diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index c277b5f408b..79de3169a25 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,4 +1,28 @@ # newer versions go on top +- version: "6.22.0" + changes: + - description: | + The changes below apply to the CloudTrail data stream only. + Replace every `ignore_failure: true` with an `ignore_missing` flag, a condition guard, or an explicit `on_failure` handler reporting to `error.message`, so real faults surface instead of being silently swallowed. + Add support for CloudTrail fields that were previously dropped. + Populate the `cloud.provider`, `cloud.service.name` and `related.*` ECS fields. + type: enhancement + link: https://github.com/elastic/integrations/pull/20972 + - description: | + The change below applies to the CloudTrail data stream only. + Stop storing the assumed-role ARN session name in `user.changes.*`. The session name is now added to `related.user` for cross-source correlation; when it is an email, both the full email and the local-part prefix are added. `user.name` continues to hold the IAM role name for detection rules. + type: enhancement + link: https://github.com/elastic/integrations/pull/20972 + - description: | + The fixes below apply to the CloudTrail data stream only. + Stop populating `file.hash.sha256` on digest records, where it held the hash of the previous digest file while `file.path` pointed at the current one. The value is still available as `aws.cloudtrail.digest.previous_hash_value` and in `related.hash`. + Fix `DeleteObject` using `event.type: delete`, which is not a valid ECS value. It is now `deletion`. + Fix `Publish`, `SendCommand` and `Converse` producing no `event.type`. They now use `info`, `start` and `info` respectively. + Fix `retain: none` behaving like `retain: all`. It now drops both the keyword and the flattened copies as documented. + Fix `retain: keyword` and `retain: minimal` discarding digest and Insights records. The setting governs API call payloads and no longer affects either record type. + Fix `aws.cloudtrail.service_event_details` surviving `retain: flattened` and `retain: none`. It is now governed like the other payload fields. + type: bugfix + link: https://github.com/elastic/integrations/pull/20972 - version: "6.21.0" changes: - description: Poll Amazon Inspector findings on `updatedAt` instead of `lastObservedAt` so that findings AWS marks CLOSED or SUPPRESSED are collected and no longer remain stale in Elastic. diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log-expected.json index f6813fa1466..26ce88f14e8 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log-expected.json @@ -41,7 +41,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "lambda" + } }, "ecs": { "version": "8.11.0" @@ -72,6 +76,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "cloudtrail-events-test" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json index 882e2a476a8..fe8393e5766 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -64,6 +68,9 @@ "EXAMPLE_KEY_ID", "Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EX_PRINCIPAL_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log new file mode 100644 index 00000000000..279105fc782 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log @@ -0,0 +1 @@ +{"eventVersion":"1.05","userIdentity":{"type":"AssumedRole","principalId":"AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com","arn":"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com","accountId":"111111111111","accessKeyId":"AKIAI44QH8DHBEXAMPLE","sessionContext":{"attributes":{"mfaAuthenticated":"false","creationDate":"2019-10-02T21:50:54Z"},"sessionIssuer":{"type":"Role","principalId":"AROAIN5ATK5U7KEXAMPLE","arn":"arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b","accountId":"111111111111","userName":"AWSReservedSSO_SecurityAudit_8df5ccd37b"}}},"eventTime":"2019-10-02T22:12:29Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"81.2.69.144","userAgent":"aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239","requestParameters":{"roleArn":"arn:aws:iam::111111111111:role/JohnRole2","roleSessionName":"firstname.lastname@example.com","durationSeconds":3600},"responseElements":{"credentials":{"accessKeyId":"ASIAWHOJDLGPOEXAMPLE","expiration":"Oct 2, 2019 11:12:29 PM","sessionToken":"EXAMPLETOKEN"},"assumedRoleUser":{"assumedRoleId":"AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com","arn":"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com"}},"requestID":"b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE","eventID":"2a17948f-3042-46ec-98e2-62865EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"111111111111"} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json new file mode 100644 index 00000000000..2baaa48b741 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json @@ -0,0 +1,161 @@ +{ + "expected": [ + { + "@timestamp": "2019-10-02T22:12:29.000Z", + "actor": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + } + }, + "aws": { + "cloudtrail": { + "event_type": "AwsApiCall", + "event_version": "1.05", + "flattened": { + "request_parameters": { + "durationSeconds": 3600, + "roleArn": "arn:aws:iam::111111111111:role/JohnRole2", + "roleSessionName": "firstname.lastname@example.com" + }, + "response_elements": { + "assumedRoleUser": { + "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "assumedRoleId": "AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com" + }, + "credentials": { + "accessKeyId": "ASIAWHOJDLGPOEXAMPLE", + "expiration": "Oct 2, 2019 11:12:29 PM", + "sessionToken": "EXAMPLETOKEN" + } + } + }, + "recipient_account_id": "111111111111", + "request_id": "b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE", + "request_parameters": "{durationSeconds=3600, roleArn=arn:aws:iam::111111111111:role/JohnRole2, roleSessionName=firstname.lastname@example.com}", + "response_elements": "{assumedRoleUser={assumedRoleId=AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com, arn=arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com}, credentials={accessKeyId=ASIAWHOJDLGPOEXAMPLE, sessionToken=EXAMPLETOKEN, expiration=Oct 2, 2019 11:12:29 PM}}", + "user_identity": { + "access_key_id": "AKIAI44QH8DHBEXAMPLE", + "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "session_context": { + "creation_date": "2019-10-02T21:50:54.000Z", + "mfa_authenticated": "false", + "session_issuer": { + "account_id": "111111111111", + "arn": "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b", + "principal_id": "AROAIN5ATK5U7KEXAMPLE", + "type": "Role" + } + }, + "type": "AssumedRole" + } + } + }, + "cloud": { + "account": { + "id": "111111111111" + }, + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "sts" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "AssumeRole", + "category": [ + "authentication" + ], + "created": "2021-11-11T01:02:03.123456789Z", + "id": "2a17948f-3042-46ec-98e2-62865EXAMPLE", + "kind": "event", + "original": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com\",\"arn\":\"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com\",\"accountId\":\"111111111111\",\"accessKeyId\":\"AKIAI44QH8DHBEXAMPLE\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2019-10-02T21:50:54Z\"},\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROAIN5ATK5U7KEXAMPLE\",\"arn\":\"arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b\",\"accountId\":\"111111111111\",\"userName\":\"AWSReservedSSO_SecurityAudit_8df5ccd37b\"}}},\"eventTime\":\"2019-10-02T22:12:29Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"us-east-2\",\"sourceIPAddress\":\"81.2.69.144\",\"userAgent\":\"aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::111111111111:role/JohnRole2\",\"roleSessionName\":\"firstname.lastname@example.com\",\"durationSeconds\":3600},\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIAWHOJDLGPOEXAMPLE\",\"expiration\":\"Oct 2, 2019 11:12:29 PM\",\"sessionToken\":\"EXAMPLETOKEN\"},\"assumedRoleUser\":{\"assumedRoleId\":\"AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com\",\"arn\":\"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com\"}},\"requestID\":\"b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE\",\"eventID\":\"2a17948f-3042-46ec-98e2-62865EXAMPLE\",\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"111111111111\"}", + "outcome": "success", + "provider": "sts.amazonaws.com", + "type": [ + "info" + ] + }, + "related": { + "entity": [ + "firstname.lastname@example.com", + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b", + "AKIAI44QH8DHBEXAMPLE", + "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "AWSReservedSSO_SecurityAudit_8df5ccd37b", + "arn:aws:iam::111111111111:role/JohnRole2" + ], + "ip": [ + "81.2.69.144" + ], + "user": [ + "firstname.lastname@example.com", + "firstname.lastname", + "AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com", + "AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event", + "actor_target_mapping" + ], + "target": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/JohnRole2" + ] + } + }, + "user": { + "email": "firstname.lastname@example.com", + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + }, + "id": "AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com", + "name": "AWSReservedSSO_SecurityAudit_8df5ccd37b", + "target": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/JohnRole2" + ] + } + } + }, + "user_agent": { + "device": { + "name": "Spider" + }, + "name": "aws-cli", + "original": "aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239", + "os": { + "full": "Linux 4.9.184", + "name": "Linux", + "version": "4.9.184" + }, + "version": "1.16.248" + } + } + ] +} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json index 5cae84e7a61..5ab85d00687 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json @@ -80,7 +80,11 @@ "account": { "id": "111111111111" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "sts" + } }, "ecs": { "version": "8.11.0" @@ -111,10 +115,13 @@ "arn:aws:iam::111111111111:role/JohnRole1", "arn:aws:iam::111111111111:role/JohnRole2" ], + "ip": [ + "81.2.69.144" + ], "user": [ + "JohnRole1", "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe", - "JohnRole1" + "JohnDoe" ] }, "source": { @@ -145,9 +152,6 @@ } }, "user": { - "changes": { - "name": "JohnRole1" - }, "entity": { "id": [ "arn:aws:iam::111111111111:role/JohnRole1" @@ -262,7 +266,11 @@ "account": { "id": "111111111111" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "sts" + } }, "ecs": { "version": "8.11.0" @@ -292,10 +300,16 @@ "arn:aws:iam::111111111111:role/JohnRole1", "arn:aws:iam::111111111111:role/JohnRole2" ], + "hosts": [ + "i-1234567890abcdef0" + ], + "ip": [ + "81.2.69.144" + ], "user": [ + "JohnRole1", "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe", - "JohnRole1" + "JohnDoe" ] }, "source": { @@ -326,9 +340,6 @@ } }, "user": { - "changes": { - "name": "JohnRole1" - }, "entity": { "id": [ "arn:aws:iam::111111111111:role/JohnRole1" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-group-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-group-policy-json.log-expected.json index bb2d513d268..75d83093058 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-group-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-group-policy-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -74,6 +78,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -138,6 +145,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-role-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-role-policy-json.log-expected.json index 0d1fd3b8227..2afa4b1b982 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-role-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-role-policy-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "cloudtrail-role" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json index 51980a6ba56..bd3098c9457 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json @@ -29,6 +29,7 @@ "arn": "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f", "session_context": { "creation_date": "2024-10-30T19:14:35.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "000000000", @@ -45,7 +46,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -82,11 +87,14 @@ "arn:aws:iam::aws:policy/AdministratorAccess", "arn:aws:iam::000000000:role/ec2-instance-role" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-06815aa7cf7d21f8f", "pwncloud-backdoor-user", "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role", - "i-06815aa7cf7d21f8f" + "ec2-instance-role" ] }, "service": { @@ -138,9 +146,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-06815aa7cf7d21f8f" - }, "entity": { "id": [ "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-role-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-role-json.log-expected.json index 71f4d16503e..4e4fe1c27a9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-role-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-role-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -71,6 +75,9 @@ "ACCESSKEYID", "test-cloudtrail" ], + "ip": [ + "216.160.83.56" + ], "user": [ "test-cloudtrail", "PRINCIPALID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json index 7173242de46..d8d00735106 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json @@ -64,6 +64,7 @@ "arn": "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f", "session_context": { "creation_date": "2024-10-30T19:14:35.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "000000000", @@ -80,7 +81,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -106,10 +111,13 @@ "arn:aws:iam::000000000:role/ec2-instance-role", "sg-038ccc3a1f7b05f42" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-06815aa7cf7d21f8f", "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role", - "i-06815aa7cf7d21f8f" + "ec2-instance-role" ] }, "service": { @@ -162,9 +170,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-06815aa7cf7d21f8f" - }, "entity": { "id": [ "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-ingress-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-ingress-json.log-expected.json index 99256dc278a..148477fd662 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-ingress-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-ingress-json.log-expected.json @@ -70,7 +70,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -98,6 +102,9 @@ "sg-0f63fecfa17ef4fee", "sgr-027eb7c59241731e0" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-batch-get-secret-value-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-batch-get-secret-value-json.log-expected.json index d68786c0f57..d58fd271448 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-batch-get-secret-value-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-batch-get-secret-value-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "secretsmanager" + } }, "ecs": { "version": "8.11.0" @@ -62,6 +66,9 @@ "arn:aws:secretsmanager:us-east-1:000000000:secret:DdApiKeySecret-aUFEgO4SmSGN-xqgqXR", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json index 032911dfe64..869903fb998 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json @@ -28,7 +28,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -55,6 +59,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -112,7 +119,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -139,6 +150,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log new file mode 100644 index 00000000000..d5a68415c11 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log @@ -0,0 +1 @@ +{"awsAccountId":"123456789123","digestStartTime":"2020-09-11T18:36:49Z","digestEndTime":"2020-09-11T19:36:49Z","digestS3Bucket":"alice-bucket","digestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz","digestPublicKeyFingerprint":"47aaa19f7eec22e9bd0b5e58cfade8cb","digestSignatureAlgorithm":"SHA256withRSA","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T18:32:04Z","previousDigestS3Bucket":"alice-bucket","previousDigestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz","previousDigestHashValue":"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860","previousDigestHashAlgorithm":"SHA-256","previousDigestSignature":"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987","logFiles":[{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz","hashValue":"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T19:26:24Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz","hashValue":"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:11:18Z","oldestEventTime":"2020-09-11T19:11:18Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz","hashValue":"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:32:04Z","oldestEventTime":"2020-09-11T18:32:04Z"}]} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-config.yml b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-config.yml new file mode 100644 index 00000000000..ea62b82d20c --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-config.yml @@ -0,0 +1,13 @@ +dynamic_fields: + # This can be removed after ES 8.16.2 is set as the minimum version supported in the manifest. + # Once removed, it requires to update pipeline tests to remove the trailing dot where required. + # Relates: https://github.com/elastic/elasticsearch/pull/117213 + "user_agent.version": '^\d+\.\d+(\.|\..*)?$' +fields: + # Simulate @timestamp value from Filebeat. + '@timestamp': '2021-11-11T01:02:03.123456789Z' + tags: + - preserve_original_event + - actor_target_mapping + _conf: + retain: keyword diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-expected.json new file mode 100644 index 00000000000..55d94ab2943 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json-keyword.log-expected.json @@ -0,0 +1,83 @@ +{ + "expected": [ + { + "@timestamp": "2020-09-11T19:36:49.000Z", + "aws": { + "cloudtrail": { + "flattened": { + "digest": { + "end_time": "2020-09-11T19:36:49.000Z", + "log_files": [ + { + "hashAlgorithm": "SHA-256", + "hashValue": "420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c", + "newestEventTime": "2020-09-11T19:26:24Z", + "oldestEventTime": "2020-09-11T19:26:24Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196", + "newestEventTime": "2020-09-11T19:11:18Z", + "oldestEventTime": "2020-09-11T19:11:18Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz" + }, + { + "hashAlgorithm": "SHA-256", + "hashValue": "2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70", + "newestEventTime": "2020-09-11T18:32:04Z", + "oldestEventTime": "2020-09-11T18:32:04Z", + "s3Bucket": "alice-bucket", + "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz" + } + ], + "newest_event_time": "2020-09-11T19:26:24.000Z", + "oldest_event_time": "2020-09-11T18:32:04.000Z", + "previous_hash_algorithm": "SHA-256", + "previous_hash_value": "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860", + "previous_s3_bucket": "alice-bucket", + "previous_s3_object": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz", + "previous_signature": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987", + "public_key_fingerprint": "47aaa19f7eec22e9bd0b5e58cfade8cb", + "s3_bucket": "alice-bucket", + "signature_algorithm": "SHA256withRSA", + "start_time": "2020-09-11T18:36:49.000Z" + } + } + } + }, + "cloud": { + "account": { + "id": "123456789123" + }, + "provider": "aws" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "created": "2021-11-11T01:02:03.123456789Z", + "kind": "event", + "original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"}]}", + "outcome": "success", + "type": [ + "info" + ] + }, + "file": { + "path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz" + }, + "related": { + "hash": [ + "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860" + ] + }, + "tags": [ + "preserve_original_event", + "actor_target_mapping" + ] + } + ] +} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log index f3393babceb..d5a68415c11 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log @@ -1 +1 @@ -{"awsAccountId":"123456789123","digestStartTime":"2020-09-11T18:36:49Z","digestEndTime":"2020-09-11T19:36:49Z","digestS3Bucket":"alice-bucket","digestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz","digestPublicKeyFingerprint":"47aaa19f7eec22e9bd0b5e58cfade8cb","digestSignatureAlgorithm":"SHA256withRSA","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T18:32:04Z","previousDigestS3Bucket":"alice-bucket","previousDigestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz","previousDigestHashValue":"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860","previousDigestHashAlgorithm":"SHA-256","previousDigestSignature":"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987","logFiles":[{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz","hashValue":"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T19:26:24Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz","hashValue":"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:11:18Z","oldestEventTime":"2020-09-11T19:11:18Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz","hashValue":"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:32:04Z","oldestEventTime":"2020-09-11T18:32:04Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz","hashValue":"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:21:28Z","oldestEventTime":"2020-09-11T19:21:28Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz","hashValue":"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:51:21Z","oldestEventTime":"2020-09-11T18:51:21Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz","hashValue":"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:46:45Z","oldestEventTime":"2020-09-11T18:46:45Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz","hashValue":"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:01:06Z","oldestEventTime":"2020-09-11T19:01:06Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz","hashValue":"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:16:12Z","oldestEventTime":"2020-09-11T19:16:12Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz","hashValue":"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:56:05Z","oldestEventTime":"2020-09-11T18:56:05Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz","hashValue":"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:06:31Z","oldestEventTime":"2020-09-11T19:06:31Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz","hashValue":"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:41:58Z","oldestEventTime":"2020-09-11T18:41:58Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz","hashValue":"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:37:10Z","oldestEventTime":"2020-09-11T18:37:10Z"}]} +{"awsAccountId":"123456789123","digestStartTime":"2020-09-11T18:36:49Z","digestEndTime":"2020-09-11T19:36:49Z","digestS3Bucket":"alice-bucket","digestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz","digestPublicKeyFingerprint":"47aaa19f7eec22e9bd0b5e58cfade8cb","digestSignatureAlgorithm":"SHA256withRSA","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T18:32:04Z","previousDigestS3Bucket":"alice-bucket","previousDigestS3Object":"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz","previousDigestHashValue":"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860","previousDigestHashAlgorithm":"SHA-256","previousDigestSignature":"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987","logFiles":[{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz","hashValue":"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:26:24Z","oldestEventTime":"2020-09-11T19:26:24Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz","hashValue":"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T19:11:18Z","oldestEventTime":"2020-09-11T19:11:18Z"},{"s3Bucket":"alice-bucket","s3Object":"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz","hashValue":"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70","hashAlgorithm":"SHA-256","newestEventTime":"2020-09-11T18:32:04Z","oldestEventTime":"2020-09-11T18:32:04Z"}]} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json index da3a894ef56..55d94ab2943 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-cloudtrail-digest-json.log-expected.json @@ -31,84 +31,16 @@ "oldestEventTime": "2020-09-11T18:32:04Z", "s3Bucket": "alice-bucket", "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689", - "newestEventTime": "2020-09-11T19:21:28Z", - "oldestEventTime": "2020-09-11T19:21:28Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097", - "newestEventTime": "2020-09-11T18:51:21Z", - "oldestEventTime": "2020-09-11T18:51:21Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b", - "newestEventTime": "2020-09-11T18:46:45Z", - "oldestEventTime": "2020-09-11T18:46:45Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5", - "newestEventTime": "2020-09-11T19:01:06Z", - "oldestEventTime": "2020-09-11T19:01:06Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7", - "newestEventTime": "2020-09-11T19:16:12Z", - "oldestEventTime": "2020-09-11T19:16:12Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba", - "newestEventTime": "2020-09-11T18:56:05Z", - "oldestEventTime": "2020-09-11T18:56:05Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7", - "newestEventTime": "2020-09-11T19:06:31Z", - "oldestEventTime": "2020-09-11T19:06:31Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6", - "newestEventTime": "2020-09-11T18:41:58Z", - "oldestEventTime": "2020-09-11T18:41:58Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz" - }, - { - "hashAlgorithm": "SHA-256", - "hashValue": "9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771", - "newestEventTime": "2020-09-11T18:37:10Z", - "oldestEventTime": "2020-09-11T18:37:10Z", - "s3Bucket": "alice-bucket", - "s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz" } ], "newest_event_time": "2020-09-11T19:26:24.000Z", "oldest_event_time": "2020-09-11T18:32:04.000Z", "previous_hash_algorithm": "SHA-256", + "previous_hash_value": "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860", "previous_s3_bucket": "alice-bucket", + "previous_s3_object": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz", + "previous_signature": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987", + "public_key_fingerprint": "47aaa19f7eec22e9bd0b5e58cfade8cb", "s3_bucket": "alice-bucket", "signature_algorithm": "SHA256withRSA", "start_time": "2020-09-11T18:36:49.000Z" @@ -119,7 +51,8 @@ "cloud": { "account": { "id": "123456789123" - } + }, + "provider": "aws" }, "ecs": { "version": "8.11.0" @@ -127,21 +60,18 @@ "event": { "created": "2021-11-11T01:02:03.123456789Z", "kind": "event", - "original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz\",\"hashValue\":\"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:21:28Z\",\"oldestEventTime\":\"2020-09-11T19:21:28Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz\",\"hashValue\":\"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:51:21Z\",\"oldestEventTime\":\"2020-09-11T18:51:21Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz\",\"hashValue\":\"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:46:45Z\",\"oldestEventTime\":\"2020-09-11T18:46:45Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz\",\"hashValue\":\"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:01:06Z\",\"oldestEventTime\":\"2020-09-11T19:01:06Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz\",\"hashValue\":\"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:16:12Z\",\"oldestEventTime\":\"2020-09-11T19:16:12Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz\",\"hashValue\":\"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:56:05Z\",\"oldestEventTime\":\"2020-09-11T18:56:05Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz\",\"hashValue\":\"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:06:31Z\",\"oldestEventTime\":\"2020-09-11T19:06:31Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz\",\"hashValue\":\"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:41:58Z\",\"oldestEventTime\":\"2020-09-11T18:41:58Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz\",\"hashValue\":\"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:37:10Z\",\"oldestEventTime\":\"2020-09-11T18:37:10Z\"}]}", + "original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"}]}", "outcome": "success", "type": [ "info" ] }, "file": { - "hash": { - "sha256": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" - }, "path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz" }, "related": { "hash": [ - "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" + "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860" ] }, "tags": [ diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json index ddd00a5ef1b..030d8006525 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json @@ -41,7 +41,11 @@ "account": { "id": "111122223333" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "signin" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "JohnDoe", "arn:aws:iam::111122223333:user/JohnDoe" ], + "ip": [ + "89.160.20.156" + ], "user": [ "AIDACKCEVSQ6C2EXAMPLE", "JohnDoe" @@ -162,7 +169,11 @@ "account": { "id": "111122223333" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "signin" + } }, "ecs": { "version": "8.11.0" @@ -187,6 +198,9 @@ "JaneDoe", "arn:aws:iam::111122223333:user/JaneDoe" ], + "ip": [ + "89.160.20.156" + ], "user": [ "AIDACKCEVSQ6C2EXAMPLE", "JaneDoe" @@ -277,6 +291,7 @@ "access_key_id": "AKIAIOSFODNN7EXAMPLE", "arn": "arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName", "session_context": { + "creation_date": "2013-11-02T01:06:28.000Z", "mfa_authenticated": "false", "session_issuer": { "account_id": "123456789012", @@ -293,7 +308,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "signin" + } }, "ecs": { "version": "8.11.0" @@ -320,10 +339,13 @@ "AKIAIOSFODNN7EXAMPLE", "RoleToBeAssumed" ], + "ip": [ + "89.160.20.156" + ], "user": [ + "MySessionName", "AROAIDPPEZS35WEXAMPLE:AssumedRoleSessionName", - "RoleToBeAssumed", - "MySessionName" + "RoleToBeAssumed" ] }, "source": { @@ -353,9 +375,6 @@ "actor_target_mapping" ], "user": { - "changes": { - "name": "MySessionName" - }, "entity": { "id": [ "arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json index da7b05fa8be..d79f985e1dc 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json @@ -28,6 +28,7 @@ "arn": "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae", "session_context": { "creation_date": "2024-10-29T14:29:03.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "00000000000", @@ -44,7 +45,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "bedrock" + } }, "ecs": { "version": "8.11.0" @@ -66,7 +71,10 @@ "kind": "event", "original": "{\"eventVersion\":\"1.10\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"PRINCIPALID:i-03cd6b2a7eb4bf3ae\",\"arn\":\"arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae\",\"accountId\":\"00000000000\",\"accessKeyId\":\"ACCESSKEY\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"PRINCIPALID\",\"arn\":\"arn:aws:iam::00000000000:role/private-ec2-instance-role\",\"accountId\":\"00000000000\",\"userName\":\"private-ec2-instance-role\"},\"attributes\":{\"creationDate\":\"2024-10-29T14:29:03Z\",\"mfaAuthenticated\":\"false\"},\"ec2RoleDelivery\":\"2.0\"}},\"eventTime\":\"2024-10-29T15:51:44Z\",\"eventSource\":\"bedrock.amazonaws.com\",\"eventName\":\"Converse\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"Boto3/1.35.50 md/Botocore#1.35.50 ua/2.0 os/linux#6.8.0-1016-aws md/arch#x86_64 lang/python#3.12.3 md/pyimpl#CPython cfg/retry-mode#legacy Botocore/1.35.50\",\"requestParameters\":{\"modelId\":\"anthropic.claude-3-5-sonnet-20240620-v1:0\"},\"responseElements\":null,\"requestID\":\"aff6f361-1ef0-4460-97af-26528a80b511\",\"eventID\":\"3d67c35a-eef1-4d64-9620-77af8f372ae7\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"00000000000\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.3\",\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"bedrock-runtime.us-east-1.amazonaws.com\"}}", "outcome": "success", - "provider": "bedrock.amazonaws.com" + "provider": "bedrock.amazonaws.com", + "type": [ + "info" + ] }, "related": { "entity": [ @@ -76,10 +84,13 @@ "anthropic.claude-3-5-sonnet-20240620-v1:0", "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-03cd6b2a7eb4bf3ae", "PRINCIPALID:i-03cd6b2a7eb4bf3ae", - "private-ec2-instance-role", - "i-03cd6b2a7eb4bf3ae" + "private-ec2-instance-role" ] }, "source": { @@ -121,9 +132,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-03cd6b2a7eb4bf3ae" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-expected.json index aee10350768..edb72eb0b4d 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json-minimal.log-expected.json @@ -51,7 +51,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -78,6 +82,9 @@ "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md", "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md" ], + "ip": [ + "216.160.83.56" + ], "user": [ "ACCESSKEYID", "test@elastic.co" @@ -155,6 +162,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json.log-expected.json index 6c8286e2f2c..4f1d7e38e42 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-copy-object-json.log-expected.json @@ -66,7 +66,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -93,6 +97,9 @@ "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README-copy.md", "arn:aws:s3:::elastic-cspm-cloudtrail-test-bucket/test-copy-object/README.md" ], + "ip": [ + "216.160.83.56" + ], "user": [ "ACCESSKEYID", "test@elastic.co" @@ -170,6 +177,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json index a1fa460679b..362725a3632 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json @@ -46,7 +46,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -83,6 +87,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json index 0ec8f9430a2..726cbb6f7af 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json @@ -31,6 +31,7 @@ "arn": "arn:aws:sts::00000000000:assumed-role/bedrock_ec2_role/i-05e14c76fdb335957", "session_context": { "creation_date": "2024-11-01T13:35:39.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "00000000000", @@ -47,7 +48,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -82,10 +87,13 @@ "arn:aws:iam::00000000000:role/bedrock_ec2_role", "arn:aws:ssmmessages:us-east-2:00000000000:control-channel/i-05e14c76fdb335957" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-05e14c76fdb335957", "PRINCIPALID:i-05e14c76fdb335957", - "bedrock_ec2_role", - "i-05e14c76fdb335957" + "bedrock_ec2_role" ] }, "source": { @@ -127,9 +135,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-05e14c76fdb335957" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/bedrock_ec2_role/i-05e14c76fdb335957" @@ -149,6 +154,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json index cada1afca2d..4a91e5eb115 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json @@ -138,6 +138,11 @@ "request_parameters": "{dBInstanceIdentifier=test-cloudtrail-event-instance-14340, masterUsername=admin, allocatedStorage=20, engine=mysql, dBInstanceClass=db.t3.micro, masterUserPassword=HIDDEN_DUE_TO_SECURITY_REASONS}", "response_elements": "{allocatedStorage=20, backupTarget=region, cACertificateIdentifier=rds-ca-rsa2048-g1, dbInstancePort=0, dBParameterGroups=[{dBParameterGroupName=default.mysql8.0, parameterApplyStatus=in-sync}], dbiResourceId=db-ANY6I3FNUJC7WQKYS5RFPU7ORM, preferredBackupWindow=09:23-09:53, deletionProtection=false, dBInstanceArn=arn:aws:rds:us-east-1:1010101010101:db:test-cloudtrail-event-instance-14340, dBInstanceIdentifier=test-cloudtrail-event-instance-14340, engine=mysql, publiclyAccessible=true, iAMDatabaseAuthenticationEnabled=false, networkType=IPV4, engineVersion=8.0.35, performanceInsightsEnabled=false, masterUsername=admin, certificateDetails={cAIdentifier=rds-ca-rsa2048-g1}, multiAZ=false, dBInstanceClass=db.t3.micro, storageEncrypted=false, dBSubnetGroup={vpcId=vpc-73d2e309, subnets=[{subnetIdentifier=subnet-c4bf5e9b, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1d}}, {subnetIdentifier=subnet-0a0bee6c, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1a}}, {subnetIdentifier=subnet-37391109, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1e}}, {subnetIdentifier=subnet-fee506df, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1b}}, {subnetIdentifier=subnet-bf6ab5b1, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1f}}, {subnetIdentifier=subnet-8bdf6bc6, subnetStatus=Active, subnetAvailabilityZone={name=us-east-1c}}], subnetGroupStatus=Complete, dBSubnetGroupDescription=default, dBSubnetGroupName=default}, storageThroughput=0, httpEndpointEnabled=false, vpcSecurityGroups=[{vpcSecurityGroupId=sg-4e483165, status=active}], customerOwnedIpEnabled=false, licenseModel=general-public-license, pendingModifiedValues={masterUserPassword=HIDDEN_DUE_TO_SECURITY_REASONS}, monitoringInterval=0, preferredMaintenanceWindow=sun:06:55-sun:07:25, dBInstanceStatus=creating, backupRetentionPeriod=1, engineLifecycleSupport=open-source-rds-extended-support, storageType=gp2, optionGroupMemberships=[{optionGroupName=default:mysql-8-0, status=in-sync}], dedicatedLogVolume=false, autoMinorVersionUpgrade=true, copyTagsToSnapshot=false}", "user_identity": { + "credential_id": "EXAMPLEVHULjJdTUdPJfofVa1sufHDoj7aYcOYcxFVllWR_Whr1fEXAMPLE", + "on_behalf_of": { + "identity_store_arn": "arn:aws:identitystore::123456789012:identitystore/d-9067642ac7", + "user_id": "544894e8-80c1-707f-60e3-3ba6510dfac1" + }, "type": "IdentityCenterUser" } } @@ -146,7 +151,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -181,6 +190,9 @@ "subnet-bf6ab5b1", "subnet-8bdf6bc6" ], + "ip": [ + "216.160.83.56" + ], "user": [ "544894e8-80c1-707f-60e3-3ba6510dfac1" ] diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json index a7202b0f960..9fa4b13268c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "guardduty" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "test@elastic.co", "TESTACCESSKEY" ], + "ip": [ + "216.160.83.56" + ], "user": [ "TESTPRINCIPALID", "test@elastic.co" @@ -126,6 +133,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-document-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-document-json.log-expected.json index f6ae9079830..9194335aaa2 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-document-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-document-json.log-expected.json @@ -59,7 +59,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -93,6 +97,9 @@ "EncryptFilesAndUploadRansomNote", "arn:aws:iam::00000000000:user/pwncloud-backdoor-user" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "pwncloud-backdoor-user" @@ -159,6 +166,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json index 44a177714f2..76409aa003e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json @@ -47,7 +47,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -78,6 +82,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -142,7 +149,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -172,6 +183,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -250,7 +264,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -279,6 +297,9 @@ "entity": [ "arn:aws:iam::0123456789012:user/Alice", "EXAMPLE_KEY" + ], + "ip": [ + "127.0.0.1" ] }, "source": { @@ -338,7 +359,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -366,6 +391,9 @@ "entity": [ "arn:aws:iam::0123456789012:user/Alice", "EXAMPLE_KEY" + ], + "ip": [ + "127.0.0.1" ] }, "source": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json index b427f7c99ba..3c76ba88b5f 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "EXAMPLE_KEY_ID", "Alice" ], + "ip": [ + "89.160.20.156" + ], "user": [ "EX_PRINCIPAL_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json index bcd874c6021..81ae0105570 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json @@ -77,7 +77,11 @@ "account": { "id": "1010101010101" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "lambda" + } }, "ecs": { "version": "8.11.0" @@ -103,6 +107,9 @@ "arn:aws:iam::1010101010101:user/testcloudtrail@elastic.co", "cloudtrail-events-test" ], + "ip": [ + "216.160.83.56" + ], "user": [ "AIDA2IBR2EZTJMPOR52WV", "testcloudtrail@elastic.co" @@ -160,6 +167,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-policy-json.log-expected.json index fdb954d01f2..a02d81745bf 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-policy-json.log-expected.json @@ -50,7 +50,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -78,6 +82,9 @@ "PwncloudSNSPublishPolicy", "arn:aws:iam::00000000000:user/pwncloud-backdoor-user" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "pwncloud-backdoor-user" @@ -153,6 +160,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-json.log-expected.json index d00d1f8f902..64f53aea5e1 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-json.log-expected.json @@ -46,7 +46,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "cloudformation" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "arn:aws:cloudformation:us-east-1:000000000:stack/cloudtrail-stack/19182870-87c7-11ef-bc78-0e34431d21e9", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -143,6 +150,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-set-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-set-json.log-expected.json index bc10ae9953d..8408c16b87e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-set-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-stack-set-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "cloudformation" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "cloudtrail-stack-set:11c4915f-65ac-46d9-a173-17c8e89d8718" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -134,6 +141,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-topic-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-topic-json.log-expected.json index cf8a355a926..4e7821eddb9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-topic-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-topic-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "sns" + } }, "ecs": { "version": "8.11.0" @@ -122,6 +126,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-response-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-response-json.log-expected.json index 10e794db81b..2a34dcc2acc 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-response-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-response-json.log-expected.json @@ -49,7 +49,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -80,6 +84,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "tmf-01bee5a4ef310ec1b" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -144,6 +151,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-rule-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-rule-json.log-expected.json index 40c8bb474ef..4100f6be5ec 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-rule-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-filter-rule-json.log-expected.json @@ -63,7 +63,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -94,6 +98,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -158,6 +165,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-session-request-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-session-request-json.log-expected.json index b6e5e20e949..6afb390163e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-session-request-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-session-request-json.log-expected.json @@ -61,7 +61,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -92,6 +96,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "tms-089e55493216df002" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -156,6 +163,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-target-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-target-json.log-expected.json index a7399847644..7557c8a2b71 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-target-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-traffic-mirror-target-json.log-expected.json @@ -53,7 +53,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -84,6 +88,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "tmt-0c62986bff32556ac" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -148,6 +155,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json index 8f3838e59d3..c872c1a6dd5 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json @@ -53,7 +53,11 @@ "account": { "id": "0123456789012" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -79,6 +83,9 @@ "arn:aws:cloudtrail:us-west-2:0123456789012:trail/TEST-trail", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trust-anchor-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trust-anchor-json.log-expected.json index 217eba691d9..a20e48673f9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trust-anchor-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trust-anchor-json.log-expected.json @@ -74,7 +74,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rolesanywhere" + } }, "ecs": { "version": "8.11.0" @@ -98,6 +102,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:rolesanywhere:us-east-1:000000000:trust-anchor/3a219944-dbbf-4274-a680-880224f97d93" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -171,6 +178,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json index 8005f225ca4..face6bdce90 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -75,6 +79,9 @@ "arn:aws:iam::123456789012:user/Alice", "EXAMPLE_KEY_ID" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLEUSERID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json index 5ed64ba8e7e..6fa3000d807 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json @@ -43,7 +43,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json index 26af15dc70c..35010b338e2 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -73,6 +77,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Alice", "EXAMPLE_ID" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json index f1fc4d85041..4d0c0ed22db 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-access-key-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-alarms-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-alarms-json.log-expected.json index c697b7e5cf3..0eb6fad2afd 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-alarms-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-alarms-json.log-expected.json @@ -36,7 +36,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "monitoring" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -131,6 +138,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json index 0bffc8f09d9..6f3d5248892 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json @@ -42,7 +42,11 @@ "account": { "id": "777788889999" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -70,10 +74,13 @@ "AKIAQRSTUVWXYZEXAMPLE", "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk" ], + "ip": [ + "89.160.20.156" + ], "user": [ + "devdsk", "AIDAQRSTUVWXYZEXAMPLE:devdsk", - "AssumeNothing", - "devdsk" + "AssumeNothing" ] }, "source": { @@ -103,9 +110,6 @@ "actor_target_mapping" ], "user": { - "changes": { - "name": "devdsk" - }, "entity": { "id": [ "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-cluster-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-cluster-json.log-expected.json index e47cd3e621d..ac8ff489525 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-cluster-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-cluster-json.log-expected.json @@ -81,7 +81,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -106,6 +110,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:rds:us-east-1:000000000:cluster:test-cloudtrail-event-instance-31611-cluster" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -179,6 +186,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-instance-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-instance-json.log-expected.json index 152533e8578..a55da6008a5 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-instance-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-db-instance-json.log-expected.json @@ -146,7 +146,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -179,6 +183,9 @@ "ACCESSKEYID", "subnet-fee506df" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -252,6 +259,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json index c34e3831777..1a84857e981 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "guardduty" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -121,6 +128,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-file-system-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-file-system-json.log-expected.json index c500c0b4f8d..a215e63d6ae 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-file-system-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-file-system-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "elasticfilesystem" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "fs-083449b7896389cf9" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -130,6 +137,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-flow-log-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-flow-log-json.log-expected.json index d5421d94e61..f4c634c9a23 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-flow-log-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-flow-log-json.log-expected.json @@ -46,7 +46,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -77,6 +81,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "fl-07a9b55570fe770b6" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -141,6 +148,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-global-cluster-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-global-cluster-json.log-expected.json index 9c509864d1c..3be3918500b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-global-cluster-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-global-cluster-json.log-expected.json @@ -46,7 +46,11 @@ "account": { "id": "704479110758" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "arn:aws:iam::0000000000:user/test@elastic.co", "arn:aws:rds::704479110758:global-cluster:myglobalcluster" ], + "ip": [ + "216.160.83.56" + ], "user": [ "AIDA2IBR2EZTJMPOR52WV", "romulo.farias@elastic.co" @@ -143,6 +150,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json index 791657ecb43..e65129a7c5a 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-group-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -131,7 +138,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -161,6 +172,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_PRINCIPLE", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-group-json.log-expected.json index 66081e6882c..077193d028c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-group-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "logs" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "cloudtrail-log-group-test", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -130,6 +137,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-stream-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-stream-json.log-expected.json index 02de40d258a..28e59486c76 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-stream-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-log-stream-json.log-expected.json @@ -36,7 +36,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "logs" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "cloudtrail-log-stream-test", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -131,6 +138,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-mount-target-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-mount-target-json.log-expected.json index 649eefaaeee..d84a49991c0 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-mount-target-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-mount-target-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "elasticfilesystem" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "fsmt-012695c3935f60c2c" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -130,6 +137,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-entry-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-entry-json.log-expected.json index bf15ba9d771..e2d922d01c9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-entry-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-entry-json.log-expected.json @@ -41,7 +41,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -73,6 +77,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "acl-0af9cb843511d66d4" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -147,6 +154,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-json.log-expected.json index 433ac9eaec7..4a37ad07fd5 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-network-acl-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -63,6 +67,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "acl-0af9cb843511d66d4" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -136,6 +143,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-resolver-query-log-config-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-resolver-query-log-config-json.log-expected.json index 5b8603b9760..174b080ed2b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-resolver-query-log-config-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-resolver-query-log-config-json.log-expected.json @@ -50,7 +50,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "route53resolver" + } }, "ecs": { "version": "8.11.0" @@ -74,6 +78,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:route53resolver:us-east-1:000000000:resolver-query-log-config/rqlc-10e716304cee4d36" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -147,6 +154,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-group-json.log-expected.json index 591a3a5f326..c5854482548 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-group-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "000000000" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "wafv2" + } }, "ecs": { "version": "8.11.0" @@ -69,6 +73,9 @@ "e0e758d9-0c7d-4559-8374-ef0ef1f45a52", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -133,6 +140,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-json.log-expected.json index 5b1386ec769..38248c0e66c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-rule-json.log-expected.json @@ -36,7 +36,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "events" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -131,6 +138,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json index a5b926c30dd..73ed0e93ab1 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-ssh-public-key-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json index 7f369cc00df..48e746dceb0 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-trail-json.log-expected.json @@ -33,7 +33,11 @@ "account": { "id": "0123456789012" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -60,6 +64,9 @@ "arn:aws:iam::0123456789012:user/Alice", "arn:aws:cloudtrail:us-west-2:0123456789012:trail/test-trail" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json index 3c4f9d07686..95e455df200 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-user-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "EXAMPLE_KEY_ID", "Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EX_PRINCIPAL_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json index ab244202dcc..ca735bf639b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-virtual-mfa-device-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-web-acl-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-web-acl-json.log-expected.json index 4cb91ec746c..6e2037f1340 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-web-acl-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-web-acl-json.log-expected.json @@ -43,7 +43,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "wafv2" + } }, "ecs": { "version": "8.11.0" @@ -74,6 +78,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -143,6 +150,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-disable-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-disable-key-json.log-expected.json index 9ec6325c0c8..8db852423da 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-disable-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-disable-key-json.log-expected.json @@ -45,7 +45,11 @@ "account": { "id": "1010101010101" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "kms" + } }, "ecs": { "version": "8.11.0" @@ -69,6 +73,9 @@ "arn:aws:kms:us-east-1:1010101010101:key/65479477-67d5-4b84-b71c-d540f7a8f31f", "testcloudtrail@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "AIDA2IBR2EZTJMPOR52WV", "testcloudtrail@elastic.co" @@ -142,6 +149,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json index e584006a6b8..38b4d1e0234 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-enable-mfa-device-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json index b956097851d..2d9be8acebe 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json @@ -63,7 +63,11 @@ "account": { "id": "0000000000" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -90,9 +94,9 @@ "ACCESSKEY" ], "user": [ + "AWSConfig-Describe", "PRINCIPALID:AWSConfig-Describe", - "AWSServiceRoleForConfig", - "AWSConfig-Describe" + "AWSServiceRoleForConfig" ] }, "service": { @@ -124,9 +128,6 @@ } }, "user": { - "changes": { - "name": "AWSConfig-Describe" - }, "id": "PRINCIPALID:AWSConfig-Describe", "name": "AWSServiceRoleForConfig" }, @@ -140,6 +141,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-caller-identity-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-caller-identity-json.log-expected.json index 1200cd3bb82..c826bbc6797 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-caller-identity-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-caller-identity-json.log-expected.json @@ -28,7 +28,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "sts" + } }, "ecs": { "version": "8.11.0" @@ -62,6 +66,9 @@ "ACCESSKEY", "terraformer" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "terraformer" @@ -125,6 +132,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameter-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameter-json.log-expected.json index ad1aac21c6c..bbed39bd17b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameter-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameter-json.log-expected.json @@ -40,7 +40,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -64,6 +68,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -137,6 +144,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameters-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameters-json.log-expected.json index 65241b7f35c..2d54c919773 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameters-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-parameters-json.log-expected.json @@ -42,7 +42,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -139,6 +146,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-password-data-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-password-data-json.log-expected.json index 4909a003f31..441f43a26ed 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-password-data-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-password-data-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,12 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "hosts": [ + "i-003e90a87a9e72f06" + ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -131,6 +141,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json index 558d402eb4f..7690fa4ce7e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json @@ -28,6 +28,7 @@ "arn": "arn:aws:sts::00000000000:assumed-role/Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9/i-00486a46a6d8692b9", "session_context": { "creation_date": "2024-10-31T19:53:23.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "00000000000", @@ -44,7 +45,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -72,10 +77,13 @@ "arn:aws:sts::00000000000:assumed-role/Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9/i-00486a46a6d8692b9", "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-00486a46a6d8692b9", "PRINCIPALID:i-00486a46a6d8692b9", - "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9", - "i-00486a46a6d8692b9" + "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" ] }, "service": { @@ -126,9 +134,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-00486a46a6d8692b9" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9/i-00486a46a6d8692b9" @@ -150,6 +155,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-secret-value-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-secret-value-json.log-expected.json index ed6a0969ffb..aeb51473e91 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-secret-value-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-secret-value-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "secretsmanager" + } }, "ecs": { "version": "8.11.0" @@ -58,6 +62,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -131,6 +138,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json index dacbe06f00c..cd2ca52b08c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-insight-json.log-expected.json @@ -56,13 +56,15 @@ "state": "End" } }, - "recipient_account_id": "123456789012" + "recipient_account_id": "123456789012", + "shared_event_id": "e672c2b1-e71a-4779-f96c-02da7bb30d2e" } }, "cloud": { "account": { "id": "123456789012" }, + "provider": "aws", "region": "us-east-1" }, "ecs": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-list-attached-role-policies-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-list-attached-role-policies-json.log-expected.json index b2de3555188..8e66a0d052c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-list-attached-role-policies-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-list-attached-role-policies-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -68,6 +72,9 @@ "isai", "arn:aws:iam::00000000000:user/isai" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "isai" @@ -130,6 +137,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-json.log-expected.json index 1526fdf083c..1fc6a150b2d 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-json.log-expected.json @@ -84,7 +84,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -109,6 +113,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:rds:us-east-1:000000000:cluster:test-cloudtrail-event-instance-31611-cluster" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -182,6 +189,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-snapshot-attribute-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-snapshot-attribute-json.log-expected.json index 517322d0514..fdc0e522140 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-snapshot-attribute-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-cluster-snapshot-attribute-json.log-expected.json @@ -50,7 +50,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -81,6 +85,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -145,6 +152,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-instance-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-instance-json.log-expected.json index ddadca8a869..87c2ddbfd59 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-instance-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-instance-json.log-expected.json @@ -152,7 +152,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -185,6 +189,9 @@ "ACCESSKEYID", "subnet-fee506df" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -258,6 +265,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-snapshot-attributte-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-snapshot-attributte-json.log-expected.json index 691102f1a7f..7632c83ef2c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-snapshot-attributte-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-db-snapshot-attributte-json.log-expected.json @@ -47,7 +47,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -78,6 +82,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -142,6 +149,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-image-attribute-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-image-attribute-json.log-expected.json index 4e3580fd3fe..0f8547074fb 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-image-attribute-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-image-attribute-json.log-expected.json @@ -49,11 +49,22 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" }, + "entity": { + "target": { + "id": [ + "ami-0beb42caf02660314" + ] + } + }, "event": { "action": "ModifyImageAttribute", "created": "2021-11-11T01:02:03.123456789Z", @@ -66,13 +77,6 @@ "info" ] }, - "entity": { - "target": { - "id": [ - "ami-0beb42caf02660314" - ] - } - }, "related": { "entity": [ "ami-0beb42caf02660314", @@ -80,6 +84,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -144,6 +151,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-snapshot-attribute-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-snapshot-attribute-json.log-expected.json index b529259e654..3762af5bb81 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-snapshot-attribute-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-modify-snapshot-attribute-json.log-expected.json @@ -49,11 +49,22 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" }, + "entity": { + "target": { + "id": [ + "snap-0a392d80692e2526a" + ] + } + }, "event": { "action": "ModifySnapshotAttribute", "created": "2021-11-11T01:02:03.123456789Z", @@ -66,13 +77,6 @@ "info" ] }, - "entity": { - "target": { - "id": [ - "snap-0a392d80692e2526a" - ] - } - }, "related": { "entity": [ "snap-0a392d80692e2526a", @@ -80,6 +84,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -144,6 +151,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json index 29f7470624c..708cc7fd88c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json @@ -41,6 +41,7 @@ "arn": "arn:aws:sts::000000000000:assumed-role/ec2-instance-role/i-021987ab2dbf04585", "session_context": { "creation_date": "2024-10-30T14:08:29.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "000000000000", @@ -57,7 +58,11 @@ "account": { "id": "000000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -92,10 +97,13 @@ "arn:aws:sts::000000000000:assumed-role/ec2-instance-role/i-021987ab2dbf04585", "arn:aws:ssmmessages:us-east-1:000000000000:control-channel/i-021987ab2dbf04585" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-021987ab2dbf04585", "PRINCIPALID:i-021987ab2dbf04585", - "ec2-instance-role", - "i-021987ab2dbf04585" + "ec2-instance-role" ] }, "source": { @@ -134,9 +142,6 @@ } }, "user": { - "changes": { - "name": "i-021987ab2dbf04585" - }, "entity": { "id": [ "arn:aws:sts::000000000000:assumed-role/ec2-instance-role/i-021987ab2dbf04585" @@ -156,6 +161,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json index 0ad558f1ee3..e76b3a54386 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json @@ -40,6 +40,7 @@ "arn": "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-0ddf9acf8eeb33959", "session_context": { "creation_date": "2024-10-30T20:15:05.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "00000000000", @@ -56,7 +57,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "sns" + } }, "ecs": { "version": "8.11.0" @@ -78,7 +83,10 @@ "kind": "event", "original": "{\"eventVersion\":\"1.10\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"PRINCIPALID:i-0ddf9acf8eeb33959\",\"arn\":\"arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-0ddf9acf8eeb33959\",\"accountId\":\"00000000000\",\"accessKeyId\":\"ACCESSKEY\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"PRINCIPALID\",\"arn\":\"arn:aws:iam::00000000000:role/private-ec2-instance-role\",\"accountId\":\"00000000000\",\"userName\":\"private-ec2-instance-role\"},\"attributes\":{\"creationDate\":\"2024-10-30T20:15:05Z\",\"mfaAuthenticated\":\"false\"},\"ec2RoleDelivery\":\"2.0\"}},\"eventTime\":\"2024-10-30T20:41:38Z\",\"eventSource\":\"sns.amazonaws.com\",\"eventName\":\"Publish\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/linux#6.8.0-1016-aws md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#sns.publish\",\"requestParameters\":{\"topicArn\":\"arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration\",\"message\":\"HIDDEN_DUE_TO_SECURITY_REASONS\"},\"responseElements\":{\"messageId\":\"1c6ef438-7b64-55a9-bbcd-aba4e7260fe1\"},\"requestID\":\"459469ac-b1ae-5731-9dec-36302dec5d79\",\"eventID\":\"4dfbb87b-9d53-4cbc-a013-b1544cea8c02\",\"readOnly\":false,\"resources\":[{\"accountId\":\"00000000000\",\"type\":\"AWS::SNS::Topic\",\"ARN\":\"arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"00000000000\",\"eventCategory\":\"Data\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.3\",\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"sns.us-east-1.amazonaws.com\"}}", "outcome": "success", - "provider": "sns.amazonaws.com" + "provider": "sns.amazonaws.com", + "type": [ + "info" + ] }, "related": { "entity": [ @@ -88,10 +96,13 @@ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-0ddf9acf8eeb33959", "arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration" ], + "ip": [ + "216.160.83.56" + ], "user": [ + "i-0ddf9acf8eeb33959", "PRINCIPALID:i-0ddf9acf8eeb33959", - "private-ec2-instance-role", - "i-0ddf9acf8eeb33959" + "private-ec2-instance-role" ] }, "source": { @@ -133,9 +144,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-0ddf9acf8eeb33959" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-0ddf9acf8eeb33959" @@ -158,6 +166,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-logging-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-logging-json.log-expected.json index 9d717e7a5ed..b7ef1bd7dcc 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-logging-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-logging-json.log-expected.json @@ -58,7 +58,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -83,6 +87,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "elastic-cspm-cloudtrail-test-bucket" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -156,6 +163,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-replication-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-replication-json.log-expected.json index 422779a4294..952c3753807 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-replication-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-replication-json.log-expected.json @@ -65,7 +65,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -91,6 +95,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -166,6 +173,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-versioning-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-versioning-json.log-expected.json index f52c87f5e3f..5c35fc36fef 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-versioning-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-bucket-versioning-json.log-expected.json @@ -55,7 +55,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -80,6 +84,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "elastic-cspm-cloudtrail-test-bucket" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -153,6 +160,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-object-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-object-json.log-expected.json index bf002704903..d3bbc605926 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-object-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-put-object-json.log-expected.json @@ -55,7 +55,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "s3" + } }, "ecs": { "version": "8.11.0" @@ -84,6 +88,9 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -159,6 +166,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json index ce56d619b41..1522e1a0377 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-remove-user-from-group-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -69,6 +73,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-s3-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-s3-json.log-expected.json index d0dd467e424..64c1e789a44 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-s3-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-s3-json.log-expected.json @@ -153,7 +153,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -186,6 +190,9 @@ "test-cloudtrail-event-instance-31611-restored-from-s3", "arn:aws:rds:us-east-1:000000000:db:test-cloudtrail-event-instance-31611-restored-from-s3" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -259,6 +266,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-snapshot-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-snapshot-json.log-expected.json index 2040e04105e..dfad9b134df 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-snapshot-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-restore-db-instnace-from-snapshot-json.log-expected.json @@ -142,7 +142,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -175,6 +179,9 @@ "ACCESSKEYID", "subnet-fee506df" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -248,6 +255,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-run-instances-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-run-instances-json.log-expected.json index 78b96d76be2..afdf3379a58 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-run-instances-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-run-instances-json.log-expected.json @@ -224,7 +224,11 @@ "account": { "id": "1010101010101" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -254,6 +258,12 @@ "ami-00a4cd63f089232e0", "eni-043138569d4a31e90" ], + "hosts": [ + "i-0f2f135de18b555e3" + ], + "ip": [ + "216.160.83.56" + ], "user": [ "AIDA2IBR2EZTJMPOR52WV", "testcloudtrail@elastic.co" @@ -311,6 +321,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-schedule-key-deletion-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-schedule-key-deletion-json.log-expected.json index e933aed2069..05dcbd30a07 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-schedule-key-deletion-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-schedule-key-deletion-json.log-expected.json @@ -49,7 +49,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "kms" + } }, "ecs": { "version": "8.11.0" @@ -73,6 +77,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:kms:us-east-1:000000000:key/27d7cd14-7557-4509-a438-15fbf1e8db11" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -146,6 +153,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json index 77ab74fb063..e3d7f7da0a3 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json @@ -90,7 +90,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -112,7 +116,10 @@ "kind": "event", "original": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"PRINCIPAL:StateManagerService\",\"arn\":\"arn:aws:sts::00000000000:assumed-role/AWSServiceRoleForAmazonSSM/StateManagerService\",\"accountId\":\"00000000000\",\"accessKeyId\":\"ACCESSKEY\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"PRINCIPAL\",\"arn\":\"arn:aws:iam::00000000000:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM\",\"accountId\":\"00000000000\",\"userName\":\"AWSServiceRoleForAmazonSSM\"},\"webIdFederationData\":{},\"attributes\":{\"creationDate\":\"2024-11-04T19:56:35Z\",\"mfaAuthenticated\":\"false\"}},\"invokedBy\":\"ssm.amazonaws.com\"},\"eventTime\":\"2024-11-04T19:56:35Z\",\"eventSource\":\"ssm.amazonaws.com\",\"eventName\":\"SendCommand\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"ssm.amazonaws.com\",\"userAgent\":\"ssm.amazonaws.com\",\"requestParameters\":{\"instanceIds\":[\"*\"],\"documentName\":\"AWS-RunPatchBaselineAssociation\",\"documentVersion\":\"1\",\"timeoutSeconds\":600,\"comment\":\"1e59ed7b-bf7f-4304-ba2d-e48cfcf5658d:c257a672-eb26-428b-9a92-3e51bbb69c71\",\"parameters\":\"HIDDEN_DUE_TO_SECURITY_REASONS\",\"maxConcurrency\":\"100%\",\"maxErrors\":\"100%\",\"clientName\":\"\",\"interactive\":false},\"responseElements\":{\"command\":{\"commandId\":\"9f9aa7a3-b1a6-45ba-b83f-f5cc4b5f9961\",\"documentName\":\"AWS-RunPatchBaselineAssociation\",\"documentVersion\":\"1\",\"comment\":\"1e59ed7b-bf7f-4304-ba2d-e48cfcf5658d:c257a672-eb26-428b-9a92-3e51bbb69c71\",\"expiresAfter\":\"Nov 5, 2024, 2:06:35 AM\",\"parameters\":\"HIDDEN_DUE_TO_SECURITY_REASONS\",\"instanceIds\":[\"*\"],\"targets\":[],\"requestedDateTime\":\"Nov 4, 2024, 7:56:35 PM\",\"status\":\"Pending\",\"statusDetails\":\"Pending\",\"outputS3Region\":\"us-east-1\",\"outputS3BucketName\":\"\",\"outputS3KeyPrefix\":\"\",\"maxConcurrency\":\"100%\",\"maxErrors\":\"100%\",\"targetCount\":0,\"completedCount\":0,\"errorCount\":0,\"deliveryTimedOutCount\":0,\"serviceRole\":\"\",\"notificationConfig\":{\"notificationArn\":\"\",\"notificationEvents\":[],\"notificationType\":\"\"},\"cloudWatchOutputConfig\":{\"cloudWatchLogGroupName\":\"\",\"cloudWatchOutputEnabled\":false},\"interactive\":false,\"timeoutSeconds\":600,\"clientName\":\"StateManager\",\"clientSourceId\":\"\",\"alarmConfiguration\":{\"ignorePollAlarmFailure\":false,\"alarms\":[]},\"triggeredAlarms\":[],\"hasSendCommandSignature\":false,\"hasCancelCommandSignature\":false}},\"requestID\":\"8dd0bf64-ad22-4210-ac5b-027967c93994\",\"eventID\":\"854f1ab5-82e4-44dc-b29a-62b346e257d7\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"00000000000\",\"eventCategory\":\"Management\"}", "outcome": "success", - "provider": "ssm.amazonaws.com" + "provider": "ssm.amazonaws.com", + "type": [ + "start" + ] }, "related": { "entity": [ @@ -123,9 +130,9 @@ "arn:aws:iam::00000000000:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "user": [ + "StateManagerService", "PRINCIPAL:StateManagerService", - "AWSServiceRoleForAmazonSSM", - "StateManagerService" + "AWSServiceRoleForAmazonSSM" ] }, "service": { @@ -150,9 +157,6 @@ } }, "user": { - "changes": { - "name": "StateManagerService" - }, "id": "PRINCIPAL:StateManagerService", "name": "AWSServiceRoleForAmazonSSM" }, @@ -166,6 +170,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-targets-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-targets-json.log-expected.json index 16364feab59..0e015e2ea4b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-targets-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-targets-json.log-expected.json @@ -81,7 +81,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -96,7 +100,10 @@ "kind": "event", "original": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"PRINCPALID\",\"arn\":\"arn:aws:iam::00000000000:user/pwncloud-backdoor-user\",\"accountId\":\"00000000000\",\"accessKeyId\":\"ACCESSKEYID\",\"userName\":\"pwncloud-backdoor-user\"},\"eventTime\":\"2024-10-30T20:30:00Z\",\"eventSource\":\"ssm.amazonaws.com\",\"eventName\":\"SendCommand\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/linux#6.8.0-1016-aws md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython cfg/retry-mode#standard md/installer#exe md/distrib#ubuntu.24 md/prompt#off md/command#ssm.send-command\",\"requestParameters\":{\"targets\":[{\"key\":\"instanceids\",\"values\":[\"i-0ddf9acf8eeb33959\"]}],\"documentName\":\"EncryptFilesAndUploadRansomNote\",\"interactive\":false},\"responseElements\":{\"command\":{\"commandId\":\"29afe621-dae7-4f93-a5b6-e485d0e429b1\",\"documentName\":\"EncryptFilesAndUploadRansomNote\",\"documentVersion\":\"$DEFAULT\",\"comment\":\"\",\"expiresAfter\":\"Oct 30, 2024, 10:30:00 PM\",\"parameters\":\"HIDDEN_DUE_TO_SECURITY_REASONS\",\"instanceIds\":[],\"targets\":[{\"key\":\"instanceids\",\"values\":[\"i-0ddf9acf8eeb33959\"]}],\"requestedDateTime\":\"Oct 30, 2024, 8:30:00 PM\",\"status\":\"Pending\",\"statusDetails\":\"Pending\",\"outputS3Region\":\"us-east-1\",\"outputS3BucketName\":\"\",\"outputS3KeyPrefix\":\"\",\"maxConcurrency\":\"50\",\"maxErrors\":\"0\",\"targetCount\":0,\"completedCount\":0,\"errorCount\":0,\"deliveryTimedOutCount\":0,\"serviceRole\":\"\",\"notificationConfig\":{\"notificationArn\":\"\",\"notificationEvents\":[],\"notificationType\":\"\"},\"cloudWatchOutputConfig\":{\"cloudWatchLogGroupName\":\"\",\"cloudWatchOutputEnabled\":false},\"interactive\":false,\"timeoutSeconds\":3600,\"clientName\":\"\",\"clientSourceId\":\"\",\"alarmConfiguration\":{\"ignorePollAlarmFailure\":false,\"alarms\":[]},\"triggeredAlarms\":[],\"hasSendCommandSignature\":false,\"hasCancelCommandSignature\":false}},\"requestID\":\"11b4aa49-fb0a-4045-aa33-d12ac1d3b304\",\"eventID\":\"c25b98b1-270c-47e6-ba2d-e2e25f26bec7\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"00000000000\",\"eventCategory\":\"Management\",\"tlsDetails\":{\"tlsVersion\":\"TLSv1.2\",\"cipherSuite\":\"ECDHE-RSA-AES128-GCM-SHA256\",\"clientProvidedHostHeader\":\"ssm.us-east-1.amazonaws.com\"}}", "outcome": "success", - "provider": "ssm.amazonaws.com" + "provider": "ssm.amazonaws.com", + "type": [ + "start" + ] }, "host": { "target": { @@ -114,6 +121,9 @@ "pwncloud-backdoor-user", "arn:aws:iam::00000000000:user/pwncloud-backdoor-user" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCPALID", "pwncloud-backdoor-user" @@ -180,6 +190,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-serial-console-ssh-public-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-serial-console-ssh-public-key-json.log-expected.json index 58a402392fe..7b2296bed35 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-serial-console-ssh-public-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-serial-console-ssh-public-key-json.log-expected.json @@ -42,7 +42,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2-instance-connect" + } }, "ecs": { "version": "8.11.0" @@ -75,6 +79,12 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "hosts": [ + "i-097069fd5068721f3" + ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -139,6 +149,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-ssh-public-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-ssh-public-key-json.log-expected.json index 6661d39b0df..441826ce819 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-ssh-public-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-ssh-public-key-json.log-expected.json @@ -42,7 +42,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ec2-instance-connect" + } }, "ecs": { "version": "8.11.0" @@ -75,6 +79,12 @@ "ACCESSKEYID", "arn:aws:iam::000000000:user/test@elastic.co" ], + "hosts": [ + "i-097069fd5068721f3" + ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -139,6 +149,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json index 65872f41f1e..6a5aef7d976 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-logging-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -62,6 +66,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-session-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-session-json.log-expected.json index 644a5d710a8..3fa4c2a321f 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-session-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-start-session-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,12 @@ "i-1234567890abcdef0", "arn:aws:iam::000000000:user/test@elastic.co" ], + "hosts": [ + "i-1234567890abcdef0" + ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -134,6 +144,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-configuration-recorder.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-configuration-recorder.log-expected.json index c7180a1302e..1e52fe4ceb3 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-configuration-recorder.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-configuration-recorder.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "1010101010101" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "config" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "arn:aws:iam::1010101010101:user/testcloudtrail@elastic.co", "testcloudtrail@elastic.co" ], + "ip": [ + "216.160.83.56" + ], "user": [ "AIDA2IBR2EZTJMPOR52WV", "testcloudtrail@elastic.co" @@ -129,6 +136,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-cluster-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-cluster-json.log-expected.json index 9314c35ccc6..12ffbd4f542 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-cluster-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-cluster-json.log-expected.json @@ -79,7 +79,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -104,6 +108,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "arn:aws:rds:us-east-1:000000000:cluster:test-cloudtrail-event-instance-31611-cluster" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -177,6 +184,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-instance-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-instance-json.log-expected.json index 7bdd4b2a592..f4a8a255bf0 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-instance-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-db-instance-json.log-expected.json @@ -149,7 +149,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "rds" + } }, "ecs": { "version": "8.11.0" @@ -182,6 +186,9 @@ "ACCESSKEYID", "subnet-fee506df" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -255,6 +262,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json index f2db2cf4ecd..96207b49291 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-stop-logging-json.log-expected.json @@ -38,7 +38,11 @@ "account": { "id": "0123456789012" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -62,6 +66,9 @@ "arn:aws:cloudtrail:us-west-2:0123456789012:trail/TEST-trail", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-subscribe-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-subscribe-json.log-expected.json index 6148cece34d..6bc0f7c4a37 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-subscribe-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-subscribe-json.log-expected.json @@ -41,7 +41,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "sns" + } }, "ecs": { "version": "8.11.0" @@ -75,6 +79,9 @@ "arn:aws:iam::00000000000:user/pwncloud-backdoor-user", "arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "pwncloud-backdoor-user" @@ -141,6 +148,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-instances-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-instances-json.log-expected.json index 6943aec055b..195d8386867 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-instances-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-instances-json.log-expected.json @@ -61,7 +61,11 @@ "account": { "id": "111111111111" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "ec2" + } }, "ecs": { "version": "8.11.0" @@ -85,6 +89,12 @@ "arn:aws:iam::111111111111:user/services/example", "example" ], + "hosts": [ + "i-00000000000000000" + ], + "ip": [ + "127.0.0.1" + ], "user": [ "AAAAAAAAAAAAAAAAAAAAA", "example" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-session-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-session-json.log-expected.json index ecd34028dbc..c189bfd9d14 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-session-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-terminate-session-json.log-expected.json @@ -43,7 +43,11 @@ "account": { "id": "00000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -76,6 +80,9 @@ "ACCESSKEY", "root-5hvouhyykagjjk3f6glxk8o6bu" ], + "ip": [ + "216.160.83.56" + ], "user": [ "00000000000" ] @@ -142,6 +149,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json index 173adb2394c..b78e0dac90b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json @@ -49,7 +49,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -72,6 +76,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Alice", "EXAMPLE_ID" @@ -165,7 +172,11 @@ "account": { "id": "0011223344" }, - "region": "eu-west-1" + "provider": "aws", + "region": "eu-west-1", + "service": { + "name": "grafana" + } }, "ecs": { "version": "8.11.0" @@ -186,6 +197,9 @@ "entity": [ "some.user@example.com" ], + "ip": [ + "127.0.0.1" + ], "user": [ "some.user@example.com" ] @@ -268,7 +282,11 @@ "account": { "id": "001122334455" }, - "region": "eu-west-1" + "provider": "aws", + "region": "eu-west-1", + "service": { + "name": "s3express" + } }, "ecs": { "version": "8.11.0" @@ -292,10 +310,14 @@ "Some_AWS_Role", "arn:aws:sts::001122334455:assumed-role/Some_AWS_Role/some.user@example.com" ], + "ip": [ + "127.0.0.1" + ], "user": [ + "some.user@example.com", + "some.user", "REDACTED:some.user@example.com", - "Some_AWS_Role", - "some.user@example.com" + "Some_AWS_Role" ] }, "source": { @@ -314,9 +336,7 @@ "version": "1.3" }, "user": { - "changes": { - "name": "some.user@example.com" - }, + "email": "some.user@example.com", "entity": { "id": [ "arn:aws:sts::001122334455:assumed-role/Some_AWS_Role/some.user@example.com" @@ -341,6 +361,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json index de4f8635c0d..580aa12bb99 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-access-key-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json index 884e636f005..5a5f5b617bd 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-accout-password-policy-json.log-expected.json @@ -42,7 +42,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -69,6 +73,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-assume-role-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-assume-role-policy-json.log-expected.json index ceed1b89aff..9dbed620db9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-assume-role-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-assume-role-policy-json.log-expected.json @@ -35,7 +35,11 @@ "account": { "id": "000000000" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -66,6 +70,9 @@ "arn:aws:iam::000000000:user/test@elastic.co", "cloudtrail-role" ], + "ip": [ + "216.160.83.56" + ], "user": [ "PRINCIPALID", "test@elastic.co" @@ -130,6 +137,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json index f8c7ab3cc58..a463258e858 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-group-json.log-expected.json @@ -33,7 +33,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -63,6 +67,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -129,7 +136,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -159,6 +170,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "0123456789012", "Alice" @@ -223,7 +237,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -251,6 +269,9 @@ "entity": [ "arn:aws:iam::0123456789012:user/Alice", "EXAMPLE_KEY" + ], + "ip": [ + "127.0.0.1" ] }, "source": { @@ -312,7 +333,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -340,6 +365,9 @@ "entity": [ "arn:aws:iam::0123456789012:user/Alice", "EXAMPLE_KEY" + ], + "ip": [ + "127.0.0.1" ] }, "source": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-lambda-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-lambda-json.log-expected.json index 5c971d58300..762470fcfd2 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-lambda-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-lambda-json.log-expected.json @@ -2,6 +2,30 @@ "expected": [ { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "aws": { + "cloudtrail": { + "flattened": { + "response_elements": { + "vpcConfig": { + "securityGroupIds": [ + "sg-test" + ], + "subnetIds": [ + "subnet-test1", + "subnet-test2" + ] + } + } + }, + "response_elements": "{vpcConfig={securityGroupIds=[sg-test], subnetIds=[subnet-test1, subnet-test2]}}" + } + }, + "cloud": { + "provider": "aws", + "service": { + "name": "lambda" + } + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-login-profile-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-login-profile-json.log-expected.json index e0b9957082e..846e4c2279a 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-login-profile-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-login-profile-json.log-expected.json @@ -37,7 +37,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -65,6 +69,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-ssh-public-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-ssh-public-key-json.log-expected.json index d8207c8dd1f..d28e5dca3bc 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-ssh-public-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-ssh-public-key-json.log-expected.json @@ -39,7 +39,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -67,6 +71,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", @@ -140,7 +147,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -168,6 +179,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "EXAMPLE_ID", diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-trail-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-trail-json.log-expected.json index 7247b59ac4a..0c7548cf366 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-trail-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-trail-json.log-expected.json @@ -34,7 +34,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -58,6 +62,9 @@ "myTrail2", "Alice" ], + "ip": [ + "89.160.20.156" + ], "user": [ "EX_PRINCIPAL_ID", "Alice" @@ -161,7 +168,11 @@ "account": { "id": "0123456789012" }, - "region": "us-west-2" + "provider": "aws", + "region": "us-west-2", + "service": { + "name": "cloudtrail" + } }, "ecs": { "version": "8.11.0" @@ -187,6 +198,9 @@ "arn:aws:iam::0123456789012:user/Alice", "test-cloudtrail-bucket" ], + "ip": [ + "127.0.0.1" + ], "user": [ "EXAMPLE_ID", "Alice" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-user-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-user-json.log-expected.json index 4f05bde42e3..28010cd58f3 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-user-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-update-user-json.log-expected.json @@ -33,7 +33,11 @@ "account": { "id": "123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -61,6 +65,9 @@ "EXAMPLE_KEY_ID", "Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Bob", "Robert", @@ -102,6 +109,9 @@ }, { "@timestamp": "2021-11-11T01:02:03.123456789Z", + "cloud": { + "provider": "aws" + }, "ecs": { "version": "8.11.0" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-expected.json index fc7b2d34f9d..654989a6a35 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-flattened.log-expected.json @@ -47,7 +47,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -70,6 +74,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Alice", "EXAMPLE_ID" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log-expected.json index 48f1be7d964..8aa92e7a87e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-keyword.log-expected.json @@ -33,7 +33,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -56,6 +60,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Alice", "EXAMPLE_ID" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log new file mode 100644 index 00000000000..0db4791855b --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log @@ -0,0 +1 @@ +{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"EXAMPLE_ID","arn":"arn:aws:iam::0123456789012:user/Alice","accountId":"0123456789012","accessKeyId":"EXAMPLE_KEY","userName":"Alice","sessionContext":{"attributes":{"mfaAuthenticated":"true","creationDate":"2020-01-10T14:38:30Z"}},"invokedBy":"signin.amazonaws.com"},"eventTime":"2020-01-10T16:06:40Z","eventSource":"iam.amazonaws.com","eventName":"UploadSSHPublicKey","awsRegion":"us-east-1","sourceIPAddress":"127.0.0.1","userAgent":"signin.amazonaws.com","requestParameters":{"sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain","userName":"Alice"},"responseElements":{"sSHPublicKey":{"fingerprint":"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de","status":"Active","uploadDate":"Jan 10, 2020 4:06:40 PM","userName":"Alice","sSHPublicKeyId":"EXAMPLE_KEY_ID","sSHPublicKeyBody":"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain"}},"requestID":"EXAMPLE-44b9-41cd-90f2-EXAMPLE","eventID":"EXAMPLE-9a9d-4da4-9998-EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"0123456789012"} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-config.yml b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-config.yml new file mode 100644 index 00000000000..d832521389d --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-config.yml @@ -0,0 +1,13 @@ +dynamic_fields: + # This can be removed after ES 8.16.2 is set as the minimum version supported in the manifest. + # Once removed, it requires to update pipeline tests to remove the trailing dot where required. + # Relates: https://github.com/elastic/elasticsearch/pull/117213 + "user_agent.version": '^\d+\.\d+(\.|\..*)?$' +fields: + # Simulate @timestamp value from Filebeat. + '@timestamp': '2021-11-11T01:02:03.123456789Z' + tags: + - preserve_original_event + - actor_target_mapping + _conf: + retain: none diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-expected.json new file mode 100644 index 00000000000..59eed5946f0 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json-none.log-expected.json @@ -0,0 +1,98 @@ +{ + "expected": [ + { + "@timestamp": "2020-01-10T16:06:40.000Z", + "actor": { + "entity": { + "id": [ + "arn:aws:iam::0123456789012:user/Alice" + ] + } + }, + "aws": { + "cloudtrail": { + "event_type": "AwsApiCall", + "event_version": "1.05", + "recipient_account_id": "0123456789012", + "request_id": "EXAMPLE-44b9-41cd-90f2-EXAMPLE", + "user_identity": { + "access_key_id": "EXAMPLE_KEY", + "arn": "arn:aws:iam::0123456789012:user/Alice", + "invoked_by": "signin.amazonaws.com", + "session_context": { + "creation_date": "2020-01-10T14:38:30.000Z", + "mfa_authenticated": "true" + }, + "type": "IAMUser" + } + } + }, + "cloud": { + "account": { + "id": "0123456789012" + }, + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "UploadSSHPublicKey", + "created": "2021-11-11T01:02:03.123456789Z", + "id": "EXAMPLE-9a9d-4da4-9998-EXAMPLE", + "kind": "event", + "original": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"EXAMPLE_ID\",\"arn\":\"arn:aws:iam::0123456789012:user/Alice\",\"accountId\":\"0123456789012\",\"accessKeyId\":\"EXAMPLE_KEY\",\"userName\":\"Alice\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"true\",\"creationDate\":\"2020-01-10T14:38:30Z\"}},\"invokedBy\":\"signin.amazonaws.com\"},\"eventTime\":\"2020-01-10T16:06:40Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"UploadSSHPublicKey\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"signin.amazonaws.com\",\"requestParameters\":{\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\",\"userName\":\"Alice\"},\"responseElements\":{\"sSHPublicKey\":{\"fingerprint\":\"de:ad:c0:de:de:ad:c0:de:de:ad:c0:de:de:ad:c0:de\",\"status\":\"Active\",\"uploadDate\":\"Jan 10, 2020 4:06:40 PM\",\"userName\":\"Alice\",\"sSHPublicKeyId\":\"EXAMPLE_KEY_ID\",\"sSHPublicKeyBody\":\"ssh-rsa AAAAdeadcodedeadcode Alice@localhost.domain\"}},\"requestID\":\"EXAMPLE-44b9-41cd-90f2-EXAMPLE\",\"eventID\":\"EXAMPLE-9a9d-4da4-9998-EXAMPLE\",\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"0123456789012\"}", + "outcome": "success", + "provider": "iam.amazonaws.com", + "type": [ + "info" + ] + }, + "related": { + "entity": [ + "EXAMPLE_KEY", + "Alice", + "arn:aws:iam::0123456789012:user/Alice" + ], + "ip": [ + "127.0.0.1" + ], + "user": [ + "Alice", + "EXAMPLE_ID" + ] + }, + "source": { + "address": "127.0.0.1", + "ip": "127.0.0.1" + }, + "tags": [ + "preserve_original_event", + "actor_target_mapping" + ], + "user": { + "entity": { + "id": [ + "arn:aws:iam::0123456789012:user/Alice" + ] + }, + "id": "EXAMPLE_ID", + "name": "Alice", + "target": { + "name": "Alice" + } + }, + "user_agent": { + "device": { + "name": "Other" + }, + "name": "Other", + "original": "signin.amazonaws.com" + } + } + ] +} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json.log-expected.json index 13beb419285..793b0638b79 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-upload-ssh-public-key-json.log-expected.json @@ -49,7 +49,11 @@ "account": { "id": "0123456789012" }, - "region": "us-east-1" + "provider": "aws", + "region": "us-east-1", + "service": { + "name": "iam" + } }, "ecs": { "version": "8.11.0" @@ -72,6 +76,9 @@ "Alice", "arn:aws:iam::0123456789012:user/Alice" ], + "ip": [ + "127.0.0.1" + ], "user": [ "Alice", "EXAMPLE_ID" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json index 3ae40ac25f3..98d874fddf8 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json @@ -40,6 +40,7 @@ "arn": "arn:aws-us-gov:sts::111111111111:assumed-role/ExampleRole/i-example1234567890", "session_context": { "creation_date": "2026-01-05T17:53:33.000Z", + "ec2_role_delivery": "2.0", "mfa_authenticated": "false", "session_issuer": { "account_id": "111111111111", @@ -56,7 +57,11 @@ "account": { "id": "111111111111" }, - "region": "us-gov-east-1" + "provider": "aws", + "region": "us-gov-east-1", + "service": { + "name": "ssm" + } }, "ecs": { "version": "8.11.0" @@ -80,10 +85,17 @@ "arn:aws-us-gov:sts::111111111111:assumed-role/ExampleRole/i-example1234567890", "arn:aws-us-gov:iam::111111111111:role/ExampleRole" ], + "hosts": [ + "example-host.example.com", + "i-example1234567890" + ], + "ip": [ + "81.2.69.144" + ], "user": [ + "i-example1234567890", "AROAEXAMPLE:i-example1234567890", - "ExampleRole", - "i-example1234567890" + "ExampleRole" ] }, "source": { @@ -115,9 +127,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-example1234567890" - }, "entity": { "id": [ "arn:aws-us-gov:sts::111111111111:assumed-role/ExampleRole/i-example1234567890" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json index 703f0561940..06bbe78ae49 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json @@ -30,6 +30,11 @@ "request_id": "redacted", "service_event_details": "{UserAuthentication=Success}", "user_identity": { + "credential_id": "redacted", + "on_behalf_of": { + "identity_store_arn": "arn:aws:identitystore::redacted:identitystore/redacted", + "user_id": "redacted" + }, "type": "IdentityCenterUser" } } @@ -38,7 +43,11 @@ "account": { "id": "redacted" }, - "region": "us-east-2" + "provider": "aws", + "region": "us-east-2", + "service": { + "name": "signin" + } }, "ecs": { "version": "8.11.0" diff --git a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml index 4b66511f2b8..127f1d032c2 100644 --- a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml @@ -30,11 +30,20 @@ processors: tag: date_json_eventTime_to_timestamp_e9417ba3 field: json.eventTime target_field: "@timestamp" - ignore_failure: true formats: - ISO8601 + if: ctx.json?.eventTime != null && ctx.json.eventTime != '' + on_failure: + - remove: + tag: remove_json_eventTime_e9417ba3 + field: json.eventTime + ignore_missing: true + - append: + tag: append_error_message_e9417ba3 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - script: - tag: remove-nulls + tag: script_remove_nulls_before_renames lang: painless description: This script processor iterates over the whole document to remove fields with null values. source: | @@ -58,12 +67,19 @@ processors: return v == null || v == '' || v == '-' || v == 'none' || (v instanceof Map && v.size() == 0) || (v instanceof List && v.size() == 0) }); } + // _conf holds the retain setting, not event data, and 'none' is one of its + // valid values. Walking it would delete the setting and leave the rest of the + // pipeline treating retain as unconfigured, which means 'all'. + def conf = ctx.remove('_conf'); handleMap(ctx); + if (conf != null) { + ctx._conf = conf; + } # Before renames because some json fields are mutated on the process - script: description: Appends any relevant entity to `related.entity` for all events lang: painless - tag: script_append_related_entity + tag: script_append_related_entity_31dc3369 if: ctx.json?.eventName != null && ctx.tags != null && ctx.tags.contains('actor_target_mapping') params: # Static resource type classifications (evaluated once at pipeline compilation) @@ -140,14 +156,10 @@ processors: field: tags value: preserve_original_event allow_duplicates: false - - set: - tag: set_error_message_10fabed8 - description: Add error reason + - append: + tag: append_error_message_10fabed8 field: error.message - value: | - Processor '{{{ _ingest.on_failure_processor_type }}}' - {{#_ingest.on_failure_processor_tag}}with tag '{{{ _ingest.on_failure_processor_tag }}}' - {{/_ingest.on_failure_processor_tag}}failed with message '{{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' source: | void addFields(Set entities, List fields) { for (String field : fields) { @@ -1021,54 +1033,68 @@ processors: tag: rename_json_eventVersion_to_aws_cloudtrail_event_version_6f418145 field: json.eventVersion target_field: aws.cloudtrail.event_version - ignore_failure: true + ignore_missing: true - rename: field: json.userIdentity.type target_field: aws.cloudtrail.user_identity.type ignore_missing: true - tag: rename_user_identity_type + tag: rename_user_identity_type_122d0a3c - rename: field: json.userIdentity.userName target_field: user.name ignore_missing: true - tag: rename_user_identity_user_name_iam_user + tag: rename_user_identity_user_name_iam_user_c30a296d - rename: field: json.userIdentity.principalId target_field: user.id ignore_missing: true - tag: rename_user_identity_principal_id + tag: rename_user_identity_principal_id_1f790b6f - rename: tag: rename_json_userIdentity_arn_to_aws_cloudtrail_user_identity_arn_02745565 field: json.userIdentity.arn target_field: aws.cloudtrail.user_identity.arn - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_userIdentity_accountId_to_cloud_account_id_3b445356 field: json.userIdentity.accountId target_field: cloud.account.id - ignore_failure: true + ignore_missing: true + if: ctx.cloud?.account?.id == null - rename: tag: rename_json_userIdentity_accessKeyId_to_aws_cloudtrail_user_identity_access_key_id_066b3e77 field: json.userIdentity.accessKeyId target_field: aws.cloudtrail.user_identity.access_key_id - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_userIdentity_sessionContext_attributes_mfaAuthenticated_to_aws_cloudtrail_user_identity_session_context_mfa_authenticated_2c5df2fe field: json.userIdentity.sessionContext.attributes.mfaAuthenticated target_field: aws.cloudtrail.user_identity.session_context.mfa_authenticated - ignore_failure: true + ignore_missing: true - date: tag: date_json_userIdentity_sessionContext_attributes_creationDate_to_aws_cloudtrail_user_identity_session_context_creation_date_7cf57f10 field: json.userIdentity.sessionContext.attributes.creationDate target_field: aws.cloudtrail.user_identity.session_context.creation_date - ignore_failure: true formats: - ISO8601 + - basic_date_time_no_millis + - basic_date_time + if: >- + ctx.json?.userIdentity?.sessionContext?.attributes?.creationDate != null && + ctx.json.userIdentity.sessionContext.attributes.creationDate != '' + on_failure: + - remove: + tag: remove_json_creationDate_7cf57f10 + field: json.userIdentity.sessionContext.attributes.creationDate + ignore_missing: true + - append: + tag: append_error_message_7cf57f10 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: tag: rename_json_userIdentity_sessionContext_sessionIssuer_type_to_aws_cloudtrail_user_identity_session_context_session_issuer_type_7b65c83f field: json.userIdentity.sessionContext.sessionIssuer.type target_field: aws.cloudtrail.user_identity.session_context.session_issuer.type - ignore_failure: true + ignore_missing: true # userIdentity.sessionIssuer.userName is only set with assumed roles. - rename: field: json.userIdentity.sessionContext.sessionIssuer.userName @@ -1076,68 +1102,195 @@ processors: ignore_missing: true override: true if: ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' || ctx.aws?.cloudtrail?.user_identity?.type == 'FederatedUser' - tag: rename_user_name_assumed_role + tag: rename_user_name_assumed_role_b771e356 - rename: tag: rename_json_userIdentity_sessionContext_sessionIssuer_principalId_to_aws_cloudtrail_user_identity_session_context_session_issuer_principal_id_9cb05993 field: json.userIdentity.sessionContext.sessionIssuer.principalId target_field: aws.cloudtrail.user_identity.session_context.session_issuer.principal_id ignore_missing: true - ignore_failure: true + # Extract the session name from the ARN into a scratch field. The session name + # is an actor label, not a user-account modification, so it must not go into + # user.changes.* (ECS defines that fieldset for modifications made to a user + # account during the event). It is added to related.user for cross-source + # correlation. When it is an email (SSO/Identity Center), both the full email + # and the local-part prefix are added so it correlates with sources that store + # only the short username. user.name is left as the IAM role name. (issue #18346) - grok: field: aws.cloudtrail.user_identity.arn patterns: - - "arn:(aws|aws-us-gov):sts:.*/%{GREEDYDATA:user.changes.name}$" + - '^arn:[a-z0-9-]+:sts:.*/%{GREEDYDATA:_tmp.session_name}$' + ignore_missing: true + if: >- + (ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' || + ctx.aws?.cloudtrail?.user_identity?.type == 'FederatedUser' || + ctx.aws?.cloudtrail?.user_identity?.type == 'IdentityCenterUser') && + ctx.aws.cloudtrail.user_identity.arn != null && + ctx.aws.cloudtrail.user_identity.arn.contains(':sts:') && + ctx.aws.cloudtrail.user_identity.arn.contains('/') + tag: extract_session_name_from_arn + on_failure: + - append: + tag: append_error_message_extract_session_name_from_arn + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - append: + tag: append_related_user_session_name_ad00fb8e + field: related.user + value: '{{{_tmp.session_name}}}' + if: ctx._tmp?.session_name != null + allow_duplicates: false + - dissect: + tag: extract_session_name_email_prefix_453956b3 + field: _tmp.session_name + pattern: '%{_tmp.session_name_prefix}@%{}' + if: ctx._tmp?.session_name != null && ctx._tmp.session_name.contains('@') + - append: + tag: append_related_user_session_name_prefix_b21bdeb0 + field: related.user + value: '{{{_tmp.session_name_prefix}}}' + if: ctx._tmp?.session_name_prefix != null + allow_duplicates: false + - set: + tag: set_user_email_from_session_name_39bbd1e6 + field: user.email + copy_from: _tmp.session_name + if: ctx.user?.email == null && ctx._tmp?.session_name_prefix != null + ignore_empty_value: true + - set: + tag: set_aws_cloudtrail_user_identity_on_behalf_of_user_id_7d2af063 + field: aws.cloudtrail.user_identity.on_behalf_of.user_id + copy_from: json.userIdentity.onBehalfOf.userId + ignore_empty_value: true + - rename: + tag: rename_json_userIdentity_onBehalfOf_identityStoreArn_to_aws_cloudtrail_user_identity_on_behalf_of_identity_store_arn_1f9c4b70 + field: json.userIdentity.onBehalfOf.identityStoreArn + target_field: aws.cloudtrail.user_identity.on_behalf_of.identity_store_arn ignore_missing: true - if: (ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' || ctx.aws?.cloudtrail?.user_identity?.type == 'FederatedUser') && ctx.aws?.cloudtrail?.user_identity?.arn != null - tag: extract_user_name_from_arn - rename: field: json.userIdentity.onBehalfOf.userId target_field: user.id ignore_missing: true if: ctx.aws?.cloudtrail?.user_identity?.type == 'IdentityCenterUser' && ctx.user?.id == null - tag: rename_user_id_identity_center_user + tag: rename_user_id_identity_center_user_a2cfa5f2 - rename: tag: rename_json_userIdentity_sessionContext_sessionIssuer_arn_to_aws_cloudtrail_user_identity_session_context_session_issuer_arn_7ea9b97b field: json.userIdentity.sessionContext.sessionIssuer.arn target_field: aws.cloudtrail.user_identity.session_context.session_issuer.arn - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_userIdentity_sessionContext_sessionIssuer_accountId_to_aws_cloudtrail_user_identity_session_context_session_issuer_account_id_8cbd5a9e field: json.userIdentity.sessionContext.sessionIssuer.accountId target_field: aws.cloudtrail.user_identity.session_context.session_issuer.account_id - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_sessionCredentialFromConsole_to_aws_cloudtrail_session_credential_from_console_6cdda950 field: json.sessionCredentialFromConsole target_field: aws.cloudtrail.session_credential_from_console ignore_missing: true - ignore_failure: true - rename: tag: rename_json_userIdentity_invokedBy_to_aws_cloudtrail_user_identity_invoked_by_0bc27c76 field: json.userIdentity.invokedBy target_field: aws.cloudtrail.user_identity.invoked_by - ignore_failure: true + ignore_missing: true + - rename: + tag: rename_json_userIdentity_invokedByDelegate_accountId_to_aws_cloudtrail_user_identity_invoked_by_delegate_account_id_5a71e3b4 + field: json.userIdentity.invokedByDelegate.accountId + target_field: aws.cloudtrail.user_identity.invoked_by_delegate.account_id + ignore_missing: true + - rename: + tag: rename_json_userIdentity_credentialId_to_aws_cloudtrail_user_identity_credential_id_c8f40d29 + field: json.userIdentity.credentialId + target_field: aws.cloudtrail.user_identity.credential_id + ignore_missing: true + - rename: + tag: rename_json_userIdentity_identityProvider_to_aws_cloudtrail_user_identity_identity_provider_9e3a6b15 + field: json.userIdentity.identityProvider + target_field: aws.cloudtrail.user_identity.identity_provider + ignore_missing: true + - rename: + tag: rename_json_userIdentity_inScopeOf_issuerType_to_aws_cloudtrail_user_identity_in_scope_of_issuer_type_2d7c8f60 + field: json.userIdentity.inScopeOf.issuerType + target_field: aws.cloudtrail.user_identity.in_scope_of.issuer_type + ignore_missing: true + - rename: + tag: rename_json_userIdentity_inScopeOf_credentialsIssuedTo_to_aws_cloudtrail_user_identity_in_scope_of_credentials_issued_to_71b4e0a3 + field: json.userIdentity.inScopeOf.credentialsIssuedTo + target_field: aws.cloudtrail.user_identity.in_scope_of.credentials_issued_to + ignore_missing: true + - rename: + tag: rename_json_userIdentity_inScopeOf_sourceArn_to_aws_cloudtrail_user_identity_in_scope_of_source_arn_0c5fd812 + field: json.userIdentity.inScopeOf.sourceArn + target_field: aws.cloudtrail.user_identity.in_scope_of.source_arn + ignore_missing: true + - rename: + tag: rename_json_userIdentity_inScopeOf_sourceAccount_to_aws_cloudtrail_user_identity_in_scope_of_source_account_e6a29b47 + field: json.userIdentity.inScopeOf.sourceAccount + target_field: aws.cloudtrail.user_identity.in_scope_of.source_account + ignore_missing: true + - rename: + tag: rename_json_userIdentity_sessionContext_ec2RoleDelivery_to_aws_cloudtrail_user_identity_session_context_ec2_role_delivery_836bf1da + field: json.userIdentity.sessionContext.ec2RoleDelivery + target_field: aws.cloudtrail.user_identity.session_context.ec2_role_delivery + ignore_missing: true + - rename: + tag: rename_json_userIdentity_sessionContext_sourceIdentity_to_aws_cloudtrail_user_identity_session_context_source_identity_4b1e7c95 + field: json.userIdentity.sessionContext.sourceIdentity + target_field: aws.cloudtrail.user_identity.session_context.source_identity + ignore_missing: true + - rename: + tag: rename_json_userIdentity_sessionContext_webIdFederationData_federatedProvider_to_aws_cloudtrail_user_identity_session_context_web_id_federation_data_federated_provider_a05d3e28 + field: json.userIdentity.sessionContext.webIdFederationData.federatedProvider + target_field: aws.cloudtrail.user_identity.session_context.web_id_federation_data.federated_provider + ignore_missing: true + # The keys under webIdFederationData.attributes are named by the identity + # provider, so the object is stored whole rather than field by field. + - rename: + tag: rename_json_userIdentity_sessionContext_webIdFederationData_attributes_to_aws_cloudtrail_user_identity_session_context_web_id_federation_data_attributes_6e4a91cb + field: json.userIdentity.sessionContext.webIdFederationData.attributes + target_field: aws.cloudtrail.user_identity.session_context.web_id_federation_data.attributes + ignore_missing: true + - rename: + tag: rename_json_userIdentity_sessionContext_assumedRoot_to_aws_cloudtrail_user_identity_session_context_assumed_root_d38f0c72 + field: json.userIdentity.sessionContext.assumedRoot + target_field: aws.cloudtrail.user_identity.session_context.assumed_root + ignore_missing: true + - rename: + tag: rename_json_userIdentity_sessionContext_signInSessionArn_to_aws_cloudtrail_user_identity_session_context_sign_in_session_arn_2b7de5a4 + field: json.userIdentity.sessionContext.signInSessionArn + target_field: aws.cloudtrail.user_identity.session_context.sign_in_session_arn + ignore_missing: true + - dissect: + tag: dissect_json_eventSource_to_cloud_service_name_5d2b7c94 + field: json.eventSource + pattern: '%{cloud.service.name}.amazonaws.com' + if: >- + ctx.cloud?.service?.name == null && ctx.json?.eventSource != null && + ctx.json.eventSource.endsWith('.amazonaws.com') - rename: tag: rename_json_eventSource_to_event_provider_4648c27c field: json.eventSource target_field: event.provider - ignore_failure: true + ignore_missing: true + if: ctx.event?.provider == null - set: tag: set_event_action_c4f8aee8 field: event.action value: '{{{json.eventName}}}' - ignore_failure: true ignore_empty_value: true - rename: tag: rename_json_eventCategory_to_aws_cloudtrail_event_category_14bbb655 field: json.eventCategory target_field: aws.cloudtrail.event_category - ignore_failure: true + ignore_missing: true - rename: field: json.additionalEventData.UserName - tag: rename_additionalEventData_UserName_to_username + tag: rename_additionalEventData_UserName_to_username_552c89e0 target_field: user.name if: ctx.event?.action == 'UserAuthentication' && ctx.user?.name == null && ctx.json?.additionalEventData?.UserName != null + - set: + tag: set_cloud_provider_aws_8f31c0e6 + field: cloud.provider + value: aws - set: tag: set_cloud_region_5d7559a1 field: cloud.region @@ -1147,18 +1300,21 @@ processors: tag: rename_json_sourceIPAddress_to_source_address_03dee86f field: json.sourceIPAddress target_field: source.address - ignore_failure: true - - grok: - tag: grok_source_address_146128d9 + ignore_missing: true + if: ctx.source?.address == null + # CloudTrail reports sourceIPAddress as a service DNS name (`config.amazonaws.com`) or + # `AWS Internal` for service-initiated calls, so conversion failure is expected and not an + # error: the original value is always retained in source.address. + - convert: field: source.address + target_field: source.ip + tag: convert_source_address_to_source_ip + type: ip ignore_failure: true - patterns: - - ^%{IP:source.ip}$ - geoip: tag: geoip_source_ip_to_source_geo_253d8f4f field: source.ip target_field: source.geo - ignore_failure: true ignore_missing: true - geoip: tag: geoip_source_ip_to_source_as_28d69883 @@ -1183,46 +1339,41 @@ processors: tag: user_agent_json_userAgent_to_user_agent_12c778f0 field: json.userAgent target_field: user_agent - on_failure: - - rename: - tag: rename_json_userAgent_to_user_agent_original_638aaaff - field: json.userAgent - target_field: user_agent.original - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_errorCode_to_aws_cloudtrail_error_code_f6ce7f43 field: json.errorCode target_field: aws.cloudtrail.error_code - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_errorMessage_to_aws_cloudtrail_error_message_4764ab25 field: json.errorMessage target_field: aws.cloudtrail.error_message - ignore_failure: true - - script: - lang: painless - tag: script_cache_flattened_duplicates_configuration - source: |- - ctx._conf = ctx._conf ?: [:]; - ctx._conf.keep_flattened_duplicates = ctx._conf.retain == null || - ctx._conf.retain.contains('all') || - ctx._conf.retain.contains('flattened') || - ctx._conf.retain.contains('minimal'); + ignore_missing: true - script: description: > - Set values in aws.cloudtrail.request_parameters, aws.cloudtrail.response_elements, and - aws.cloudtrail.additional_eventdata. If _conf.keep_flattened_duplicates is true, also - copy into aws.cloudtrail.flattened. Since aws.cloudtrail.flattened is optionally present, - is MUST NEVER be used as an RHS in any processor. + Resolve _conf.keep_flattened_duplicates from the retain setting, then set values in + aws.cloudtrail.request_parameters, aws.cloudtrail.response_elements, + aws.cloudtrail.additional_eventdata and aws.cloudtrail.service_event_details. If + _conf.keep_flattened_duplicates is true, also copy into aws.cloudtrail.flattened. Since + aws.cloudtrail.flattened is optionally present, it MUST NEVER be used as an RHS in any + processor. Assignments of json.requestParameters, json.responseElements, json.additionalEventData and json.serviceEventDetails to the corresponding flattened fields are shallow, so - sub-fields of these field MUST NEVER be renamed or otherwise mutated, that is, they + sub-fields of these fields MUST NEVER be renamed or otherwise mutated, that is, they MUST NEVER be an LHS in any processor. lang: painless tag: script_duplicate_rules_fields source: |- - if (ctx._conf.keep_flattened_duplicates && ctx.aws.cloudtrail?.flattened == null) { - ctx.aws.cloudtrail.flattened = [:]; + ctx._conf = ctx._conf ?: [:]; + ctx._conf.keep_flattened_duplicates = ctx._conf.retain == null || + ctx._conf.retain.contains('all') || + ctx._conf.retain.contains('flattened') || + ctx._conf.retain.contains('minimal'); + ctx.aws = ctx.aws ?: [:]; + ctx.aws.cloudtrail = ctx.aws.cloudtrail ?: [:]; + if (ctx._conf.keep_flattened_duplicates) { + ctx.aws.cloudtrail.flattened = ctx.aws.cloudtrail.flattened ?: [:]; } if (ctx.json?.requestParameters != null) { ctx.aws.cloudtrail.request_parameters = ctx.json.requestParameters.toString(); @@ -1248,119 +1399,162 @@ processors: ctx.aws.cloudtrail.flattened.service_event_details = ctx.json.serviceEventDetails; } } - ignore_failure: true + on_failure: + - append: + tag: append_error_message_duplicate_rules_fields + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: tag: rename_json_requestID_to_aws_cloudtrail_request_id_cc292e2f field: json.requestID target_field: aws.cloudtrail.request_id - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_eventID_to_event_id_f952b9c8 field: json.eventID target_field: event.id - ignore_failure: true + ignore_missing: true + if: ctx.event?.id == null - rename: tag: rename_json_eventType_to_aws_cloudtrail_event_type_8540078d field: json.eventType target_field: aws.cloudtrail.event_type - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_apiVersion_to_aws_cloudtrail_api_version_07d67e45 field: json.apiVersion target_field: aws.cloudtrail.api_version - ignore_failure: true - - script: - tag: script_bb5a6300 - lang: painless - source: | - if (ctx.json?.managementEvent != null) { - ctx.aws.cloudtrail.management_event = String.valueOf(ctx.json.managementEvent); - } - ignore_failure: true + ignore_missing: true + - convert: + tag: convert_json_managementEvent_to_aws_cloudtrail_management_event + field: json.managementEvent + target_field: aws.cloudtrail.management_event + type: string + ignore_missing: true - rename: tag: rename_json_readOnly_to_aws_cloudtrail_read_only_910e0493 field: json.readOnly target_field: aws.cloudtrail.read_only - ignore_failure: true + ignore_missing: true - script: - tag: script_729dd190 - description: 'Drops duplicates where the same combination of ARN, accountId and type is found multiple times in the resources list.' + tag: script_deduplicate_json_resources + description: 'Moves the resources list to aws.cloudtrail.resources, dropping duplicates where the same combination of ARN, accountId and type appears more than once.' lang: painless + if: ctx.json?.resources != null + on_failure: + - append: + tag: append_error_message_deduplicate_json_resources + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' source: > - if (ctx.json?.resources instanceof List) { - def resources = ctx.json.resources; - - Map uniqueResources = [:]; - for (def originalResource : resources) { - if (originalResource instanceof Map) { - Map resource = [:]; - resource.putAll(originalResource); - if (resource.containsKey('ARN')) { - resource.arn = resource.remove('ARN'); - } - if (resource.containsKey('accountId')) { - resource.account_id = resource.remove('accountId'); - } - String key = (resource.containsKey('arn') ? resource.arn : '') + '_' + - (resource.containsKey('account_id') ? resource.account_id : '') + '_' + - (resource.containsKey('type') ? resource.type : ''); - uniqueResources[key] = resource; + def resources = ctx.json.remove('resources'); + ctx.aws = ctx.aws ?: [:]; + ctx.aws.cloudtrail = ctx.aws.cloudtrail ?: [:]; + if (!(resources instanceof List)) { + ctx.aws.cloudtrail.resources = resources; + return; + } + Map uniqueResources = [:]; + for (def originalResource : resources) { + if (originalResource instanceof Map) { + Map resource = [:]; + resource.putAll(originalResource); + if (resource.containsKey('ARN')) { + resource.arn = resource.remove('ARN'); + } + if (resource.containsKey('accountId')) { + resource.account_id = resource.remove('accountId'); } + String key = (resource.containsKey('arn') ? resource.arn : '') + '_' + + (resource.containsKey('account_id') ? resource.account_id : '') + '_' + + (resource.containsKey('type') ? resource.type : ''); + uniqueResources[key] = resource; } - ctx.json.resources = new ArrayList(uniqueResources.values()); } - - rename: - tag: rename_json_resources_to_aws_cloudtrail_resources_ca12a9ee - field: json.resources - target_field: aws.cloudtrail.resources - ignore_failure: true + ctx.aws.cloudtrail.resources = new ArrayList(uniqueResources.values()); - rename: tag: rename_json_recipientAccountId_to_aws_cloudtrail_recipient_account_id_69771ba8 field: json.recipientAccountId target_field: aws.cloudtrail.recipient_account_id - ignore_failure: true + ignore_missing: true - set: tag: set_cloud_account_id_0ab85f1e field: cloud.account.id copy_from: aws.cloudtrail.recipient_account_id override: false ignore_empty_value: true + - rename: + tag: rename_json_sharedEventID_to_aws_cloudtrail_shared_event_id_b3d0c1a7 + field: json.sharedEventID + target_field: aws.cloudtrail.shared_event_id + ignore_missing: true - rename: tag: rename_json_sharedEventId_to_aws_cloudtrail_shared_event_id_593eca9a field: json.sharedEventId target_field: aws.cloudtrail.shared_event_id - ignore_failure: true + ignore_missing: true + if: ctx.aws?.cloudtrail?.shared_event_id == null - rename: tag: rename_json_vpcEndpointId_to_aws_cloudtrail_vpc_endpoint_id_21ac588e field: json.vpcEndpointId target_field: aws.cloudtrail.vpc_endpoint_id - ignore_failure: true + ignore_missing: true + - rename: + tag: rename_json_vpcEndpointAccountId_to_aws_cloudtrail_vpc_endpoint_account_id_4f2b91ce + field: json.vpcEndpointAccountId + target_field: aws.cloudtrail.vpc_endpoint_account_id + ignore_missing: true + # An addendum is emitted when CloudTrail delivers an event late or corrects a + # previously delivered one, so it explains gaps and restated values. + - rename: + tag: rename_json_addendum_reason_to_aws_cloudtrail_addendum_reason_8b06d5f2 + field: json.addendum.reason + target_field: aws.cloudtrail.addendum.reason + ignore_missing: true + - rename: + tag: rename_json_addendum_updatedFields_to_aws_cloudtrail_addendum_updated_fields_47e1c9a8 + field: json.addendum.updatedFields + target_field: aws.cloudtrail.addendum.updated_fields + ignore_missing: true + - rename: + tag: rename_json_addendum_originalRequestID_to_aws_cloudtrail_addendum_original_request_id_d92f3b05 + field: json.addendum.originalRequestID + target_field: aws.cloudtrail.addendum.original_request_id + ignore_missing: true + - rename: + tag: rename_json_addendum_originalEventID_to_aws_cloudtrail_addendum_original_event_id_6a3ed470 + field: json.addendum.originalEventID + target_field: aws.cloudtrail.addendum.original_event_id + ignore_missing: true - append: tag: append_related_user_0121b806 field: related.user - value: '{{json.requestParameters.userName}}' + value: '{{{json.requestParameters.userName}}}' allow_duplicates: false if: ctx.json?.requestParameters?.userName != null - append: tag: append_related_user_5ff399b8 field: related.user - value: '{{json.requestParameters.newUserName}}' + value: '{{{json.requestParameters.newUserName}}}' allow_duplicates: false if: ctx.json?.requestParameters?.newUserName != null - append: tag: append_related_user_e323b1c9 field: related.user - value: '{{json.responseElements.user.userId}}' + value: '{{{json.responseElements.user.userId}}}' allow_duplicates: false if: ctx.json?.responseElements?.user?.userId != null - script: - tag: script_0221d805 + tag: script_console_login_additional_eventdata + description: Maps the ConsoleLogin additionalEventData entries to aws.cloudtrail.console_login. lang: painless - ignore_failure: true + if: ctx.json?.eventName == 'ConsoleLogin' + on_failure: + - append: + tag: append_error_message_console_login + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' source: >- - if (ctx.json?.eventName != 'ConsoleLogin') { - return; - } Map aed_map = [:]; if (ctx.json?.additionalEventData?.MobileVersion != null) { aed_map.mobile_version = ctx.json.additionalEventData.MobileVersion != 'No'; @@ -1372,12 +1566,20 @@ processors: aed_map.mfa_used = ctx.json.additionalEventData.MFAUsed != 'No'; } if (aed_map.size() > 0) { + ctx.aws = ctx.aws ?: [:]; + ctx.aws.cloudtrail = ctx.aws.cloudtrail ?: [:]; ctx.aws.cloudtrail.console_login = [:]; ctx.aws.cloudtrail.console_login.additional_eventdata = aed_map; } - script: lang: painless - tag: Add ECS categorization + tag: script_add_ecs_categorization + description: Maps the CloudTrail event name to ECS event.kind, event.category, event.type and event.outcome. + on_failure: + - append: + tag: append_error_message_ecs_categorization + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' params: AddUserToGroup: category: @@ -1785,11 +1987,13 @@ processors: Publish: category: - api - type: [] + type: + - info SendCommand: category: - process - type: [] + type: + - start GetPolicy: category: - iam @@ -1813,7 +2017,8 @@ processors: Converse: category: - api - type: [] + type: + - info CreateDocument: category: - file @@ -1878,7 +2083,7 @@ processors: category: - file type: - - delete + - deletion source: >- ctx.event.kind = 'event'; ctx.event.type = ['info']; @@ -1907,88 +2112,143 @@ processors: tag: rename_json_awsAccountId_to_cloud_account_id_8aa111ca field: json.awsAccountId target_field: cloud.account.id - ignore_failure: true + ignore_missing: true + if: ctx.cloud?.account?.id == null - rename: tag: rename_json_digestS3Object_to_file_path_42209760 field: json.digestS3Object target_field: file.path - ignore_failure: true + ignore_missing: true + if: ctx.file?.path == null - rename: - tag: rename_json_previousDigestSignature_to_file_hash_sha256_0cfc4a19 + tag: rename_json_previousDigestS3Object_to_aws_cloudtrail_digest_previous_s3_object_7d2e4a91 + field: json.previousDigestS3Object + target_field: aws.cloudtrail.digest.previous_s3_object + ignore_missing: true + - rename: + tag: rename_json_previousDigestSignature_to_aws_cloudtrail_digest_previous_signature_0cfc4a19 field: json.previousDigestSignature - target_field: file.hash.sha256 - if: >- - ctx.json?.previousDigestHashAlgorithm != null && ctx.json?.previousDigestHashAlgorithm == 'SHA-256' + target_field: aws.cloudtrail.digest.previous_signature + ignore_missing: true + - rename: + tag: rename_json_previousDigestHashValue_to_aws_cloudtrail_digest_previous_hash_value_5c8b1f30 + field: json.previousDigestHashValue + target_field: aws.cloudtrail.digest.previous_hash_value + ignore_missing: true - append: - tag: append_related_hash_7574f0ee + tag: append_related_hash_previous_digest_7574f0ee field: related.hash - value: '{{{file.hash.sha256}}}' - if: ctx.file?.hash?.sha256 != null + value: '{{{aws.cloudtrail.digest.previous_hash_value}}}' + allow_duplicates: false + if: ctx.aws?.cloudtrail?.digest?.previous_hash_value != null - rename: tag: rename_json_logFiles_to_aws_cloudtrail_digest_log_files_84d51ab1 field: json.logFiles target_field: aws.cloudtrail.digest.log_files - ignore_failure: true + ignore_missing: true - date: tag: date_json_digestStartTime_to_aws_cloudtrail_digest_start_time_3c1d2845 field: json.digestStartTime target_field: aws.cloudtrail.digest.start_time - ignore_failure: true - formats: - - ISO8601 - - date: - tag: date_json_digestEndTime_to_timestamp_3953c970 - field: json.digestEndTime - target_field: "@timestamp" - ignore_failure: true formats: - ISO8601 + if: ctx.json?.digestStartTime != null && ctx.json.digestStartTime != '' + on_failure: + - remove: + tag: remove_json_digestStartTime_3c1d2845 + field: json.digestStartTime + ignore_missing: true + - append: + tag: append_error_message_3c1d2845 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: tag: date_json_digestEndTime_to_aws_cloudtrail_digest_end_time_d95ac027 field: json.digestEndTime target_field: aws.cloudtrail.digest.end_time - ignore_failure: true formats: - ISO8601 + if: ctx.json?.digestEndTime != null && ctx.json.digestEndTime != '' + on_failure: + - remove: + tag: remove_json_digestEndTime_d95ac027 + field: json.digestEndTime + ignore_missing: true + - append: + tag: append_error_message_d95ac027 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + # Digest files carry no eventTime. digestEndTime is the digest's own creation + # time: CloudTrail names each digest object after it and chains the next digest + # from it, so it is the correct event time for these records. + - set: + tag: set_timestamp_from_digest_end_time_3953c970 + field: "@timestamp" + copy_from: aws.cloudtrail.digest.end_time + ignore_empty_value: true - rename: tag: rename_json_digestS3Bucket_to_aws_cloudtrail_digest_s3_bucket_91e31365 field: json.digestS3Bucket target_field: aws.cloudtrail.digest.s3_bucket - ignore_failure: true + ignore_missing: true - date: tag: date_json_newestEventTime_to_aws_cloudtrail_digest_newest_event_time_66ba4c38 field: json.newestEventTime target_field: aws.cloudtrail.digest.newest_event_time - ignore_failure: true formats: - ISO8601 + if: ctx.json?.newestEventTime != null && ctx.json.newestEventTime != '' + on_failure: + - remove: + tag: remove_json_newestEventTime_66ba4c38 + field: json.newestEventTime + ignore_missing: true + - append: + tag: append_error_message_66ba4c38 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - date: tag: date_json_oldestEventTime_to_aws_cloudtrail_digest_oldest_event_time_51f01072 field: json.oldestEventTime target_field: aws.cloudtrail.digest.oldest_event_time - ignore_failure: true formats: - ISO8601 + if: ctx.json?.oldestEventTime != null && ctx.json.oldestEventTime != '' + on_failure: + - remove: + tag: remove_json_oldestEventTime_51f01072 + field: json.oldestEventTime + ignore_missing: true + - append: + tag: append_error_message_51f01072 + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' - rename: tag: rename_json_previousDigestS3Bucket_to_aws_cloudtrail_digest_previous_s3_bucket_6835b0bc field: json.previousDigestS3Bucket target_field: aws.cloudtrail.digest.previous_s3_bucket - ignore_failure: true + ignore_missing: true - rename: tag: rename_json_previousDigestHashAlgorithm_to_aws_cloudtrail_digest_previous_hash_algorithm_dd0916ee field: json.previousDigestHashAlgorithm target_field: aws.cloudtrail.digest.previous_hash_algorithm - ignore_failure: true + ignore_missing: true + - rename: + tag: rename_json_digestPublicKeyFingerprint_to_aws_cloudtrail_digest_public_key_fingerprint_4ec7a218 + field: json.digestPublicKeyFingerprint + target_field: aws.cloudtrail.digest.public_key_fingerprint + ignore_missing: true - rename: tag: rename_json_publicKeyFingerprint_to_aws_cloudtrail_digest_public_key_fingerprint_6babc730 field: json.publicKeyFingerprint target_field: aws.cloudtrail.digest.public_key_fingerprint - ignore_failure: true + ignore_missing: true + if: ctx.aws?.cloudtrail?.digest?.public_key_fingerprint == null - rename: tag: rename_json_digestSignatureAlgorithm_to_aws_cloudtrail_digest_signature_algorithm_71bf5c31 field: json.digestSignatureAlgorithm target_field: aws.cloudtrail.digest.signature_algorithm - ignore_failure: true + ignore_missing: true - set: tag: set_group_id_984fd6e8 field: group.id @@ -2014,13 +2274,6 @@ processors: field: user.target.name copy_from: json.requestParameters.userName ignore_empty_value: true - - remove: - tag: remove_27608874 - field: - - aws.cloudtrail.digest - - json.insightDetails - if: '!ctx._conf.keep_flattened_duplicates' - ignore_missing: true - rename: tag: rename_aws_cloudtrail_digest_to_aws_cloudtrail_flattened_digest_6c535acf field: aws.cloudtrail.digest @@ -2059,11 +2312,16 @@ processors: field: json.tlsDetails.clientProvidedHostHeader target_field: tls.client.server_name ignore_missing: true + - rename: + tag: rename_json_tlsDetails_keyExchange_to_aws_cloudtrail_tls_details_key_exchange_3ce8a4d1 + field: json.tlsDetails.keyExchange + target_field: aws.cloudtrail.tls_details.key_exchange + ignore_missing: true # Standardize user fields - set: field: user.email copy_from: user.name - tag: set_user_email + tag: set_user_email_d6b77481 if: ctx.user?.email == null && ctx.user?.name != null && ctx.user.name.indexOf("@") > 0 # Don't dissect the user email into @ # as the parts are meaningless on their own @@ -2073,14 +2331,12 @@ processors: value: '{{{user.id}}}' if: ctx.user?.id != null allow_duplicates: false - ignore_failure: true - append: tag: append_related_user_3b423052 field: related.user value: '{{{user.name}}}' if: ctx.user?.name != null allow_duplicates: false - ignore_failure: true - append: tag: append_related_user_25fd8c1b @@ -2088,7 +2344,133 @@ processors: value: '{{{user.changes.name}}}' if: ctx.user?.changes?.name != null allow_duplicates: false - ignore_failure: true + + - append: + tag: append_related_user_on_behalf_of_user_id + field: related.user + value: '{{{aws.cloudtrail.user_identity.on_behalf_of.user_id}}}' + if: ctx.aws?.cloudtrail?.user_identity?.on_behalf_of?.user_id != null + allow_duplicates: false + - append: + tag: append_related_ip_source_ip + field: related.ip + value: '{{{source.ip}}}' + if: ctx.source?.ip != null + allow_duplicates: false + - convert: + tag: convert_json_serviceEventDetails_sourceIpAddress_to_tmp_service_event_ip + field: json.serviceEventDetails.sourceIpAddress + target_field: _tmp.service_event_ip + type: ip + ignore_missing: true + on_failure: + - remove: + tag: remove_tmp_service_event_ip + field: _tmp.service_event_ip + ignore_missing: true + - append: + tag: append_related_ip_service_event_source_ip + field: related.ip + value: '{{{_tmp.service_event_ip}}}' + if: ctx._tmp?.service_event_ip != null + allow_duplicates: false + - append: + tag: append_related_hosts_tls_client_server_name + field: related.hosts + value: '{{{tls.client.server_name}}}' + if: >- + ctx.tls?.client?.server_name != null && + !ctx.tls.client.server_name.endsWith('.amazonaws.com') + allow_duplicates: false + # The value can also be the literal `AWS Internal`, which is not a host. + - append: + tag: append_related_hosts_source_address + field: related.hosts + value: '{{{source.address}}}' + if: >- + ctx.source?.ip == null && ctx.source?.address != null && + ctx.source.address.contains('.') && !ctx.source.address.contains(' ') && + !ctx.source.address.endsWith('.amazonaws.com') + allow_duplicates: false + - append: + tag: append_related_hosts_computer_name + field: related.hosts + value: '{{{json.requestParameters.computerName}}}' + if: ctx.json?.requestParameters?.computerName != null + allow_duplicates: false + - script: + tag: script_append_related_hosts_instance_ids + lang: painless + description: > + Collect EC2 instance identifiers and add them to related.hosts. CloudTrail + reports them in several shapes depending on the API. + if: >- + ctx.json?.requestParameters != null || ctx.json?.responseElements != null || + ctx.aws?.cloudtrail?.resources != null + params: + scalar_keys: + - instanceId + - target + - resourceId + on_failure: + - append: + tag: append_error_message_related_hosts_instance_ids + field: error.message + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + source: | + void add(List out, def value) { + if (value instanceof String && value.length() >= 10 && value.startsWith('i-') && !out.contains(value)) { + out.add(value); + } + } + + void addContainer(List out, def container, List scalarKeys) { + if (!(container instanceof Map)) { + return; + } + for (String key : scalarKeys) { + add(out, container[key]); + } + if (container.instanceIds instanceof List) { + for (def id : container.instanceIds) { + add(out, id); + } + } + def set = container.instancesSet; + if (set instanceof Map && set.items instanceof List) { + for (def item : set.items) { + if (item instanceof Map) { + add(out, item.instanceId); + } + } + } + } + + List found = new ArrayList(); + + if (ctx.aws?.cloudtrail?.resources instanceof List) { + for (def resource : ctx.aws.cloudtrail.resources) { + if (resource instanceof Map && resource.arn instanceof String && resource.arn.contains(':instance/')) { + add(found, resource.arn.substring(resource.arn.lastIndexOf('/') + 1)); + } + } + } + addContainer(found, ctx.json?.requestParameters, params.scalar_keys); + addContainer(found, ctx.json?.responseElements, params.scalar_keys); + + if (found.isEmpty()) { + return; + } + ctx.related = ctx.related ?: [:]; + if (ctx.related.hosts instanceof List) { + for (def host : found) { + if (!ctx.related.hosts.contains(host)) { + ctx.related.hosts.add(host); + } + } + } else { + ctx.related.hosts = found; + } # Remove the fields that the user does not want. # In the case that we did not want the flattened fields our work is already @@ -2096,7 +2478,7 @@ processors: # in the following two processors. - script: if: ctx._conf?.retain == 'minimal' && ctx.aws?.cloudtrail?.flattened != null - tag: script_retain_minimal_flattened + tag: script_retain_minimal_flattened_3d24add8 params: # This list of fields is determined by enumerating all fields containing # the string "cloudtrail.flattened" that are in .attributes.required_fields of the @@ -2112,6 +2494,11 @@ processors: - aws.cloudtrail.flattened.request_parameters.serialNumber - aws.cloudtrail.flattened.request_parameters.withDecryption - aws.cloudtrail.flattened.request_parameters.x-amz-server-side-encryption-customer-algorithm + # Content of digest and Insights records rather than API call payloads, so it + # is carried over whole instead of being reduced to the fields above. + preserved_flattened_fields: + - digest + - insight_details source: |- def set(Map root, String path, def v) { String[] elems = path.splitOnToken('.'); @@ -2130,6 +2517,12 @@ processors: } set(flattened, f.substring(prefix), v); } + for (String f: params.preserved_flattened_fields) { + def v = ctx.aws.cloudtrail.flattened[f]; + if (v != null) { + flattened[f] = v; + } + } ctx.aws.cloudtrail.flattened = flattened; - remove: tag: remove_9365dd2c @@ -2137,6 +2530,7 @@ processors: - aws.cloudtrail.response_elements - aws.cloudtrail.request_parameters - aws.cloudtrail.additional_eventdata + - aws.cloudtrail.service_event_details ignore_missing: true if: ctx._conf?.retain != null && ctx._conf.retain != '' && ctx._conf.retain != 'all' && ctx._conf.retain != 'keyword' && ctx._conf.retain != 'minimal' @@ -2145,9 +2539,10 @@ processors: field: - json - _conf + - _tmp ignore_missing: true - script: - tag: remove_nulls + tag: script_remove_nulls lang: painless description: This script processor iterates over the whole document to remove fields with null/empty values. source: | @@ -2172,19 +2567,35 @@ processors: }); } handleMap(ctx); - -on_failure: - set: field: event.kind + tag: set_pipeline_error_into_event_kind value: pipeline_error + if: ctx.error?.message != null - append: + tag: append_preserve_original_event_into_tags + field: tags + value: preserve_original_event + allow_duplicates: false + if: ctx.error?.message != null +on_failure: + - append: + tag: append_error_message field: error.message - value: >- - Processor '{{{ _ingest.on_failure_processor_type }}}' - {{{#_ingest.on_failure_processor_tag}}}with tag '{{{ _ingest.on_failure_processor_tag }}}' - {{{/_ingest.on_failure_processor_tag}}}in pipeline '{{{ _ingest.pipeline }}}' failed with message '{{{ _ingest.on_failure_message }}}' + value: 'Processor {{{_ingest.on_failure_processor_type}}} with tag {{{_ingest.on_failure_processor_tag}}} in pipeline {{{_ingest.on_failure_pipeline}}} failed with message: {{{_ingest.on_failure_message}}}' + - set: + tag: set_pipeline_error_to_event_kind + field: event.kind + value: pipeline_error + - append: + tag: append_preserve_original_event_to_tags + field: tags + value: preserve_original_event + allow_duplicates: false - remove: + tag: remove_json_and_conf field: - json - _conf + - _tmp ignore_missing: true diff --git a/packages/aws/data_stream/cloudtrail/fields/fields.yml b/packages/aws/data_stream/cloudtrail/fields/fields.yml index f94cc0630c4..a626fe1093a 100644 --- a/packages/aws/data_stream/cloudtrail/fields/fields.yml +++ b/packages/aws/data_stream/cloudtrail/fields/fields.yml @@ -69,9 +69,89 @@ type: keyword description: >- The account that owns the entity that was used to get credentials. + - name: ec2_role_delivery + type: keyword + description: >- + The value is 1.0 if the credentials were provided by Amazon EC2 Instance Metadata + Service Version 1 (IMDSv1). The value is 2.0 if the credentials were provided using + the new IMDS scheme. + - name: source_identity + type: keyword + description: >- + The sourceIdentity field occurs in events when users assume an IAM role to perform + an action. sourceIdentity identifies the original user identity making the request, + whether that user's identity is an IAM user, an IAM role, a user authenticated + through SAML-based federation, or a user authenticated through OpenID Connect + (OIDC)-compliant web identity federation. + - name: web_id_federation_data + type: group + fields: + - name: federated_provider + type: keyword + description: >- + The principal name of the identity provider (for example, www.amazon.com for + Login with Amazon or accounts.google.com for Google). + - name: attributes + type: flattened + description: >- + The application ID and user ID as reported by the provider (for example, + www.amazon.com:app_id and www.amazon.com:user_id for Login with Amazon). + - name: assumed_root + type: boolean + description: >- + The value is true for a temporary session when a management account or delegated + administrator calls AWS STS AssumeRoot. + - name: sign_in_session_arn + type: keyword + description: >- + The ARN of the sign-in session that supports the request. This ARN is the value of + the aws:SignInSessionArn global condition key. The key identifies the session more + specifically than the principal ARN. - name: invoked_by type: keyword description: The name of the AWS service that made the request, such as Amazon EC2 Auto Scaling or AWS Elastic Beanstalk. + - name: invoked_by_delegate + type: group + fields: + - name: account_id + type: keyword + description: The AWS account ID of the product provider that initiated the request. + - name: credential_id + type: keyword + description: >- + The credential ID for the request. This is only set when the caller uses a bearer + token, such as an IAM Identity Center authorized access token. + - name: identity_provider + type: keyword + description: >- + The principal name of the external identity provider. This field appears only for + SAMLUser or WebIdentityUser types. + - name: in_scope_of + type: group + fields: + - name: issuer_type + type: keyword + description: >- + The resource type of credentialsIssuedTo. For example, AWS::Lambda::Function. + - name: credentials_issued_to + type: keyword + description: The resource related to the environment where the credentials were issued. + - name: source_arn + type: keyword + description: The ARN of the resource that invoked the service-to-service request. + - name: source_account + type: keyword + description: The owner account ID for the sourceArn. It appears together with sourceArn. + - name: on_behalf_of + type: group + fields: + - name: user_id + type: keyword + description: The ID of the IAM Identity Center user who the call was made on behalf of. + - name: identity_store_arn + type: keyword + description: >- + The ARN of the IAM Identity Center identity store that the call was made on behalf of. - name: error_code type: keyword description: The AWS service error if the request returns an error. @@ -144,6 +224,41 @@ - name: vpc_endpoint_id type: keyword description: Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon S3. + - name: vpc_endpoint_account_id + type: keyword + description: >- + Identifies the AWS account ID of the VPC endpoint owner for the corresponding endpoint for + which a request has traversed. + - name: tls_details + type: group + fields: + - name: key_exchange + type: keyword + description: >- + The key exchange method used in the TLS handshake. This field indicates whether the + connection used classical cryptography or post-quantum cryptography. Example values + include X25519MLKEM768 for post-quantum TLS 1.3, x25519 for classical TLS 1.3, and + secp256r1 for TLS 1.2. + - name: addendum + type: group + fields: + - name: reason + type: keyword + description: The reason that the event or some of its contents were missing. + - name: updated_fields + type: keyword + description: >- + The event record fields that are updated by the addendum. This is only provided if the + reason is UPDATED_DATA. + - name: original_request_id + type: keyword + description: >- + The original unique ID of the request. This is only provided if the reason is + UPDATED_DATA. + - name: original_event_id + type: keyword + description: >- + The original event ID. This is only provided if the reason is UPDATED_DATA. - name: console_login type: group fields: diff --git a/packages/aws/data_stream/cloudtrail/manifest.yml b/packages/aws/data_stream/cloudtrail/manifest.yml index a3fe345b8b3..e820e615343 100644 --- a/packages/aws/data_stream/cloudtrail/manifest.yml +++ b/packages/aws/data_stream/cloudtrail/manifest.yml @@ -196,10 +196,11 @@ streams: required: false show_user: false description: >- - Cloudtrail `response_elements`, `request_parameters` and `additional_eventdata` data can - be placed in keyword and text fields as JSON, and in flattened fields. Depending on requirements - this configuration determines which fields will be retained in the final document. The Minimal - option retains the minimal set of fields required for the Security Detection Engine rules. + Cloudtrail `response_elements`, `request_parameters`, `additional_eventdata` and + `service_event_details` data can be placed in keyword and text fields as JSON, and in + flattened fields. Depending on requirements this configuration determines which fields + will be retained in the final document. The Minimal option retains the minimal set of + fields required for the Security Detection Engine rules. options: - text: Keyword and Flattened value: all @@ -357,9 +358,11 @@ streams: required: false show_user: false description: >- - Cloudtrail `response_elements`, `request_parameters` and `additional_eventdata` data can - be placed in keyword and text fields as JSON, and in flattened fields. Depending on requirements - This configuration determines which fields will be retained in the final document. + Cloudtrail `response_elements`, `request_parameters`, `additional_eventdata` and + `service_event_details` data can be placed in keyword and text fields as JSON, and in + flattened fields. Depending on requirements this configuration determines which fields + will be retained in the final document. The Minimal option retains the minimal set of + fields required for the Security Detection Engine rules. options: - text: Keyword and Flattened value: all diff --git a/packages/aws/data_stream/cloudtrail/sample_event.json b/packages/aws/data_stream/cloudtrail/sample_event.json index d5e5bf8d8bd..1c2ae48a06f 100644 --- a/packages/aws/data_stream/cloudtrail/sample_event.json +++ b/packages/aws/data_stream/cloudtrail/sample_event.json @@ -1,11 +1,11 @@ { "@timestamp": "2020-09-11T19:36:49.000Z", "agent": { - "ephemeral_id": "6b4ed425-a0ee-4515-8b8d-e73e018989c2", - "id": "449295a1-c91d-4d82-a238-4b90b3da70e8", - "name": "elastic-agent-43820", + "ephemeral_id": "7ad78bab-65d4-4305-9441-4359591715a1", + "id": "5a250ba4-f6c6-4fae-8665-b585c0eb1be9", + "name": "elastic-agent-10655", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "aws": { "cloudtrail": { @@ -113,7 +113,11 @@ "newest_event_time": "2020-09-11T19:26:24.000Z", "oldest_event_time": "2020-09-11T18:32:04.000Z", "previous_hash_algorithm": "SHA-256", + "previous_hash_value": "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860", "previous_s3_bucket": "alice-bucket", + "previous_s3_object": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz", + "previous_signature": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987", + "public_key_fingerprint": "47aaa19f7eec22e9bd0b5e58cfade8cb", "s3_bucket": "alice-bucket", "signature_algorithm": "SHA256withRSA", "start_time": "2020-09-11T18:36:49.000Z" @@ -122,8 +126,8 @@ }, "s3": { "bucket": { - "arn": "arn:aws:s3:::elastic-package-aws-bucket-22020", - "name": "elastic-package-aws-bucket-22020" + "arn": "arn:aws:s3:::elastic-package-aws-bucket-45147", + "name": "elastic-package-aws-bucket-45147" }, "object": { "key": "cloudtrail-digest.log" @@ -134,26 +138,27 @@ "account": { "id": "123456789123" }, + "provider": "aws", "region": "us-east-1" }, "data_stream": { "dataset": "aws.cloudtrail", - "namespace": "41832", + "namespace": "95850", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "449295a1-c91d-4d82-a238-4b90b3da70e8", + "id": "5a250ba4-f6c6-4fae-8665-b585c0eb1be9", "snapshot": false, - "version": "8.18.0" + "version": "8.19.4" }, "event": { "agent_id_status": "verified", - "created": "2025-09-04T09:55:08.902Z", + "created": "2026-08-31T13:18:34.514Z", "dataset": "aws.cloudtrail", - "ingested": "2025-09-04T09:55:09Z", + "ingested": "2026-08-31T13:18:35Z", "kind": "event", "original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz\",\"hashValue\":\"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:21:28Z\",\"oldestEventTime\":\"2020-09-11T19:21:28Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz\",\"hashValue\":\"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:51:21Z\",\"oldestEventTime\":\"2020-09-11T18:51:21Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz\",\"hashValue\":\"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:46:45Z\",\"oldestEventTime\":\"2020-09-11T18:46:45Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz\",\"hashValue\":\"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:01:06Z\",\"oldestEventTime\":\"2020-09-11T19:01:06Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz\",\"hashValue\":\"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:16:12Z\",\"oldestEventTime\":\"2020-09-11T19:16:12Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz\",\"hashValue\":\"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:56:05Z\",\"oldestEventTime\":\"2020-09-11T18:56:05Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz\",\"hashValue\":\"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:06:31Z\",\"oldestEventTime\":\"2020-09-11T19:06:31Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz\",\"hashValue\":\"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:41:58Z\",\"oldestEventTime\":\"2020-09-11T18:41:58Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz\",\"hashValue\":\"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:37:10Z\",\"oldestEventTime\":\"2020-09-11T18:37:10Z\"}]}", "outcome": "success", @@ -162,9 +167,6 @@ ] }, "file": { - "hash": { - "sha256": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" - }, "path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz" }, "input": { @@ -172,13 +174,13 @@ }, "log": { "file": { - "path": "https://elastic-package-aws-bucket-22020.s3.us-east-1.amazonaws.com/cloudtrail-digest.log" + "path": "https://elastic-package-aws-bucket-45147.s3.us-east-1.amazonaws.com/cloudtrail-digest.log" }, "offset": 0 }, "related": { "hash": [ - "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" + "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860" ] }, "tags": [ diff --git a/packages/aws/docs/cloudtrail.md b/packages/aws/docs/cloudtrail.md index 293c7b2a060..e45d3217b40 100644 --- a/packages/aws/docs/cloudtrail.md +++ b/packages/aws/docs/cloudtrail.md @@ -127,6 +127,10 @@ Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ec |---|---|---| | @timestamp | Event timestamp. | date | | actor.entity.id | [Deprecated] Legacy field containing the actor entity identifier. For type-specific entities, use user.entity.id, service.entity.id, host.entity.id, or entity.id instead. | keyword | +| aws.cloudtrail.addendum.original_event_id | The original event ID. This is only provided if the reason is UPDATED_DATA. | keyword | +| aws.cloudtrail.addendum.original_request_id | The original unique ID of the request. This is only provided if the reason is UPDATED_DATA. | keyword | +| aws.cloudtrail.addendum.reason | The reason that the event or some of its contents were missing. | keyword | +| aws.cloudtrail.addendum.updated_fields | The event record fields that are updated by the addendum. This is only provided if the reason is UPDATED_DATA. | keyword | | aws.cloudtrail.additional_eventdata | Additional data about the event that was not part of the request or response. | keyword | | aws.cloudtrail.additional_eventdata.text | Multi-field of `aws.cloudtrail.additional_eventdata`. | text | | aws.cloudtrail.api_version | Identifies the API version associated with the AwsApiCall eventType value. | keyword | @@ -159,16 +163,33 @@ Refer to the following [document](https://www.elastic.co/guide/en/ecs/current/ec | aws.cloudtrail.service_event_details.text | Multi-field of `aws.cloudtrail.service_event_details`. | text | | aws.cloudtrail.session_credential_from_console | | keyword | | aws.cloudtrail.shared_event_id | GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts. | keyword | +| aws.cloudtrail.tls_details.key_exchange | The key exchange method used in the TLS handshake. This field indicates whether the connection used classical cryptography or post-quantum cryptography. Example values include X25519MLKEM768 for post-quantum TLS 1.3, x25519 for classical TLS 1.3, and secp256r1 for TLS 1.2. | keyword | | aws.cloudtrail.user_identity.access_key_id | The access key ID that was used to sign the request. | keyword | | aws.cloudtrail.user_identity.arn | The Amazon Resource Name (ARN) of the principal that made the call. | keyword | +| aws.cloudtrail.user_identity.credential_id | The credential ID for the request. This is only set when the caller uses a bearer token, such as an IAM Identity Center authorized access token. | keyword | +| aws.cloudtrail.user_identity.identity_provider | The principal name of the external identity provider. This field appears only for SAMLUser or WebIdentityUser types. | keyword | +| aws.cloudtrail.user_identity.in_scope_of.credentials_issued_to | The resource related to the environment where the credentials were issued. | keyword | +| aws.cloudtrail.user_identity.in_scope_of.issuer_type | The resource type of credentialsIssuedTo. For example, AWS::Lambda::Function. | keyword | +| aws.cloudtrail.user_identity.in_scope_of.source_account | The owner account ID for the sourceArn. It appears together with sourceArn. | keyword | +| aws.cloudtrail.user_identity.in_scope_of.source_arn | The ARN of the resource that invoked the service-to-service request. | keyword | | aws.cloudtrail.user_identity.invoked_by | The name of the AWS service that made the request, such as Amazon EC2 Auto Scaling or AWS Elastic Beanstalk. | keyword | +| aws.cloudtrail.user_identity.invoked_by_delegate.account_id | The AWS account ID of the product provider that initiated the request. | keyword | +| aws.cloudtrail.user_identity.on_behalf_of.identity_store_arn | The ARN of the IAM Identity Center identity store that the call was made on behalf of. | keyword | +| aws.cloudtrail.user_identity.on_behalf_of.user_id | The ID of the IAM Identity Center user who the call was made on behalf of. | keyword | +| aws.cloudtrail.user_identity.session_context.assumed_root | The value is true for a temporary session when a management account or delegated administrator calls AWS STS AssumeRoot. | boolean | | aws.cloudtrail.user_identity.session_context.creation_date | The date and time when the temporary security credentials were issued. | date | +| aws.cloudtrail.user_identity.session_context.ec2_role_delivery | The value is 1.0 if the credentials were provided by Amazon EC2 Instance Metadata Service Version 1 (IMDSv1). The value is 2.0 if the credentials were provided using the new IMDS scheme. | keyword | | aws.cloudtrail.user_identity.session_context.mfa_authenticated | The value is true if the root user or IAM user whose credentials were used for the request also was authenticated with an MFA device; otherwise, false. | keyword | | aws.cloudtrail.user_identity.session_context.session_issuer.account_id | The account that owns the entity that was used to get credentials. | keyword | | aws.cloudtrail.user_identity.session_context.session_issuer.arn | The ARN of the source (account, IAM user, or role) that was used to get temporary security credentials. | keyword | | aws.cloudtrail.user_identity.session_context.session_issuer.principal_id | The internal ID of the entity that was used to get credentials. | keyword | | aws.cloudtrail.user_identity.session_context.session_issuer.type | The source of the temporary security credentials, such as Root, IAMUser, or Role. | keyword | +| aws.cloudtrail.user_identity.session_context.sign_in_session_arn | The ARN of the sign-in session that supports the request. This ARN is the value of the aws:SignInSessionArn global condition key. The key identifies the session more specifically than the principal ARN. | keyword | +| aws.cloudtrail.user_identity.session_context.source_identity | The sourceIdentity field occurs in events when users assume an IAM role to perform an action. sourceIdentity identifies the original user identity making the request, whether that user's identity is an IAM user, an IAM role, a user authenticated through SAML-based federation, or a user authenticated through OpenID Connect (OIDC)-compliant web identity federation. | keyword | +| aws.cloudtrail.user_identity.session_context.web_id_federation_data.attributes | The application ID and user ID as reported by the provider (for example, www.amazon.com:app_id and www.amazon.com:user_id for Login with Amazon). | flattened | +| aws.cloudtrail.user_identity.session_context.web_id_federation_data.federated_provider | The principal name of the identity provider (for example, www.amazon.com for Login with Amazon or accounts.google.com for Google). | keyword | | aws.cloudtrail.user_identity.type | The type of the identity | keyword | +| aws.cloudtrail.vpc_endpoint_account_id | Identifies the AWS account ID of the VPC endpoint owner for the corresponding endpoint for which a request has traversed. | keyword | | aws.cloudtrail.vpc_endpoint_id | Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon S3. | keyword | | aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword | | aws.s3.bucket.name | Name of a S3 bucket. | keyword | @@ -202,11 +223,11 @@ An example event for `cloudtrail` looks as following: { "@timestamp": "2020-09-11T19:36:49.000Z", "agent": { - "ephemeral_id": "6b4ed425-a0ee-4515-8b8d-e73e018989c2", - "id": "449295a1-c91d-4d82-a238-4b90b3da70e8", - "name": "elastic-agent-43820", + "ephemeral_id": "7ad78bab-65d4-4305-9441-4359591715a1", + "id": "5a250ba4-f6c6-4fae-8665-b585c0eb1be9", + "name": "elastic-agent-10655", "type": "filebeat", - "version": "8.18.0" + "version": "8.19.4" }, "aws": { "cloudtrail": { @@ -314,7 +335,11 @@ An example event for `cloudtrail` looks as following: "newest_event_time": "2020-09-11T19:26:24.000Z", "oldest_event_time": "2020-09-11T18:32:04.000Z", "previous_hash_algorithm": "SHA-256", + "previous_hash_value": "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860", "previous_s3_bucket": "alice-bucket", + "previous_s3_object": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz", + "previous_signature": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987", + "public_key_fingerprint": "47aaa19f7eec22e9bd0b5e58cfade8cb", "s3_bucket": "alice-bucket", "signature_algorithm": "SHA256withRSA", "start_time": "2020-09-11T18:36:49.000Z" @@ -323,8 +348,8 @@ An example event for `cloudtrail` looks as following: }, "s3": { "bucket": { - "arn": "arn:aws:s3:::elastic-package-aws-bucket-22020", - "name": "elastic-package-aws-bucket-22020" + "arn": "arn:aws:s3:::elastic-package-aws-bucket-45147", + "name": "elastic-package-aws-bucket-45147" }, "object": { "key": "cloudtrail-digest.log" @@ -335,26 +360,27 @@ An example event for `cloudtrail` looks as following: "account": { "id": "123456789123" }, + "provider": "aws", "region": "us-east-1" }, "data_stream": { "dataset": "aws.cloudtrail", - "namespace": "41832", + "namespace": "95850", "type": "logs" }, "ecs": { "version": "8.11.0" }, "elastic_agent": { - "id": "449295a1-c91d-4d82-a238-4b90b3da70e8", + "id": "5a250ba4-f6c6-4fae-8665-b585c0eb1be9", "snapshot": false, - "version": "8.18.0" + "version": "8.19.4" }, "event": { "agent_id_status": "verified", - "created": "2025-09-04T09:55:08.902Z", + "created": "2026-08-31T13:18:34.514Z", "dataset": "aws.cloudtrail", - "ingested": "2025-09-04T09:55:09Z", + "ingested": "2026-08-31T13:18:35Z", "kind": "event", "original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz\",\"hashValue\":\"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:21:28Z\",\"oldestEventTime\":\"2020-09-11T19:21:28Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz\",\"hashValue\":\"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:51:21Z\",\"oldestEventTime\":\"2020-09-11T18:51:21Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz\",\"hashValue\":\"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:46:45Z\",\"oldestEventTime\":\"2020-09-11T18:46:45Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz\",\"hashValue\":\"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:01:06Z\",\"oldestEventTime\":\"2020-09-11T19:01:06Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz\",\"hashValue\":\"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:16:12Z\",\"oldestEventTime\":\"2020-09-11T19:16:12Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz\",\"hashValue\":\"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:56:05Z\",\"oldestEventTime\":\"2020-09-11T18:56:05Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz\",\"hashValue\":\"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:06:31Z\",\"oldestEventTime\":\"2020-09-11T19:06:31Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz\",\"hashValue\":\"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:41:58Z\",\"oldestEventTime\":\"2020-09-11T18:41:58Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz\",\"hashValue\":\"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:37:10Z\",\"oldestEventTime\":\"2020-09-11T18:37:10Z\"}]}", "outcome": "success", @@ -363,9 +389,6 @@ An example event for `cloudtrail` looks as following: ] }, "file": { - "hash": { - "sha256": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" - }, "path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz" }, "input": { @@ -373,13 +396,13 @@ An example event for `cloudtrail` looks as following: }, "log": { "file": { - "path": "https://elastic-package-aws-bucket-22020.s3.us-east-1.amazonaws.com/cloudtrail-digest.log" + "path": "https://elastic-package-aws-bucket-45147.s3.us-east-1.amazonaws.com/cloudtrail-digest.log" }, "offset": 0 }, "related": { "hash": [ - "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987" + "531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860" ] }, "tags": [ diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index ee9dae64487..874f1ffc4ec 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.4.0 name: aws title: AWS -version: 6.21.0 +version: 6.22.0 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration categories: diff --git a/packages/aws/validation.yml b/packages/aws/validation.yml index 1189aa63c89..b2825a57124 100644 --- a/packages/aws/validation.yml +++ b/packages/aws/validation.yml @@ -1,3 +1,4 @@ errors: exclude_checks: - SVR00004 # References in dashboards. + - SVR00009 # Pipeline on_failure error message format; pre-existing pipeline predates this check.