1+ platform :ElasticSearch ES|QL
2+ source :aws_cloudtrail
3+ log_source :
4+ index :[logs-*]
5+ default_log_source :
6+ index :logs-*
7+ field_mapping :
8+ additionalEventdata :aws.cloudtrail.additional_eventdata
9+ apiVersion :aws.cloudtrail.api_version
10+ awsRegion :cloud.region
11+ errorCode :aws.cloudtrail.error_code
12+ errorMessage :aws.cloudtrail.error_message
13+ eventID :event.id
14+ eventName :event.action
15+ eventSource :event.provider
16+ eventTime :' @timestamp'
17+ eventType :aws.cloudtrail.event_type
18+ eventVersion :aws.cloudtrail.event_version
19+ managementEvent :aws.cloudtrail.management_event
20+ readOnly :aws.cloudtrail.read_only
21+ requestID :aws.cloudtrail.request_id
22+ requestParameters :aws.cloudtrail.request_parameters
23+ resources.accountId :aws.cloudtrail.resources.account_id
24+ resources.ARN :aws.cloudtrail.resources.arn
25+ resources.type :aws.cloudtrail.resources.type
26+ responseElements :aws.cloudtrail.response_elements
27+ serviceEventDetails :aws.cloudtrail.service_event_details
28+ sharedEventId :aws.cloudtrail.shared_event_id
29+ sourceIPAddress :source.address
30+ userAgent :user_agent
31+ userIdentity.accessKeyId :aws.cloudtrail.user_identity.access_key_id
32+ userIdentity.accountId :cloud.account.id
33+ userIdentity.arn :aws.cloudtrail.user_identity.arn
34+ userIdentity.invokedBy :aws.cloudtrail.user_identity.invoked_by
35+ userIdentity.principalId :user.id
36+ userIdentity.sessionContext.attributes.creationDate :aws.cloudtrail.user_identity.session_context.creation_date
37+ userIdentity.sessionContext.attributes.mfaAuthenticated :aws.cloudtrail.user_identity.session_context.mfa_authenticated
38+ userIdentity.sessionContext.sessionIssuer.userName :role.name
39+ userIdentity.type :aws.cloudtrail.user_identity.type
40+ userIdentity.userName :user.name
41+ vpcEndpointId :aws.cloudtrail.vpc_endpoint_id
42+ overrides :
43+ -field :event.outcome
44+ value :failure
45+ regexes :
46+ -(\(\(aws.cloudtrail.error_message.keyword:.* event.action:\"ConsoleLogin\"\)\))
47+ -(\(\(aws.cloudtrail.error_code.keyword:.* event.action:\"ConsoleLogin\"\)\))
48+ -(\(\(aws.cloudtrail.error_message.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\))
49+ -(\(\(aws.cloudtrail.error_code.keyword:.* aws.cloudtrail.response_elements.keyword:\*Failure\*\)\))
50+ -(\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_message.keyword:\*\)\))
51+ -(\(\(event.action:\"ConsoleLogin\".* aws.cloudtrail.error_code.keyword:\*\)\))
52+ -(\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_message.keyword:\*\)\))
53+ -(\(\(aws.cloudtrail.response_elements.keyword:\*Failure\*.* aws.cloudtrail.error_code.keyword:\*\)\))
54+ -field :event.outcome
55+ value :success
56+ literals :
57+ -' NOT (event.outcome:failure)'