performanceInsightsKMSKeyId\":\"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\",\"performanceInsightsRetentionPeriod\":7,\"deletionProtection\":true,\"associatedRoles\":[],\"httpEndpointEnabled\":false,\"maxAllocatedStorage\":1000,\"tagList\":[],\"customerOwnedIpEnabled\":false,\"networkType\":\"IPV4\",\"backupTarget\":\"region\"},\"requestID\":\"fc070739-07b9-4533-9652-eec872b5ad3d\",\"eventID\":\"eee4217d-4a93-4ad3-89ff-108b25c4c9ab\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"111111111111\",\"eventCategory\":\"Management\",\"sessionCredentialFromConsole\":\"true\"}\n",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "ModifyDBInstance",
        "provider": "rds.amazonaws.com"
    },
    "@timestamp": "2022-09-01T14:13:11.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3",
        "account": {
            "id": "111111111111"
        }
    },
    "action": {
        "type": "AwsApiCall",
        "name": "ModifyDBInstance",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "111111111111",
            "userIdentity": {
                "type": "Root",
                "principalId": "111111111111",
                "arn": "arn:aws:iam::111111111111:root",
                "accountId": "111111111111",
                "accessKeyId": "ASI00000000000000000",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-01T06:46:50Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "responseElements": {
                "publiclyAccessible": false
            }
        }
    },
    "user_agent": {
        "original": "AWS Internal"
    },
    "user": {
        "id": "111111111111"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "111111111111",
            "user_identity": {
                "type": "Root",
                "principalId": "111111111111",
                "arn": "arn:aws:iam::111111111111:root",
                "accountId": "111111111111",
                "accessKeyId": "ASI00000000000000000",
                "sessionContext": {
                    "sessionIssuer": {},
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-01T06:46:50Z",
                        "mfaAuthenticated": "true"
                    }
                }
            },
            "response_elements": {
                "publiclyAccessible": false,
                "pendingModifiedValues": {
                    "masterUserPassword": "****"
                }
            },
            "flattened": {
                "response_elements": "{\"allocatedStorage\": 100, \"associatedRoles\": [], \"autoMinorVersionUpgrade\": true, \"availabilityZone\": \"eu-west-3b\", \"backupRetentionPeriod\": 7, \"backupTarget\": \"region\", \"cACertificateIdentifier\": \"rds-ca-2019\", \"copyTagsToSnapshot\": true, \"customerOwnedIpEnabled\": false, \"dBInstanceArn\": \"arn:aws:rds:eu-west-3:111111111111:db:database-1\", \"dBInstanceClass\": \"db.m6g.large\", \"dBInstanceIdentifier\": \"database-1\", \"dBInstanceStatus\": \"available\", \"dBParameterGroups\": [{\"dBParameterGroupName\": \"default.postgres13\", \"parameterApplyStatus\": \"in-sync\"}], \"dBSecurityGroups\": [], \"dBSubnetGroup\": {\"dBSubnetGroupDescription\": \"Created from the RDS Management Console\", \"dBSubnetGroupName\": \"default-vpc-00000000000000000\", \"subnetGroupStatus\": \"Complete\", \"subnets\": [{\"subnetAvailabilityZone\": {\"name\": \"eu-west-3a\"}, \"subnetIdentifier\": \"subnet-00000000000000000\", \"subnetOutpost\": {}, \"subnetStatus\": \"Active\"}], \"vpcId\": \"vpc-00000000000000000\"}, \"dbInstancePort\": 0, \"dbiResourceId\": \"db-00000000000000000000000000\", \"deletionProtection\": true, \"domainMemberships\": [], \"endpoint\": {\"address\": \"x.rds.amazonaws.com\", \"hostedZoneId\": \"ZMESEXB7ZGGQ3\", \"port\": 5432}, \"engine\": \"postgres\", \"engineVersion\": \"13.7\", \"enhancedMonitoringResourceArn\": \"arn:aws:logs:eu-west-3:111111111111:group:schema:stream:db-00000000000000000000000000\", \"httpEndpointEnabled\": false, \"iAMDatabaseAuthenticationEnabled\": false, \"instanceCreateTime\": \"Sep 1, 2022 12:47:35 PM\", \"iops\": 3000, \"kmsKeyId\": \"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\", \"latestRestorableTime\": \"Sep 1, 2022 2:07:11 PM\", \"licenseModel\": \"postgresql-license\", \"masterUsername\": \"postgres\", \"maxAllocatedStorage\": 1000, \"monitoringInterval\": 60, \"monitoringRoleArn\": \"arn:aws:iam::111111111111:role/role\", \"multiAZ\": true, \"networkType\": \"IPV4\", \"optionGroupMemberships\": [{\"optionGroupName\": \"default:postgres-13\", \"status\": \"in-sync\"}], \"pendingModifiedValues\": {\"masterUserPassword\": \"****\"}, \"performanceInsightsEnabled\": true, \"performanceInsightsKMSKeyId\": \"arn:aws:kms:eu-west-3:111111111111:key/a7dce59f-5b3c-4178-90e1-91103a32b26d\", \"performanceInsightsRetentionPeriod\": 7, \"preferredBackupWindow\": \"10:10-10:40\", \"preferredMaintenanceWindow\": \"thu:04:33-thu:05:03\", \"publiclyAccessible\": false, \"readReplicaDBInstanceIdentifiers\": [], \"secondaryAvailabilityZone\": \"eu-west-3c\", \"storageEncrypted\": true, \"storageThroughput\": 0, \"storageType\": \"io1\", \"tagList\": [], \"vpcSecurityGroups\": [{\"status\": \"active\", \"vpcSecurityGroupId\": \"sg-00000000000000000\"}]}",
                "request_parameters": "{\"allowMajorVersionUpgrade\": false, \"applyImmediately\": true, \"dBInstanceIdentifier\": \"database-1\", \"masterUserPassword\": \"****\", \"maxAllocatedStorage\": 1000}"
            }
        }
    }
}
{
    "message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"bcf6f457-76bc-4e8c-8a7b-8a2451481675\",\"eventName\":\"AssumeRole\",\"eventSource\":\"sts.amazonaws.com\",\"eventTime\":\"2020-08-12T12:03:12Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"34c3d58a-83f5-42cc-9e4d-1beeb85f809c\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::1111111111:role/user\",\"roleSessionName\":\"session-name\"},\"resources\":[{\"ARN\":\"arn:aws:iam::1111111111:role/user\",\"accountId\":\"1111111111\",\"type\":\"AWS::IAM::Role\"}],\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIA11111111111111\",\"expiration\":\"Aug 13, 2020, 12:03:12 AM\",\"sessionToken\":\"11111111111111111111111111111111111111111\"}},\"sharedEventID\":\"e0b224e9-a818-452c-87e3-a1d4078bb102\",\"sourceIPAddress\":\"lambda.amazonaws.com\",\"userAgent\":\"lambda.amazonaws.com\",\"userIdentity\":{\"invokedBy\":\"lambda.amazonaws.com\",\"type\":\"AWSService\"}}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "AssumeRole",
        "provider": "sts.amazonaws.com"
    },
    "@timestamp": "2020-08-12T12:03:12.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3"
    },
    "action": {
        "type": "AwsApiCall",
        "name": "AssumeRole",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "invokedBy": "lambda.amazonaws.com",
                "type": "AWSService"
            },
            "resources": [
                {
                    "ARN": "arn:aws:iam::1111111111:role/user",
                    "accountId": "1111111111",
                    "type": "AWS::IAM::Role"
                }
            ]
        }
    },
    "user_agent": {
        "original": "lambda.amazonaws.com"
    },
    "source": {
        "address": "lambda.amazonaws.com",
        "domain": "lambda.amazonaws.com"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "type": "AWSService"
            },
            "resources": [
                {
                    "ARN": "arn:aws:iam::1111111111:role/user",
                    "accountId": "1111111111",
                    "type": "AWS::IAM::Role"
                }
            ],
            "flattened": {
                "response_elements": "{\"credentials\": {\"accessKeyId\": \"ASIA11111111111111\", \"expiration\": \"Aug 13, 2020, 12:03:12 AM\", \"sessionToken\": \"11111111111111111111111111111111111111111\"}}",
                "request_parameters": "{\"roleArn\": \"arn:aws:iam::1111111111:role/user\", \"roleSessionName\": \"session-name\"}"
            }
        }
    },
    "related": {
        "hosts": [
            "lambda.amazonaws.com"
        ]
    }
}
{
    "message": "{\"additionalEventData\":{\"LoginTo\":\"https://console.aws.amazon.com/billing/home?region=eu-west-3&state=hashArgs%23%2F&isauthcode=true\",\"MFAUsed\":\"No\",\"MobileVersion\":\"No\"},\"awsRegion\":\"us-east-1\",\"eventID\":\"9d4ca355-a7d3-4422-96ae-dbe2c3431609\",\"eventName\":\"ConsoleLogin\",\"eventSource\":\"signin.amazonaws.com\",\"eventTime\":\"2020-08-19T15:33:43Z\",\"eventType\":\"AwsConsoleSignIn\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestParameters\":null,\"responseElements\":{\"ConsoleLogin\":\"Success\"},\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0\",\"userIdentity\":{\"accessKeyId\":\"\",\"accountId\":\"1111111111\",\"arn\":\"arn:aws:iam::1111111111:root\",\"principalId\":\"1111111111\",\"type\":\"Root\"}}",
    "event": {
        "kind": "event",
        "category": [
            "authentication"
        ],
        "type": [
            "allowed"
        ],
        "dataset": "cloudtrail",
        "action": "ConsoleLogin",
        "provider": "signin.amazonaws.com"
    },
    "@timestamp": "2020-08-19T15:33:43.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "us-east-1",
        "account": {
            "id": "1111111111"
        }
    },
    "action": {
        "type": "AwsConsoleSignIn",
        "name": "ConsoleLogin",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "accessKeyId": "",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "type": "Root"
            }
        }
    },
    "user_agent": {
        "original": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0"
    },
    "user": {
        "id": "1111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "accessKeyId": "",
                "accountId": "1111111111",
                "arn": "arn:aws:iam::1111111111:root",
                "principalId": "1111111111",
                "type": "Root"
            },
            "flattened": {
                "response_elements": "{\"ConsoleLogin\": \"Success\"}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    }
}
{
    "message": "{\"awsRegion\":\"eu-west-3\",\"eventID\":\"bcf6f457-76bc-4e8c-8a7b-8a2451481675\",\"eventName\":\"AssumeRole\",\"eventSource\":\"sts.amazonaws.com\",\"eventTime\":\"2020-08-12T12:03:12Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.05\",\"recipientAccountId\":\"1111111111\",\"requestID\":\"34c3d58a-83f5-42cc-9e4d-1beeb85f809c\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::1111111111:role/user\",\"roleSessionName\":\"session-name\"},\"resources\":[{\"ARN\":\"arn:aws:iam::1111111111:role/user\",\"accountId\":\"1111111111\",\"type\":\"AWS::IAM::Role\"}],\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIA11111111111111\",\"expiration\":\"Aug 13, 2020, 12:03:12 AM\",\"sessionToken\":\"1111111111111111111111111111111111111111111111111111111111111111111111111\"}},\"sharedEventID\":\"e0b224e9-a818-452c-87e3-a1d4078bb102\",\"sourceIPAddress\":\"lambda.amazonaws.com\",\"userAgent\":\"lambda.amazonaws.com\",\"userIdentity\":{\"invokedBy\":\"lambda.amazonaws.com\",\"type\":\"AWSService\"}}",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "AssumeRole",
        "provider": "sts.amazonaws.com"
    },
    "@timestamp": "2020-08-12T12:03:12.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3"
    },
    "action": {
        "type": "AwsApiCall",
        "name": "AssumeRole",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "invokedBy": "lambda.amazonaws.com",
                "type": "AWSService"
            },
            "resources": [
                {
                    "ARN": "arn:aws:iam::1111111111:role/user",
                    "accountId": "1111111111",
                    "type": "AWS::IAM::Role"
                }
            ]
        }
    },
    "user_agent": {
        "original": "lambda.amazonaws.com"
    },
    "source": {
        "address": "lambda.amazonaws.com",
        "domain": "lambda.amazonaws.com"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.05",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "type": "AWSService"
            },
            "resources": [
                {
                    "ARN": "arn:aws:iam::1111111111:role/user",
                    "accountId": "1111111111",
                    "type": "AWS::IAM::Role"
                }
            ],
            "flattened": {
                "response_elements": "{\"credentials\": {\"accessKeyId\": \"ASIA11111111111111\", \"expiration\": \"Aug 13, 2020, 12:03:12 AM\", \"sessionToken\": \"1111111111111111111111111111111111111111111111111111111111111111111111111\"}}",
                "request_parameters": "{\"roleArn\": \"arn:aws:iam::1111111111:role/user\", \"roleSessionName\": \"session-name\"}"
            }
        }
    },
    "related": {
        "hosts": [
            "lambda.amazonaws.com"
        ]
    }
}
{
    "message": "{\"eventVersion\":\"1.08\",\"eventTime\":\"2022-09-05T07:45:00Z\",\"awsRegion\":\"eu-west-3\",\"eventID\":\"7a9130fc-ca15-49d9-b4aa-685f7a0c182a\",\"eventType\":\"AwsCloudTrailInsight\",\"recipientAccountId\":\"1111111111\",\"sharedEventID\":\"0a771801-c0cc-406d-a080-219de884f089\",\"insightDetails\":{\"state\":\"End\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"GetBucketPolicy\",\"insightType\":\"ApiErrorRateInsight\",\"errorCode\":\"NoSuchBucketPolicy\",\"insightContext\":{\"statistics\":{\"baseline\":{\"average\":0.0021817492},\"insight\":{\"average\":1.3333333333},\"insightDuration\":3,\"baselineDuration\":10542},\"attributions\":[{\"attribute\":\"userIdentityArn\",\"insight\":[{\"value\":\"arn:aws:iam::1111111111:root\",\"average\":1.3333333333}],\"baseline\":[{\"value\":\"arn:aws:iam::1111111111:root\",\"average\":0.0020868905},{\"value\":\"arn:aws:sts::1111111111:assumed-role/AWSServiceRoleForConfig/AWSConfig-Describe\",\"average\":9.48587e-05}]},{\"attribute\":\"userAgent\",\"insight\":[{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.6666666667},{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.6666666667}],\"baseline\":[{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.0010434453},{\"value\":\"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\",\"average\":0.0009485866},{\"value\":\"AWS Internal\",\"average\":0.0001897173}]}]}},\"eventCategory\":\"Insight\"}\n",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "GetBucketPolicy",
        "code": "NoSuchBucketPolicy",
        "provider": "s3.amazonaws.com"
    },
    "@timestamp": "2022-09-05T07:45:00.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-west-3"
    },
    "action": {
        "type": "AwsCloudTrailInsight",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111"
        }
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "1111111111",
            "insight_details": {
                "state": "End",
                "type": "ApiErrorRateInsight",
                "context": "{\"attributions\": [{\"attribute\": \"userIdentityArn\", \"baseline\": [{\"average\": 0.0020868905, \"value\": \"arn:aws:iam::1111111111:root\"}, {\"average\": 9.48587e-05, \"value\": \"arn:aws:sts::1111111111:assumed-role/AWSServiceRoleForConfig/AWSConfig-Describe\"}], \"insight\": [{\"average\": 1.3333333333, \"value\": \"arn:aws:iam::1111111111:root\"}]}, {\"attribute\": \"userAgent\", \"baseline\": [{\"average\": 0.0010434453, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.0009485866, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.0001897173, \"value\": \"AWS Internal\"}], \"insight\": [{\"average\": 0.6666666667, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.204-124.362.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}, {\"average\": 0.6666666667, \"value\": \"[S3Console/0.4, aws-internal/3 aws-sdk-java/1.11.1030 Linux/5.4.207-126.363.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.302-b08 java/1.8.0_302 vendor/Oracle_Corporation cfg/retry-mode/standard]\"}]}], \"statistics\": {\"baseline\": {\"average\": 0.0021817492}, \"baselineDuration\": 10542, \"insight\": {\"average\": 1.3333333333}, \"insightDuration\": 3}}"
            }
        }
    }
}
{
    "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AR0000000000000000:1111111111111111111111111\",\"arn\":\"arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111\",\"accountId\":\"1111111111\",\"accessKeyId\":\"AS000000000000000000\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AR0000000000000000\",\"arn\":\"arn:aws:iam::1111111111:role/service-role/username\",\"accountId\":\"1111111111\",\"userName\":\"username\"},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2022-09-09T07:45:14Z\",\"mfaAuthenticated\":\"false\"}}},\"eventTime\":\"2022-09-09T09:17:32Z\",\"eventSource\":\"elasticfilesystem.amazonaws.com\",\"eventName\":\"NewClientConnection\",\"awsRegion\":\"eu-central-1\",\"sourceIPAddress\":\"AWS Internal\",\"userAgent\":\"elasticfilesystem\",\"requestParameters\":null,\"responseElements\":null,\"eventID\":\"6ff7e265-b0b9-42c0-b4b5-ad140a7f1baa\",\"readOnly\":true,\"resources\":[{\"accountId\":\"1111111111\",\"type\":\"AWS::EFS::FileSystem\",\"ARN\":\"arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000\"},{\"accountId\":\"1111111111\",\"type\":\"AWS::EFS::AccessPoint\",\"ARN\":\"arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000\"}],\"eventType\":\"AwsServiceEvent\",\"managementEvent\":true,\"recipientAccountId\":\"1111111111\",\"serviceEventDetails\":{\"permissions\":{\"ClientRootAccess\":false,\"ClientMount\":true,\"ClientWrite\":true},\"sourceIpAddress\":\"1.2.3.4\"},\"eventCategory\":\"Management\"}\n",
    "event": {
        "kind": "event",
        "category": [
            "network"
        ],
        "type": [
            "access"
        ],
        "dataset": "cloudtrail",
        "action": "NewClientConnection",
        "provider": "elasticfilesystem.amazonaws.com"
    },
    "@timestamp": "2022-09-09T09:17:32.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "eu-central-1",
        "account": {
            "id": "1111111111"
        }
    },
    "action": {
        "type": "AwsServiceEvent",
        "name": "NewClientConnection",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "1111111111",
            "userIdentity": {
                "type": "AssumedRole",
                "principalId": "AR0000000000000000:1111111111111111111111111",
                "arn": "arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111",
                "accountId": "1111111111",
                "accessKeyId": "AS000000000000000000",
                "sessionContext": {
                    "sessionIssuer": {
                        "type": "Role",
                        "principalId": "AR0000000000000000",
                        "arn": "arn:aws:iam::1111111111:role/service-role/username",
                        "accountId": "1111111111",
                        "userName": "username"
                    },
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-09T07:45:14Z",
                        "mfaAuthenticated": "false"
                    }
                }
            },
            "resources": [
                {
                    "accountId": "1111111111",
                    "type": "AWS::EFS::FileSystem",
                    "ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000"
                },
                {
                    "accountId": "1111111111",
                    "type": "AWS::EFS::AccessPoint",
                    "ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000"
                }
            ]
        }
    },
    "user_agent": {
        "original": "elasticfilesystem"
    },
    "user": {
        "id": "1111111111"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "1111111111",
            "user_identity": {
                "type": "AssumedRole",
                "principalId": "AR0000000000000000:1111111111111111111111111",
                "arn": "arn:aws:sts::1111111111:assumed-role/role/1111111111111111111111111",
                "accountId": "1111111111",
                "accessKeyId": "AS000000000000000000",
                "sessionContext": {
                    "sessionIssuer": {
                        "type": "Role",
                        "principalId": "AR0000000000000000",
                        "arn": "arn:aws:iam::1111111111:role/service-role/username",
                        "accountId": "1111111111",
                        "userName": "username"
                    },
                    "webIdFederationData": {},
                    "attributes": {
                        "creationDate": "2022-09-09T07:45:14Z",
                        "mfaAuthenticated": "false"
                    }
                }
            },
            "resources": [
                {
                    "accountId": "1111111111",
                    "type": "AWS::EFS::FileSystem",
                    "ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:file-system/fs-00000000"
                },
                {
                    "accountId": "1111111111",
                    "type": "AWS::EFS::AccessPoint",
                    "ARN": "arn:aws:elasticfilesystem:eu-central-1:1111111111:access-point/fsap-00000000000000000"
                }
            ]
        }
    }
}
{
    "message": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"A00000000000000000000:user@example.org\",\"arn\":\"arn:aws:sts::111111111:assumed-role/role/user@example.org\",\"accountId\":\"111111111\"},\"eventTime\":\"2022-09-08T15:01:59Z\",\"eventSource\":\"signin.amazonaws.com\",\"eventName\":\"ConsoleLogin\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"1.2.3.4\",\"userAgent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36\",\"requestParameters\":null,\"responseElements\":{\"ConsoleLogin\":\"Success\"},\"additionalEventData\":{\"LoginTo\":\"https://console.aws.amazon.com/console/home\",\"MobileVersion\":\"No\",\"MFAUsed\":\"No\",\"SamlProviderArn\":\"arn:aws:iam::111111111:saml-provider/provider-name\"},\"eventID\":\"e7dd6d97-2d3a-45dc-bb19-a3ea347091e3\",\"readOnly\":false,\"eventType\":\"AwsConsoleSignIn\",\"managementEvent\":true,\"recipientAccountId\":\"111111111\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.2\",\"cipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"clientProvidedHostHeader\":\"signin.aws.amazon.com\"}}\n",
    "event": {
        "kind": "event",
        "category": [
            "authentication"
        ],
        "type": [
            "allowed"
        ],
        "dataset": "cloudtrail",
        "action": "ConsoleLogin",
        "provider": "signin.amazonaws.com"
    },
    "@timestamp": "2022-09-08T15:01:59.000000Z",
    "cloud": {
        "provider": "aws",
        "service": {
            "name": "cloudtrail"
        },
        "region": "us-east-1",
        "account": {
            "id": "111111111"
        }
    },
    "action": {
        "type": "AwsConsoleSignIn",
        "name": "ConsoleLogin",
        "outcome": "success",
        "target": "network-traffic",
        "properties": {
            "recipientAccountId": "111111111",
            "userIdentity": {
                "type": "AssumedRole",
                "principalId": "A00000000000000000000:user@example.org",
                "arn": "arn:aws:sts::111111111:assumed-role/role/user@example.org",
                "accountId": "111111111"
            }
        }
    },
    "user_agent": {
        "original": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
    },
    "user": {
        "id": "111111111"
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "tls": {
        "cipher": "ECDHE-RSA-AES128-GCM-SHA256",
        "version": "TLSv1.2"
    },
    "aws": {
        "cloudtrail": {
            "event_version": "1.08",
            "recipient_account_id": "111111111",
            "user_identity": {
                "type": "AssumedRole",
                "principalId": "A00000000000000000000:user@example.org",
                "arn": "arn:aws:sts::111111111:assumed-role/role/user@example.org",
                "accountId": "111111111"
            },
            "flattened": {
                "response_elements": "{\"ConsoleLogin\": \"Success\"}"
            }
        }
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
action.properties.errorCode keyword The code of the error associated to the request
action.properties.errorMessage keyword The message of the error associated to the request
action.properties.recipientAccountId keyword The account ID that received the event
action.properties.requestParameters.userData keyword The userData parameters sent with the request
action.properties.resources list A list of resources accessed in the event
action.properties.responseElements.pendingModifiedValues.masterUserPassword keyword The new master password for the RDS instance
action.properties.responseElements.publiclyAccessible boolean Whether the requested ressource was public
action.properties.userIdentity object Information about the user that made the request
action.target keyword The target of the action
aws.cloudtrail.event_version keyword The version of the event
aws.cloudtrail.flattened.request_parameters keyword The flattened version of the field requestParameters
aws.cloudtrail.flattened.response_elements keyword The flattened version of the field responseElements
aws.cloudtrail.insight_details.context keyword The context of the insight
aws.cloudtrail.insight_details.state keyword The status of the insight
aws.cloudtrail.insight_details.type keyword The type of the insight
aws.cloudtrail.recipient_account_id keyword The account ID that received the event
aws.cloudtrail.request_parameters.userData keyword The userData parameters sent with the request
aws.cloudtrail.request_parameters.userName keyword The name of the user sent in the request
aws.cloudtrail.resources list A list of resources accessed in the event
aws.cloudtrail.response_elements.pendingModifiedValues.masterUserPassword keyword The new master password for the RDS instance
aws.cloudtrail.response_elements.publiclyAccessible boolean Whether the requested ressource was public
aws.cloudtrail.response_elements.user.arn keyword The arn of the user in the response
aws.cloudtrail.response_elements.user.userName keyword The name of the user in the response
cloud.account.id keyword The cloud account or organization id.
cloud.instance.id keyword Instance ID of the host machine.
cloud.provider keyword Name of the cloud provider.
cloud.region keyword Region in which this host, resource, or service is located.
cloud.service.name keyword The cloud service name.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.provider keyword Source of the event.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
source.address keyword Source network address.
source.domain keyword The domain name of the source.
source.ip ip IP address of the source.
tls.cipher keyword String indicating the cipher used during the current connection.
tls.version keyword Numeric part of the version parsed from the original string.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user_agent.original keyword Unparsed user_agent string.

Configure

CloudTrail trail

As a prerequisite you need an existing CloudTrail trail and configure it to record activities from services that you want to monitor.

In the AWS console, navigate to: Services > CloudTrail > Trails. From there, enable the events that you want to record:

  • Management events: provide visibility into management operations that are performed on resources in your AWS account.
  • Insights events: help AWS users identify and respond to unusual activity associated with write API calls by continuously analyzing CloudTrail management events. Insights events are logged when CloudTrail detects unusual write management API activity in your account.
  • Data events: provide visibility into the resource operations performed on or within a resource.

Activate the logging on the trail through the switch button (On/Off) located on the top right hand corner of the trail page.

Create a SQS queue

This integration relies on S3 Event Notifications to discover new S3 objects.

To be enable to set the S3 Event Notification, create a queue in the SQS service according this guide.

In the Access Policy step choose the advanced configuration and adapt this configuration sample with your own SQS arn (the main change is the Service directive allowing S3 bucket access):

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__owner_statement",
      "Effect": "Allow",
      "Principal": {
        "Service": "s3.amazonaws.com"
      },
      "Action": "SQS:*",
      "Resource": "arn:aws:sqs:XXX:XXX"
    }
  ]
}

Please, keep in mind, to create the SQS queue in the same region as the S3 bucket you want to watch.

Create a S3 Event Notification

Use the following guide to create S3 Event Notification. Select the notification for object create in the Event type section. As the destination, choose the SQS service and select the queue you create in the previous section.

Create the intake

Go to the intake page and create a new intake from the format AWS CloudTrail.

Pull events

Go to the playbook page and create a new playbook with the Fetch new CloudTrail records on S3 connector.

Set up the module configuration with the AWS Access Key, the secret key and the region name. Set up the trigger configuration with the name of the SQS queue and the intake key, from the intake previously created.

Important

In the "Trigger Configuration" settings of your Cloudtrail playbook, we recommand the following configuration by default: chunk_size = 10000, frequency = 10 and tick the box "delete_consumed_messages" that will delete S3 notifications of your Amazon Simple Queue Service, avoiding duplicates.

Start the playbook and enjoy your events.

Further Readings