|
| 1 | +platform:ElasticSearch ES|QL |
| 2 | +source:aws_cloudtrail |
| 3 | +log_source: |
| 4 | +index:[logs-*] |
| 5 | +default_log_source: |
| 6 | +index:logs-* |
| 7 | +field_mapping: |
| 8 | +additionalEventdata:aws.cloudtrail.additional_eventdata |
| 9 | +apiVersion:aws.cloudtrail.api_version |
| 10 | +awsRegion:cloud.region |
| 11 | +errorCode:aws.cloudtrail.error_code |
| 12 | +errorMessage:aws.cloudtrail.error_message |
| 13 | +eventID:event.id |
| 14 | +eventName:event.action |
| 15 | +eventSource:event.provider |
| 16 | +eventTime:'@timestamp' |
| 17 | +eventType:aws.cloudtrail.event_type |
| 18 | +eventVersion:aws.cloudtrail.event_version |
| 19 | +managementEvent:aws.cloudtrail.management_event |
| 20 | +readOnly:aws.cloudtrail.read_only |
| 21 | +requestID:aws.cloudtrail.request_id |
| 22 | +requestParameters:aws.cloudtrail.request_parameters |
| 23 | +resources.accountId:aws.cloudtrail.resources.account_id |
| 24 | +resources.ARN:aws.cloudtrail.resources.arn |
| 25 | +resources.type:aws.cloudtrail.resources.type |
| 26 | +responseElements:aws.cloudtrail.response_elements |
| 27 | +serviceEventDetails:aws.cloudtrail.service_event_details |
| 28 | +sharedEventId:aws.cloudtrail.shared_event_id |
| 29 | +sourceIPAddress:source.address |
| 30 | +userAgent:user_agent |
| 31 | +userIdentity.accessKeyId:aws.cloudtrail.user_identity.access_key_id |
| 32 | +userIdentity.accountId:cloud.account.id |
| 33 | +userIdentity.arn:aws.cloudtrail.user_identity.arn |
| 34 | +userIdentity.invokedBy:aws.cloudtrail.user_identity.invoked_by |
| 35 | +userIdentity.principalId:user.id |
| 36 | +userIdentity.sessionContext.attributes.creationDate:aws.cloudtrail.user_identity.session_context.creation_date |
| 37 | +userIdentity.sessionContext.attributes.mfaAuthenticated:aws.cloudtrail.user_identity.session_context.mfa_authenticated |
| 38 | +userIdentity.sessionContext.sessionIssuer.userName:role.name |
| 39 | +userIdentity.type:aws.cloudtrail.user_identity.type |
| 40 | +userIdentity.userName:user.name |
| 41 | +vpcEndpointId:aws.cloudtrail.vpc_endpoint_id |