admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
contentctl_unit_changes
splunk-security_content/data_sources/cloud/AWS_CloudTrail.yml
T
Bhavin Patel 6c5446cfbc Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00

230 lines
10 KiB
YAML
Raw Permalink Blame History

name: AWS CloudTrail
id: aa8d90bf-8ab1-4a9f-8c1b-24a67b1cd0b0
author: Patrick Bareiss, Splunk
source: aws_cloudtrail
sourcetype: aws:cloudtrail
separator: eventName
supported_TA:
name: Splunk Add-on for Amazon Web Services (AWS)
version: 7.4.1
url: https://splunkbase.splunk.com/app/1876
event_names:
- event_name: AWS CloudTrail
data_source: data_sources/cloud/event_sources/AWS_CloudTrail.yml
- event_name: AWS CloudTrail AssumeRoleWithSAML
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_AssumeRoleWithSAML.yml
- event_name: AWS CloudTrail ConsoleLogin
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_ConsoleLogin.yml
- event_name: AWS CloudTrail CopyObject
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CopyObject.yml
- event_name: AWS CloudTrail CreateAccessKey
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateAccessKey.yml
- event_name: AWS CloudTrail CreateKey
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateKey.yml
- event_name: AWS CloudTrail CreateLoginProfile
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateLoginProfile.yml
- event_name: AWS CloudTrail CreateNetworkAclEntry
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateNetworkAclEntry.yml
- event_name: AWS CloudTrail CreatePolicyVersion
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreatePolicyVersion.yml
- event_name: AWS CloudTrail CreateSnapshot
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateSnapshot.yml
- event_name: AWS CloudTrail CreateTask
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateTask.yml
- event_name: AWS CloudTrail CreateVirtualMFADevice
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_CreateVirtualMFADevice.yml
- event_name: AWS CloudTrail DeactivateMFADevice
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeactivateMFADevice.yml
- event_name: AWS CloudTrail DeleteAccountPasswordPolicy
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteAccountPasswordPolicy.yml
- event_name: AWS CloudTrail DeleteAlarms
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteAlarms.yml
- event_name: AWS CloudTrail DeleteDetector
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteDetector.yml
- event_name: AWS CloudTrail DeleteGroup
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteGroup.yml
- event_name: AWS CloudTrail DeleteIPSet
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteIPSet.yml
- event_name: AWS CloudTrail DeleteLogGroup
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteLogGroup.yml
- event_name: AWS CloudTrail DeleteLogStream
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteLogStream.yml
- event_name: AWS CloudTrail DeleteLoggingConfiguration
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteLoggingConfiguration.yml
- event_name: AWS CloudTrail DeleteNetworkAclEntry
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteNetworkAclEntry.yml
- event_name: AWS CloudTrail DeletePolicy
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeletePolicy.yml
- event_name: AWS CloudTrail DeleteRule
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteRule.yml
- event_name: AWS CloudTrail DeleteRuleGroup
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteRuleGroup.yml
- event_name: AWS CloudTrail DeleteSnapshot
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteSnapshot.yml
- event_name: AWS CloudTrail DeleteTrail
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteTrail.yml
- event_name: AWS CloudTrail DeleteVirtualMFADevice
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteVirtualMFADevice.yml
- event_name: AWS CloudTrail DeleteWebACL
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DeleteWebACL.yml
- event_name: AWS CloudTrail DescribeEventAggregates
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DescribeEventAggregates.yml
- event_name: AWS CloudTrail DescribeImageScanFindings
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DescribeImageScanFindings.yml
- event_name: AWS CloudTrail DescribeSnapshotAttribute
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_DescribeSnapshotAttribute.yml
- event_name: AWS CloudTrail GetAccountPasswordPolicy
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_GetAccountPasswordPolicy.yml
- event_name: AWS CloudTrail GetObject
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_GetObject.yml
- event_name: AWS CloudTrail GetPasswordData
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_GetPasswordData.yml
- event_name: AWS CloudTrail JobCreated
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_JobCreated.yml
- event_name: AWS CloudTrail ModifyDBInstance
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_ModifyDBInstance.yml
- event_name: AWS CloudTrail ModifyImageAttribute
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_ModifyImageAttribute.yml
- event_name: AWS CloudTrail ModifySnapshotAttribute
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_ModifySnapshotAttribute.yml
- event_name: AWS CloudTrail PutBucketAcl
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutBucketAcl.yml
- event_name: AWS CloudTrail PutBucketLifecycle
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutBucketLifecycle.yml
- event_name: AWS CloudTrail PutBucketReplication
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutBucketReplication.yml
- event_name: AWS CloudTrail PutBucketVersioning
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutBucketVersioning.yml
- event_name: AWS CloudTrail PutImage
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutImage.yml
- event_name: AWS CloudTrail PutKeyPolicy
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_PutKeyPolicy.yml
- event_name: AWS CloudTrail ReplaceNetworkAclEntry
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_ReplaceNetworkAclEntry.yml
- event_name: AWS CloudTrail SetDefaultPolicyVersion
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_SetDefaultPolicyVersion.yml
- event_name: AWS CloudTrail StopLogging
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_StopLogging.yml
- event_name: AWS CloudTrail UpdateAccountPasswordPolicy
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_UpdateAccountPasswordPolicy.yml
- event_name: AWS CloudTrail UpdateLoginProfile
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_UpdateLoginProfile.yml
- event_name: AWS CloudTrail UpdateSAMLProvider
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_UpdateSAMLProvider.yml
- event_name: AWS CloudTrail UpdateTrail
data_source: data_sources/cloud/event_sources/AWS_CloudTrail_UpdateTrail.yml
fields:
- _time
- action
- app
- awsRegion
- aws_account_id
- change_type
- command
- date_hour
- date_mday
- date_minute
- date_month
- date_second
- date_wday
- date_year
- date_zone
- dest
- direction
- dvc
- errorCode
- eventCategory
- eventID
- eventName
- eventSource
- eventTime
- eventType
- eventVersion
- eventtype
- host
- index
- linecount
- managementEvent
- msg
- object
- object_category
- object_id
- product
- protocol
- punct
- readOnly
- recipientAccountId
- region
- requestID
- requestParameters.groupId
- requestParameters.ipPermissions.items{}.fromPort
- requestParameters.ipPermissions.items{}.ipProtocol
- requestParameters.ipPermissions.items{}.ipRanges.items{}.cidrIp
- requestParameters.ipPermissions.items{}.toPort
- responseElements._return
- responseElements.requestId
- responseElements.securityGroupRuleSet.items{}.cidrIpv4
- responseElements.securityGroupRuleSet.items{}.fromPort
- responseElements.securityGroupRuleSet.items{}.groupId
- responseElements.securityGroupRuleSet.items{}.groupOwnerId
- responseElements.securityGroupRuleSet.items{}.ipProtocol
- responseElements.securityGroupRuleSet.items{}.isEgress
- responseElements.securityGroupRuleSet.items{}.securityGroupRuleId
- responseElements.securityGroupRuleSet.items{}.toPort
- signature
- source
- sourceIPAddress
- sourcetype
- splunk_server
- src
- src_ip
- src_ip_range
- src_port_range
- start_time
- status
- tag
- tag::eventtype
- timeendpos
- timestartpos
- tlsDetails.cipherSuite
- tlsDetails.clientProvidedHostHeader
- tlsDetails.tlsVersion
- user
- userAgent
- userIdentity.accessKeyId
- userIdentity.accountId
- userIdentity.arn
- userIdentity.principalId
- userIdentity.type
- userIdentity.userName
- userName
- user_access_key
- user_agent
- user_arn
- user_group_id
- user_id
- user_name
- user_type
- vendor
- vendor_account
- vendor_product
- vendor_region
example_log: '{"eventVersion": "1.09", "userIdentity": {"type": "IAMUser", "principalId":
"AIDAAAAAAAAAAAAAAAAAA", "arn": "arn:aws:iam::111111111111:user/daftpunk_cli", "accountId":
"111111111111", "accessKeyId": "AKIAAAAAAAAAAAAAAAAA", "userName": "daftpunk_cli"},
"eventTime": "2024-02-21T19:19:40Z", "eventSource": "ec2.amazonaws.com", "eventName":
"AuthorizeSecurityGroupIngress", "awsRegion": "us-west-2", "sourceIPAddress": "2.2.2.2",
"userAgent": "aws-cli/2.13.22 Python/3.11.5 Darwin/22.5.0 source/arm64 prompt/off
command/ec2.authorize-security-group-ingress", "requestParameters": {"groupId":
"sg-07ffb1896dcd3713e", "ipPermissions": {"items": [{"ipProtocol": "-1", "fromPort":
-1, "toPort": -1, "groups": {}, "ipRanges": {"items": [{"cidrIp": "0.0.0.0/0"}]},
"ipv6Ranges": {}, "prefixListIds": {}}]}}, "responseElements": {"requestId": "4950930b-2129-423c-95b0-1b87c8fa115a",
"_return": true, "securityGroupRuleSet": {"items": [{"groupOwnerId": "111111111111",
"groupId": "sg-07ffb1896dcd3713e", "securityGroupRuleId": "sgr-0217c1b508cc6b76c",
"isEgress": false, "ipProtocol": "-1", "fromPort": -1, "toPort": -1, "cidrIpv4":
"0.0.0.0/0"}]}}, "requestID": "4950930b-2129-423c-95b0-1b87c8fa115a", "eventID":
"bdade96f-6272-468a-b084-413b9711e92f", "readOnly": false, "eventType": "AwsApiCall",
"managementEvent": true, "recipientAccountId": "111111111111", "eventCategory":
"Management", "tlsDetails": {"tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256",
"clientProvidedHostHeader": "ec2.us-west-2.amazonaws.com"}}'
Reference in New Issue View Git Blame Copy Permalink