AWSCloudTrail

  • Artigo

CloudTrail logs, which ingested from Sentinel's connector, holds all your data and management events of your Amazon Wev Services account.

Table attributes

Attribute Value
Resource types -
Categories Security
Solutions SecurityInsights
Basic log No
Ingestion-time transformation Yes
Sample Queries Yes

Columns

Column Type Description
AdditionalEventData string Additional data about the event that was not part of the request or response.
APIVersion string Identifies the API version associated with the AwsApiCall eventType value.
AwsEventId string GUID generated by CloudTrail to uniquely identify each event. You can use this value to identify a single event.
AWSRegion string The AWS region that the request was made to.
AwsRequestId string deprecated, please use AwsRequestId_ instead.
AwsRequestId_ string The value that identifies the request. The service being called generates this value.
_BilledSize real The record size in bytes
Category string Shows the event category that is used in LookupEvents calls.
CidrIp string The CIDR IP is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IPv4 CIDR range.
CipherSuite string Optional. Part of tlsDetails. The cipher suite (combination of security algorithms used) of a request.
ClientProvidedHostHeader string Optional. Part of tlsDetails. The client-provided host name used in the service API call, which is typically the FQDN of the service endpoint.
DestinationPort string The DestinationPort is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The end of port range for the TCP and UDP protocols, or an ICMP code.
EC2RoleDelivery string The friendly name of the user or role that issued the session.
ErrorCode string The AWS service error if the request returns an error.
ErrorMessage string The error description when available. This message includes messages for authorization failures. CloudTrail captures the message logged by the service in its exception handling.
EventName string The requested action, which is one of the actions in the API for that service.
EventSource string The service that the request was made to. This name is typically a short form of the service name without spaces plus .amazonaws.com.
EventTypeName string Identifies the type of event that generated the event record. This can be the one of the following values: AwsApiCall, AwsServiceEvent, AwsConsoleAction , AwsConsoleSignIn.
EventVersion string The version of the log event format.
IpProtocol string The IP protocol is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The IP protocol name or number. The valid values are tcp, udp, icmp, or a protocol number.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
ManagementEvent bool A Boolean value that identifies whether the event is a management event.
OperationName string Constant value: CloudTrail.
ReadOnly bool Identifies whether this operation is a read-only operation.
RecipientAccountId string Represents the account ID that received this event. The recipientAccountID may be different from the CloudTrail userIdentity Element accountId. This can occur in cross-account resource access.
RequestParameters string The parameters, if any, that were sent with the request. These parameters are documented in the API reference documentation for the appropriate AWS service.
Resources string A list of resources accessed in the event.
ResponseElements string The response element for actions that make changes (create, update, or delete actions). If an action does not change state (for example, a request to get or list objects), this element is omitted.
ServiceEventDetails string Identifies the service event, including what triggered the event and the result.
SessionCreationDate datetime The date and time when the temporary security credentials were issued.
SessionIssuerAccountId string The account that owns the entity that was used to get credentials.
SessionIssuerArn string The ARN of the source (account, IAM user, or role) that was used to get temporary security credentials.
SessionIssuerPrincipalId string The internal ID of the entity that was used to get credentials.
SessionIssuerType string The source of the temporary security credentials, such as Root, IAMUser, or Role.
SessionIssuerUserName string The friendly name of the user or role that issued the session.
SessionMfaAuthenticated bool The value is true if the root user or IAM user whose credentials were used for the request also was authenticated with an MFA device; otherwise, false.
SharedEventId string GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts.
SourceIpAddress string The IP address that the request was made from. For actions that originate from the service console, the address reported is for the underlying customer resource, not the console web server. For services in AWS, only the DNS name is displayed.
SourcePort string The SourcePort is located under RequestParameters in CloudTrail, and it is used to specify the IP permissions for a security group rule. The start of port range for the TCP and UDP protocols, or an ICMP type number.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
TenantId string The Log Analytics workspace ID
TimeGenerated datetime The timestamp (UTC). An event's time stamp comes from the local host that provides the service API endpoint on which the API call was made.
TlsVersion string Optional. Part of tlsDetails. The TLS version of a request.
Type string The name of the table
UserAgent string The agent through which the request was made, such as the AWS Management Console, an AWS service, the AWS SDKs or the AWS CLI.
UserIdentityAccessKeyId string The access key ID that was used to sign the request.
UserIdentityAccountId string The account that owns the entity that granted permissions for the request.
UserIdentityArn string The Amazon Resource Name (ARN) of the principal that made the call.
UserIdentityInvokedBy string The name of the AWS service that made the request.
UserIdentityPrincipalid string A unique identifier for the entity that made the call.
UserIdentityType string The type of the identity. The following values are possible: Root, IAMUser, AssumedRole, FederatedUser, Directory, AWSAccount, AWSService, Unknown.
UserIdentityUserName string The name of the identity that made the call.
VpcEndpointId string Identifies the VPC endpoint in which requests were made from a VPC to another AWS service.