Data Source: ASL AWS CloudTrail

Created: 2025-01-14

Last Updated: 2026-10-14

ID: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898

Author: Patrick Bareiss, Splunk

Description

Represents AWS API dataset data collection from Amazon Security Lake.

Details

Property	Value
Source	`aws_asl`
Sourcetype	`aws:asl`
Separator	api.operation

Name ▲▼	Technique ▲▼	Type ▲▼
ASL AWS Defense Evasion Impair Security Services	Disable or Modify Cloud Log	Hunting
ASL AWS EC2 Snapshot Shared Externally	Transfer Data to Cloud Account	TTP
ASL AWS UpdateLoginProfile	Cloud Account	TTP
ASL AWS Defense Evasion Update Cloudtrail	Disable or Modify Cloud Log	TTP
ASL AWS Defense Evasion Stop Logging Cloudtrail	Disable or Modify Cloud Log	TTP
ASL AWS Disable Bucket Versioning	Inhibit System Recovery	Anomaly
ASL AWS IAM Failure Group Deletion	Account Manipulation	Anomaly
ASL AWS Create Policy Version to allow all resources	Cloud Accounts	TTP
ASL AWS Credential Access GetPasswordData	Password Guessing, Cloud Accounts	Anomaly
ASL AWS ECR Container Upload Outside Business Hours	Malicious Image	Anomaly
ASL AWS Defense Evasion Delete CloudWatch Log Group	Disable or Modify Cloud Log	TTP
ASL AWS Create Access Key	Cloud Account	Hunting
ASL AWS Credential Access RDS Password reset	Brute Force, Cloud Accounts	TTP
ASL AWS Detect Users creating keys with encrypt policy without MFA	Data Encrypted for Impact	TTP
ASL AWS IAM AccessDenied Discovery Events	Cloud Infrastructure Discovery	Anomaly
ASL AWS Multi-Factor Authentication Disabled	Multi-Factor Authentication, Cloud Accounts, Multi-Factor Authentication Request Generation	TTP
ASL AWS Network Access Control List Deleted	Cloud Firewall	Anomaly
ASL AWS IAM Successful Group Deletion	Cloud Groups, Account Manipulation	Hunting
ASL AWS SAML Update identity provider	Valid Accounts	TTP
ASL AWS New MFA Method Registered For User	Multi-Factor Authentication	TTP
ASL AWS IAM Assume Role Policy Brute Force	Brute Force, Cloud Infrastructure Discovery	TTP
ASL AWS Network Access Control List Created with All Open Ports	Cloud Firewall	TTP
ASL AWS IAM Delete Policy	Account Manipulation	Hunting
ASL AWS Defense Evasion Delete Cloudtrail	Disable or Modify Cloud Log	TTP
ASL AWS Defense Evasion PutBucketLifecycle	Lifecycle-Triggered Deletion, Disable or Modify Cloud Log	Hunting
ASL AWS Concurrent Sessions From Different Ips	Browser Session Hijacking	Anomaly
ASL AWS ECR Container Upload Unknown User	Malicious Image	Anomaly

Supported Apps

Splunk Add-on for AWS (version 8.2.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">accountid</span>
  
  <span class="pill kill-chain">activity_id</span>
  
  <span class="pill kill-chain">activity_name</span>
  
  <span class="pill kill-chain">actor.idp.name</span>
  
  <span class="pill kill-chain">actor.invoked_by</span>
  
  <span class="pill kill-chain">actor.session.created_time_dt</span>
  
  <span class="pill kill-chain">actor.session.is_mfa</span>
  
  <span class="pill kill-chain">actor.session.issuer</span>
  
  <span class="pill kill-chain">actor.user.account.uid</span>
  
  <span class="pill kill-chain">actor.user.credential_uid</span>
  
  <span class="pill kill-chain">actor.user.name</span>
  
  <span class="pill kill-chain">actor.user.type</span>
  
  <span class="pill kill-chain">actor.user.uid</span>
  
  <span class="pill kill-chain">actor.user.uid_alt</span>
  
  <span class="pill kill-chain">api.operation</span>
  
  <span class="pill kill-chain">api.request.data</span>
  
  <span class="pill kill-chain">api.request.uid</span>
  
  <span class="pill kill-chain">api.response.data</span>
  
  <span class="pill kill-chain">api.response.error</span>
  
  <span class="pill kill-chain">api.response.message</span>
  
  <span class="pill kill-chain">api.service.name</span>
  
  <span class="pill kill-chain">api.version</span>
  
  <span class="pill kill-chain">asl_version</span>
  
  <span class="pill kill-chain">category_name</span>
  
  <span class="pill kill-chain">category_uid</span>
  
  <span class="pill kill-chain">class_name</span>
  
  <span class="pill kill-chain">class_uid</span>
  
  <span class="pill kill-chain">cloud.provider</span>
  
  <span class="pill kill-chain">cloud.region</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dst_endpoint.svc_name</span>
  
  <span class="pill kill-chain">eventtype</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">http_request.user_agent</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">is_mfa</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">metadata.event_code</span>
  
  <span class="pill kill-chain">metadata.product.feature.name</span>
  
  <span class="pill kill-chain">metadata.product.name</span>
  
  <span class="pill kill-chain">metadata.product.vendor_name</span>
  
  <span class="pill kill-chain">metadata.product.version</span>
  
  <span class="pill kill-chain">metadata.profiles</span>
  
  <span class="pill kill-chain">metadata.uid</span>
  
  <span class="pill kill-chain">metadata.version</span>
  
  <span class="pill kill-chain">observables.name</span>
  
  <span class="pill kill-chain">observables.type</span>
  
  <span class="pill kill-chain">observables.type_id</span>
  
  <span class="pill kill-chain">observables.value</span>
  
  <span class="pill kill-chain">policy.uid</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">region</span>
  
  <span class="pill kill-chain">resources</span>
  
  <span class="pill kill-chain">session.credential_uid</span>
  
  <span class="pill kill-chain">session.issuer</span>
  
  <span class="pill kill-chain">session.uid</span>
  
  <span class="pill kill-chain">session.uid_alt</span>
  
  <span class="pill kill-chain">severity</span>
  
  <span class="pill kill-chain">severity_id</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src_endpoint.domain</span>
  
  <span class="pill kill-chain">src_endpoint.ip</span>
  
  <span class="pill kill-chain">src_endpoint.uid</span>
  
  <span class="pill kill-chain">status</span>
  
  <span class="pill kill-chain">tag</span>
  
  <span class="pill kill-chain">tag::eventtype</span>
  
  <span class="pill kill-chain">time</span>
  
  <span class="pill kill-chain">time_dt</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">type_name</span>
  
  <span class="pill kill-chain">type_uid</span>
  
  <span class="pill kill-chain">unmapped.managementEvent</span>
  
  <span class="pill kill-chain">unmapped.readOnly</span>
  
  <span class="pill kill-chain">unmapped.recipientAccountId</span>
  
  <span class="pill kill-chain">unmapped.sessionCredentialFromConsole</span>
  
  <span class="pill kill-chain">unmapped.tlsDetails.cipherSuite</span>
  
  <span class="pill kill-chain">unmapped.tlsDetails.clientProvidedHostHeader</span>
  
  <span class="pill kill-chain">unmapped.tlsDetails.tlsVersion</span>
  
  <span class="pill kill-chain">unmapped.userIdentity.sessionContext.sessionIssuer.accountId</span>
  
  <span class="pill kill-chain">unmapped.userIdentity.sessionContext.sessionIssuer.principalId</span>
  
  <span class="pill kill-chain">unmapped.userIdentity.sessionContext.sessionIssuer.type</span>
  
  <span class="pill kill-chain">unmapped.userIdentity.sessionContext.sessionIssuer.userName</span>
  
  <span class="pill kill-chain">user.name</span>
  
  <span class="pill kill-chain">user.uid</span>
  
  <span class="pill kill-chain">user.uid_alt</span>
  
</div>

Example Log

1{"metadata":{"product":{"version":"1.10","name":"CloudTrail","vendor_name":"AWS","feature":{"name":"Management"}},"event_code":"AwsApiCall","uid":"721b851c-40ec-4a1a-9d81-666641ab0d8e","profiles":"cloud","profiles":"datetime","version":"1.1.0"},"time":1733922792000,"time_dt":1733922792000,"cloud":{"region":"us-east-1","provider":"AWS"},"api":{"response":{"error":"","message":"","data":""},"operation":"DeleteGroup","version":"","service":{"name":"iam.amazonaws.com"},"request":{"data":"{\"groupName\":\"test\"}","uid":"89c19a56-3257-40c1-a36d-ad461ce9be53"}},"dst_endpoint":{"svc_name":""},"actor":{"user":{"type":"IAMUser","name":"test","uid_alt":"AAAAAAAAAAAAAAAAAAAA","uid":"arn:aws:iam::222222222222:user/test","account":{"uid":"222222222222"},"credential_uid":"AAAAAAAAAAAAAAAAAAAAA"},"session":{"created_time_dt":"0","is_mfa":false,"issuer":""},"invoked_by":"","idp":{"name":""}},"http_request":{"user_agent":"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/macos#24.1.0 md/arch#arm64 lang/python#3.12.7 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#iam.delete-group"},"src_endpoint":{"uid":"","ip":"84.174.65.161","domain":""},"session":{"uid":"","uid_alt":"","credential_uid":"","issuer":""},"policy":{"uid":""},"resources":null,"class_name":"Account Change","class_uid":3001,"category_name":"Identity & Access Management","category_uid":3,"severity_id":1,"severity":"Informational","user":{"uid_alt":"","uid":"","name":""},"activity_name":"Delete","activity_id":6,"type_uid":300106,"type_name":"Account Change: Delete","status":"Success","is_mfa":false,"unmapped":{"tlsDetails.clientProvidedHostHeader":"iam.amazonaws.com","recipientAccountId":"222222222222","readOnly":"false","tlsDetails.tlsVersion":"TLSv1.3","managementEvent":"true","tlsDetails.cipherSuite":"TLS_AES_128_GCM_SHA256"},"accountid":"","region":"","asl_version":"","observables":{"name":"src_endpoint.ip","name":"actor.user.name","value":"84.174.65.161","value":"test","type":"IP Address","type":"User Name","type_id":2,"type_id":4}}

Required Output Fields

dest
user
user_agent
src
vendor_account
vendor_region
vendor_product

Source: GitHub | Version: 4