Data Source: AWS CloudTrail

Created: 2024-07-16

Last Updated: 2026-10-14

ID: e8ace6db-1dbd-4c72-a1fb-334684619a38

Author: Patrick Bareiss, Splunk

Description

All AWS CloudTrail events

Details

Property	Value
Source	`aws_cloudtrail`
Sourcetype	`aws:cloudtrail`
Separator	eventName

Name ▲▼	Technique ▲▼	Type ▲▼
AWS Repeated CloudWatch Logs Read Operations	Data from Cloud Storage	TTP
AWS IAM AccessDenied Discovery Events	Cloud Infrastructure Discovery	Anomaly
AWS Lambda UpdateFunctionCode	User Execution	Hunting
AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity	SSH, Direct Cloud VM Connections	TTP
AWS Anomalous Secrets Manager Batch Retrieval	Cloud Secrets Management Stores	TTP
Cloud Security Groups Modifications by User	Modify Cloud Compute Configurations	Anomaly
AWS Bedrock High Number List Foundation Model Failures	Cloud Infrastructure Discovery	TTP
AWS IAM Role Created with External Trust	Additional Cloud Roles	TTP
Detect New Open S3 Buckets over AWS CLI	Data from Cloud Storage	TTP
AWS IAM Assume Role Policy Brute Force	Brute Force, Cloud Infrastructure Discovery	TTP
AWS EC2 Startup Script Modified on Stopped Instance	Modify Cloud Compute Configurations	TTP
AWS Excessive Security Scanning	Cloud Service Discovery	TTP
AWS Detect Users with KMS keys performing encryption S3	Data Encrypted for Impact	Anomaly
AWS Bedrock Invoke Model Access Denied	Valid Accounts, Use Alternate Authentication Material	TTP
Detect New Open S3 buckets	Data from Cloud Storage	TTP
Cloud Provisioning Activity From Previously Unseen IP Address	Valid Accounts	Anomaly
Detect AWS Console Login by New User	Unsecured Credentials, Cloud Accounts	Hunting
Cloud Provisioning Activity From Previously Unseen Country	Valid Accounts	Anomaly
Cloud Instance Modified By Previously Unseen User	Cloud Accounts	Anomaly
Detect AWS Console Login by User from New Region	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
Cloud Compute Instance Created By Previously Unseen User	Cloud Accounts	Anomaly
Cloud Provisioning Activity From Previously Unseen City	Valid Accounts	Anomaly
Detect Spike in S3 Bucket deletion	Data from Cloud Storage	Anomaly
Cloud Compute Instance Created With Previously Unseen Instance Type	Create Cloud Instance	Anomaly
Detect AWS Console Login by User from New Country	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
Cloud Compute Instance Created With Previously Unseen Image	None	Anomaly
Cloud Compute Instance Created In Previously Unused Region	Unused/Unsupported Cloud Regions	Anomaly
Detect AWS Console Login by User from New City	Unused/Unsupported Cloud Regions, Cloud Accounts	Hunting
Cloud API Calls From Previously Unseen User Roles	Valid Accounts	Anomaly
Cloud Provisioning Activity From Previously Unseen Region	Valid Accounts	Anomaly

Supported Apps

Splunk Add-on for AWS (version 8.2.2)

Event Fields

+ Fields

  <span class="pill kill-chain">_time</span>
  
  <span class="pill kill-chain">app</span>
  
  <span class="pill kill-chain">aws_account_id</span>
  
  <span class="pill kill-chain">awsRegion</span>
  
  <span class="pill kill-chain">change_type</span>
  
  <span class="pill kill-chain">command</span>
  
  <span class="pill kill-chain">date_hour</span>
  
  <span class="pill kill-chain">date_mday</span>
  
  <span class="pill kill-chain">date_minute</span>
  
  <span class="pill kill-chain">date_month</span>
  
  <span class="pill kill-chain">date_second</span>
  
  <span class="pill kill-chain">date_wday</span>
  
  <span class="pill kill-chain">date_year</span>
  
  <span class="pill kill-chain">date_zone</span>
  
  <span class="pill kill-chain">dest</span>
  
  <span class="pill kill-chain">dvc</span>
  
  <span class="pill kill-chain">errorCode</span>
  
  <span class="pill kill-chain">eventCategory</span>
  
  <span class="pill kill-chain">eventID</span>
  
  <span class="pill kill-chain">eventName</span>
  
  <span class="pill kill-chain">eventSource</span>
  
  <span class="pill kill-chain">eventTime</span>
  
  <span class="pill kill-chain">eventType</span>
  
  <span class="pill kill-chain">eventVersion</span>
  
  <span class="pill kill-chain">host</span>
  
  <span class="pill kill-chain">index</span>
  
  <span class="pill kill-chain">linecount</span>
  
  <span class="pill kill-chain">managementEvent</span>
  
  <span class="pill kill-chain">msg</span>
  
  <span class="pill kill-chain">object_category</span>
  
  <span class="pill kill-chain">product</span>
  
  <span class="pill kill-chain">punct</span>
  
  <span class="pill kill-chain">readOnly</span>
  
  <span class="pill kill-chain">recipientAccountId</span>
  
  <span class="pill kill-chain">region</span>
  
  <span class="pill kill-chain">requestID</span>
  
  <span class="pill kill-chain">requestParameters.dryRun</span>
  
  <span class="pill kill-chain">requestParameters.fullyQualifiedArn.arnPrefix.account</span>
  
  <span class="pill kill-chain">requestParameters.fullyQualifiedArn.arnPrefix.partition</span>
  
  <span class="pill kill-chain">requestParameters.fullyQualifiedArn.arnPrefix.region</span>
  
  <span class="pill kill-chain">requestParameters.fullyQualifiedArn.relativeId.functionName</span>
  
  <span class="pill kill-chain">requestParameters.functionName</span>
  
  <span class="pill kill-chain">requestParameters.publish</span>
  
  <span class="pill kill-chain">responseElements.architectures{}</span>
  
  <span class="pill kill-chain">responseElements.codeSha256</span>
  
  <span class="pill kill-chain">responseElements.codeSize</span>
  
  <span class="pill kill-chain">responseElements.description</span>
  
  <span class="pill kill-chain">responseElements.functionArn</span>
  
  <span class="pill kill-chain">responseElements.functionName</span>
  
  <span class="pill kill-chain">responseElements.handler</span>
  
  <span class="pill kill-chain">responseElements.lastModified</span>
  
  <span class="pill kill-chain">responseElements.lastUpdateStatus</span>
  
  <span class="pill kill-chain">responseElements.lastUpdateStatusReason</span>
  
  <span class="pill kill-chain">responseElements.lastUpdateStatusReasonCode</span>
  
  <span class="pill kill-chain">responseElements.memorySize</span>
  
  <span class="pill kill-chain">responseElements.packageType</span>
  
  <span class="pill kill-chain">responseElements.revisionId</span>
  
  <span class="pill kill-chain">responseElements.role</span>
  
  <span class="pill kill-chain">responseElements.runtime</span>
  
  <span class="pill kill-chain">responseElements.state</span>
  
  <span class="pill kill-chain">responseElements.stateReason</span>
  
  <span class="pill kill-chain">responseElements.stateReasonCode</span>
  
  <span class="pill kill-chain">responseElements.timeout</span>
  
  <span class="pill kill-chain">responseElements.tracingConfig.mode</span>
  
  <span class="pill kill-chain">responseElements.version</span>
  
  <span class="pill kill-chain">signature</span>
  
  <span class="pill kill-chain">source</span>
  
  <span class="pill kill-chain">sourceIPAddress</span>
  
  <span class="pill kill-chain">sourcetype</span>
  
  <span class="pill kill-chain">splunk_server</span>
  
  <span class="pill kill-chain">src</span>
  
  <span class="pill kill-chain">src_ip</span>
  
  <span class="pill kill-chain">src_user</span>
  
  <span class="pill kill-chain">start_time</span>
  
  <span class="pill kill-chain">timeendpos</span>
  
  <span class="pill kill-chain">timestartpos</span>
  
  <span class="pill kill-chain">user</span>
  
  <span class="pill kill-chain">user_access_key</span>
  
  <span class="pill kill-chain">user_agent</span>
  
  <span class="pill kill-chain">user_arn</span>
  
  <span class="pill kill-chain">user_group_id</span>
  
  <span class="pill kill-chain">user_name</span>
  
  <span class="pill kill-chain">user_type</span>
  
  <span class="pill kill-chain">userAgent</span>
  
  <span class="pill kill-chain">userIdentity.accessKeyId</span>
  
  <span class="pill kill-chain">userIdentity.accountId</span>
  
  <span class="pill kill-chain">userIdentity.arn</span>
  
  <span class="pill kill-chain">userIdentity.principalId</span>
  
  <span class="pill kill-chain">userIdentity.type</span>
  
  <span class="pill kill-chain">userIdentity.userName</span>
  
  <span class="pill kill-chain">userName</span>
  
  <span class="pill kill-chain">vendor</span>
  
  <span class="pill kill-chain">vendor_account</span>
  
  <span class="pill kill-chain">vendor_product</span>
  
  <span class="pill kill-chain">vendor_region</span>
  
</div>

Example Log

1{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-02-25T00:53:49Z", "eventSource": "lambda.amazonaws.com", "eventName": "UpdateFunctionCode20150331v2", "awsRegion": "us-west-2", "sourceIPAddress": "73.202.156.34", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/lambda.update-function-code", "requestParameters": {"fullyQualifiedArn": {"arnPrefix": {"partition": "aws", "region": "us-west-2", "account": "111111111111"}, "relativeId": {"functionName": "bhavin_test"}, "functionQualifier": {}}, "functionName": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test", "publish": true, "dryRun": false}, "responseElements": {"functionName": "bhavin_test", "functionArn": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test:1", "runtime": "python3.8", "role": "arn:aws:iam::111111111111:role/service-role/bhavin_test-role-7ppg8rck", "handler": "lambda_function.lambda_handler", "codeSize": 779, "description": "", "timeout": 3, "memorySize": 128, "lastModified": "2022-02-25T00:53:49.000+0000", "codeSha256": "cn+ec5LfJBeR4xOhy4XT2AhTndy6uQ268Iu+hY1WGS8=", "version": "1", "environment": {}, "tracingConfig": {"mode": "PassThrough"}, "revisionId": "c617a19c-1192-40d0-af2f-9d51b41494b6", "state": "Pending", "stateReason": "The function is being created.", "stateReasonCode": "Creating", "packageType": "Zip", "architectures": ["x86_64"]}, "requestID": "bcbb506f-d09c-4f28-83dc-717c4eafc182", "eventID": "4ac2b1d2-cfb8-4da8-b3b5-c2c0e85495c3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}

Source: GitHub | Version: 3

Data Source: AWS CloudTrail

Description

Details

Related Detections

Supported Apps

Event Fields

Example Log