name: aws-cloudtrail
fieldsToBeRemovedBeforeParsing: []
testCases:
  - assertions:
      - fieldsHaveValues:
          Vendor.userIdentity.arn: arn:aws:iam::1312312312312312:user/jasdaqweq
          Vendor.responseElements.instancesSet.items[0].metadataOptions.httpTokens: optional
          Vendor.userIdentity.accessKeyId: MY_ACCESS_KEY
          Vendor.requestParameters.clientToken: 981AVD-7A99-467E-9F60-C4CDC040FFFF
          Vendor.responseElements.instancesSet.items[0].hypervisor: xen
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[5].value: KLK
          Vendor.requestParameters.networkInterfaceSet.items[0].deviceIndex: '0'
          event.provider: ec2.amazonaws.com
          Vendor.responseElements.instancesSet.items[0].tagSet.items[5].value: abc.adasd
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[2].key: department
          Vendor.responseElements.instancesSet.items[0].tagSet.items[3].value: Operations
          Vendor.responseElements.instancesSet.items[0].placement.tenancy: default
          Vendor.responseElements.instancesSet.items[0].hibernationOptions.configured: 'false'
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].subnetId: subnet-0a12312a123123cbdasdds27a4
          Vendor.responseElements.instancesSet.items[0].architecture: x86_64
          Vendor.requestParameters.networkInterfaceSet.items[0].groupSet.items[0].groupId: sg-09131jj23d0asda123
          Vendor.responseElements.instancesSet.items[0].instanceState.name: pending
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].sourceDestCheck: 'true'
          Vendor.responseElements.instancesSet.items[0].enclaveOptions.enabled: 'false'
          Vendor.responseElements.instancesSet.items[0].stateReason.message: pending
          Vendor.managementEvent: 'true'
          Vendor.responseElements.instancesSet.items[0].metadataOptions.httpEndpoint: enabled
          event.type[0]: info
          Vendor.requestParameters.tagSpecificationSet.items[0].resourceType: instance
          Vendor.requestParameters.networkInterfaceSet.items[0].privateIpAddress: 10.1.1.39
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[0].key: operations
          Vendor.responseElements.instancesSet.items[0].vpcId: vpc-0fad1123dasd
          Vendor.requestParameters.disableApiStop: 'false'
          Vendor.responseElements.instancesSet.items[0].metadataOptions.state: pending
          '#event.outcome': success
          Vendor.responseElements.instancesSet.items[0].sourceDestCheck: 'true'
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[0].value: dev
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[3].key: owner
          Vendor.responseElements.instancesSet.items[0].tagSet.items[1].value: dev
          Vendor.userIdentity.principalId: AAABBBDSADASDASDASDASD
          Vendor.responseElements.instancesSet.items[0].privateIpAddress: 10.1.1.39
          Vendor.requestParameters.networkInterfaceSet.items[0].subnetId: subnet-0k881231ddasd1231
          Vendor.eventType: AwsApiCall
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].groupSet.items[0].groupId: sg-0126a9879ederererb543
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[5].key: team
          event.id: 3cdf2kjk-c777-49aa-8b4f-2f4743853638
          Vendor.requestParameters.availabilityZone: us-west-2a
          user.id: AAABBBDSADASDASDASDASD
          Vendor.responseElements.instancesSet.items[0].rootDeviceName: /dev/sda1
          Vendor.responseElements.instancesSet.items[0].instanceType: t2.medium
          Vendor.eventID: 3cdf2kjk-c777-49aa-8b4f-2f4743853638
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].attachment.attachmentId: eni-attach-086b4db5d59764207
          Vendor.responseElements.instancesSet.items[0].cpuOptions.coreCount: '2'
          Vendor.requestParameters.monitoring.enabled: 'false'
          Vendor.eventCategory: Management
          Vendor.requestParameters.instancesSet.items[0].keyName: Stage2_Provisioning
          Vendor.recipientAccountId: '517716713836'
          Vendor.responseElements.instancesSet.items[0].launchTime: '1631676699000'
          Vendor.responseElements.instancesSet.items[0].instanceState.code: '0'
          Vendor.requestParameters.ebsOptimized: 'false'
          Vendor.responseElements.instancesSet.items[0].tagSet.items[0].value: DASDADDDS
          Vendor.responseElements.instancesSet.items[0].rootDeviceType: ebs
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].attachment.status: attaching
          Vendor.responseElements.instancesSet.items[0].clientToken: 98ADSAD67-4A69-467E-9F60-C4CDC040FFFF
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[3].value: asdasdasdasd
          Vendor.responseElements.ownerId: '1312312312312312'
          Vendor.userAgent: APN/1.0 HashiCorp/1.0 Terraform/1.0.6 (+https://www.terraform.io)
            terraform-provider-aws/3.50.0 (+https://registry.terraform.io/providers/hashicorp/aws)
            aws-sdk-go/1.39.5 (go1.16; linux; amd64)
          '#event.kind': event
          Vendor.responseElements.instancesSet.items[0].ebsOptimized: 'false'
          Vendor.responseElements.instancesSet.items[0].monitoring.state: disabled
          Vendor.sourceIPAddress: 70.193.98.109
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].attachment.deviceIndex: '0'
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[1].value: CS-MRC-AVD-EMU-CENTOS-DASDASD-BACKUP
          cloud.account.id: '1312312312312312'
          Vendor.responseElements.instancesSet.items[0].tagSet.items[2].key: department
          event.category[0]: configuration
          Vendor.responseElements.instancesSet.items[0].tagSet.items[4].key: team
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[4].value: Operation
          Vendor.responseElements.requestId: 8973da134-a8f8-4437-a53a-1b41eecf180d
          Vendor.responseElements.instancesSet.items[0].metadataOptions.httpProtocolIpv4: enabled
          source.address: 70.193.98.109
          Vendor.responseElements.instancesSet.items[0].tagSet.items[1].key: account
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].macAddress: 09:39:ae:66:fd:sg
          Vendor.eventSource: ec2.amazonaws.com
          Vendor.requestParameters.instancesSet.items[0].minCount: '1'
          Vendor.responseElements.instancesSet.items[0].metadataOptions.httpPutResponseHopLimit: '1'
          Vendor.responseElements.instancesSet.items[0].cpuOptions.threadsPerCore: '1'
          '#event.dataset': cloudtrail.s3
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].status: in-use
          Vendor.responseElements.instancesSet.items[0].tagSet.items[3].key: business
          Vendor.requestParameters.instancesSet.items[0].imageId: ami-cf8d9cfj8d2322a458fc
          event.type[1]: start
          '#event.module': cloudtrail
          Vendor.requestParameters.instanceType: t2.medium
          Vendor.responseElements.instancesSet.items[0].enaSupport: 'true'
          Vendor.requestParameters.instancesSet.items[0].maxCount: '1'
          Vendor.responseElements.instancesSet.items[0].imageId: ami-03cf312312f22a458fc
          source.ip: 70.193.98.109
          Vendor.responseElements.instancesSet.items[0].stateReason.code: pending
          Vendor.responseElements.instancesSet.items[0].tagSet.items[4].value: Dev
          Vendor.eventTime: '2021-09-15T03:31:39Z'
          Vendor.eventVersion: '1.08'
          Vendor.responseElements.instancesSet.items[0].tagSet.items[2].value: Engineer
            - 310000
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[2].value: Account
          Vendor.responseElements.instancesSet.items[0].groupSet.items[0].groupName: Group1
          user_agent.original: APN/1.0 HashiCorp/1.0 Terraform/1.0.6 (+https://www.terraform.io)
            terraform-provider-aws/3.50.0 (+https://registry.terraform.io/providers/hashicorp/aws)
            aws-sdk-go/1.39.5 (go1.16; linux; amd64)
          Vendor.eventName: RunInstances
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].vpcId: vpc-0e92ceasdasd123123asdasb5ce6b
          Vendor.awsRegion: us-west-2
          Vendor.userIdentity.accountId: '1312312312312312'
          Vendor.requestID: 257d5926-a8f8-4437-a53a-1b41eecf180d
          Vendor.responseElements.instancesSet.items[0].keyName: Stage2_Provisioning
          Vendor.responseElements.instancesSet.items[0].metadataOptions.httpProtocolIpv6: disabled
          cloud.region: us-west-2
          Vendor.readOnly: 'false'
          event.action: RunInstances
          Vendor.responseElements.instancesSet.items[0].virtualizationType: hvm
          Vendor.userIdentity.type: IAMUser
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[4].key: business
          cloud.provider: aws
          Vendor.userIdentity.userName: jasdaqweq
          Vendor.responseElements.instancesSet.items[0].tagSet.items[5].key: owner
          Vendor.responseElements.instancesSet.items[0].subnetId: subnet-0a848a85cbcdb27a4
          Vendor.responseElements.instancesSet.items[0].placement.availabilityZone: us-west-2a
          user.name: jasdaqweq
          Vendor.requestParameters.disableApiTermination: 'false'
          Vendor.responseElements.instancesSet.items[0].privateDnsName: ip-10-1-1-39.us-west-2.compute.internal
          Vendor.responseElements.instancesSet.items[0].tagSet.items[0].key: Name
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].networkInterfaceId: eni-01beb6c9f0ad81791
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].privateIpAddress: 10.1.1.39
          Vendor.requestParameters.hibernationOptions.configured: 'false'
          Vendor.responseElements.instancesSet.items[0].groupSet.items[0].groupId: sg-0126a987asd123asdaeb210
          Vendor.requestParameters.tagSpecificationSet.items[0].tags[1].key: Name
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].attachment.attachTime: '1631676699000'
          Vendor.responseElements.instancesSet.items[0].amiLaunchIndex: '0'
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].ownerId: '1312312312312312'
          Vendor.responseElements.instancesSet.items[0].networkInterfaceSet.items[0].interfaceType: interface
          Vendor.responseElements.reservationId: r-0f797d98ae69a012dasd
          Vendor.responseElements.instancesSet.items[0].instanceId: i-0889c4d2ef466e98
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId":
      "AAABBBDSADASDASDASDASD", "arn": "arn:aws:iam::1312312312312312:user/jasdaqweq",
      "accountId": "1312312312312312", "accessKeyId": "MY_ACCESS_KEY", "userName":
      "jasdaqweq"}, "eventTime": "2021-09-15T03:31:39Z", "eventSource": "ec2.amazonaws.com",
      "eventName": "RunInstances", "awsRegion": "us-west-2", "sourceIPAddress": "70.193.98.109",
      "userAgent": "APN/1.0 HashiCorp/1.0 Terraform/1.0.6 (+https://www.terraform.io)
      terraform-provider-aws/3.50.0 (+https://registry.terraform.io/providers/hashicorp/aws)
      aws-sdk-go/1.39.5 (go1.16; linux; amd64)", "requestParameters": {"instancesSet":
      {"items": [{"imageId": "ami-cf8d9cfj8d2322a458fc", "minCount": 1, "maxCount":
      1, "keyName": "Stage2_Provisioning"}]}, "instanceType": "t2.medium", "blockDeviceMapping":
      {}, "availabilityZone": "us-west-2a", "monitoring": {"enabled": false}, "disableApiTermination":
      false, "disableApiStop": false, "clientToken": "981AVD-7A99-467E-9F60-C4CDC040FFFF",
      "networkInterfaceSet": {"items": [{"deviceIndex": 0, "subnetId": "subnet-0k881231ddasd1231",
      "privateIpAddress": "10.1.1.39", "groupSet": {"items": [{"groupId": "sg-09131jj23d0asda123"}]}}]},
      "iamInstanceProfile": {}, "ebsOptimized": false, "tagSpecificationSet": {"items":
      [{"resourceType": "instance", "tags": [{"key": "operations", "value": "dev"},
      {"key": "Name", "value": "CS-MRC-AVD-EMU-CENTOS-DASDASD-BACKUP"}, {"key": "department",
      "value": "Account"}, {"key": "owner", "value": "asdasdasdasd"}, {"key": "business",
      "value": "Operation"}, {"key": "team", "value": "KLK"}]}]}, "hibernationOptions":
      {"configured": false}}, "responseElements": {"requestId": "8973da134-a8f8-4437-a53a-1b41eecf180d",
      "reservationId": "r-0f797d98ae69a012dasd", "ownerId": "1312312312312312", "groupSet":
      {}, "instancesSet": {"items": [{"instanceId": "i-0889c4d2ef466e98", "imageId":
      "ami-03cf312312f22a458fc", "instanceState": {"code": 0, "name": "pending"},
      "privateDnsName": "ip-10-1-1-39.us-west-2.compute.internal", "keyName": "Stage2_Provisioning",
      "amiLaunchIndex": 0, "productCodes": {}, "instanceType": "t2.medium", "launchTime":
      1631676699000, "placement": {"availabilityZone": "us-west-2a", "tenancy": "default"},
      "monitoring": {"state": "disabled"}, "subnetId": "subnet-0a848a85cbcdb27a4",
      "vpcId": "vpc-0fad1123dasd", "privateIpAddress": "10.1.1.39", "stateReason":
      {"code": "pending", "message": "pending"}, "architecture": "x86_64", "rootDeviceType":
      "ebs", "rootDeviceName": "/dev/sda1", "blockDeviceMapping": {}, "virtualizationType":
      "hvm", "hypervisor": "xen", "tagSet": {"items": [{"key": "Name", "value": "DASDADDDS"},
      {"key": "account", "value": "dev"}, {"key": "department", "value": "Engineer
      - 310000"}, {"key": "business", "value": "Operations"}, {"key": "team", "value":
      "Dev"}, {"key": "owner", "value": "abc.adasd"}]}, "clientToken": "98ADSAD67-4A69-467E-9F60-C4CDC040FFFF",
      "groupSet": {"items": [{"groupId": "sg-0126a987asd123asdaeb210", "groupName":
      "Group1"}]}, "sourceDestCheck": true, "networkInterfaceSet": {"items": [{"networkInterfaceId":
      "eni-01beb6c9f0ad81791", "subnetId": "subnet-0a12312a123123cbdasdds27a4", "vpcId":
      "vpc-0e92ceasdasd123123asdasb5ce6b", "ownerId": "1312312312312312", "status":
      "in-use", "macAddress": "09:39:ae:66:fd:sg", "privateIpAddress": "10.1.1.39",
      "sourceDestCheck": true, "interfaceType": "interface", "groupSet": {"items":
      [{"groupId": "sg-0126a9879ederererb543", "groupName": "Group1"}]}, "attachment":
      {"attachmentId": "eni-attach-086b4db5d59764207", "deviceIndex": 0, "networkCardIndex":
      0, "status": "attaching", "attachTime": 1631676699000, "deleteOnTermination":
      true}, "privateIpAddressesSet": {"item": [{"privateIpAddress": "10.1.1.39",
      "primary": true}]}, "ipv6AddressesSet": {}, "tagSet": {}}]}, "ebsOptimized":
      false, "enaSupport": true, "cpuOptions": {"coreCount": 2, "threadsPerCore":
      1}, "capacityReservationSpecification": {"capacityReservationPreference": "open"},
      "hibernationOptions": {"configured": false}, "enclaveOptions": {"enabled": false},
      "metadataOptions": {"state": "pending", "httpTokens": "optional", "httpPutResponseHopLimit":
      1, "httpEndpoint": "enabled", "httpProtocolIpv4": "enabled", "httpProtocolIpv6":
      "disabled"}}]}}, "requestID": "257d5926-a8f8-4437-a53a-1b41eecf180d", "eventID":
      "3cdf2kjk-c777-49aa-8b4f-2f4743853638", "readOnly": false, "eventType": "AwsApiCall",
      "managementEvent": true, "recipientAccountId": "517716713836", "eventCategory":
      "Management"}'
  - assertions:
      - fieldsHaveValues:
          event.provider: signin.amazonaws.com
          event.type[0]: start
          '#event.outcome': failure
          Vendor.userIdentity.principalId: AIDACKCEVSQ6C2EXAMPLE
          Vendor.recipientAccountId: '111122223333'
          event.category[0]: authentication
          source.address: 192.0.2.0
          '#event.dataset': cloudtrail.iam
          user.name: anaya
          Vendor.additionalEventData.MFAUsed: 'Yes'
          Vendor.responseElements.ConsoleLogin: Failure
          Vendor.additionalEventData.LoginTo: https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true
          event.id: d38ce1b3-4575-4cb8-a632-611b8243bfc3
          Vendor.eventType: AwsConsoleSignIn
          user.id: AIDACKCEVSQ6C2EXAMPLE
          Vendor.eventID: d38ce1b3-4575-4cb8-a632-611b8243bfc3
          Vendor.errorMessage: Failed authentication
          '#event.kind': event
          Vendor.userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36
            (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
          '#observer.type': iam
          Vendor.sourceIPAddress: 192.0.2.0
          cloud.account.id: '111122223333'
          error.message: Failed authentication
          Vendor.eventSource: signin.amazonaws.com
          source.ip: 192.0.2.0
          Vendor.eventTime: '2022-11-10T16:24:34Z'
          Vendor.eventVersion: '1.05'
          user_agent.original: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36
            (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
          Vendor.eventName: ConsoleLogin
          Vendor.awsRegion: us-east-1
          Vendor.userIdentity.accountId: '111122223333'
          cloud.region: us-east-1
          event.action: ConsoleLogin
          Vendor.userIdentity.type: IAMUser
          cloud.provider: aws
          Vendor.userIdentity.userName: anaya
          event.reason: Failed authentication
          Vendor.additionalEventData.MobileVersion: 'No'
    event:
      rawString: '{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"AIDACKCEVSQ6C2EXAMPLE","accountId":"111122223333","accessKeyId":"","userName":"anaya"},"eventTime":"2022-11-10T16:24:34Z","eventSource":"signin.amazonaws.com","eventName":"ConsoleLogin","awsRegion":"us-east-1","sourceIPAddress":"192.0.2.0","userAgent":"Mozilla/5.0
      (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99
      Safari/537.36","errorMessage":"Failed authentication","requestParameters":null,"responseElements":{"ConsoleLogin":"Failure"},"additionalEventData":{"LoginTo":"https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true","MobileVersion":"No","MFAUsed":"Yes"},"eventID":"d38ce1b3-4575-4cb8-a632-611b8243bfc3","eventType":"AwsConsoleSignIn","recipientAccountId":"111122223333"}'
  - assertions:
      - fieldsHaveValues:
          Vendor.userIdentity.arn: arn:aws:iam::111122223333:user/anaya
          event.provider: signin.amazonaws.com
          event.type[0]: start
          '#event.outcome': success
          Vendor.userIdentity.principalId: AIDACKCEVSQ6C2EXAMPLE
          Vendor.userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:62.0) Gecko/20100101
            Firefox/62.0
          event.category[0]: authentication
          source.address: 192.0.2.0
          Vendor.eventSource: signin.amazonaws.com
          '#event.dataset': cloudtrail.iam
          user.name: anaya
          Vendor.additionalEventData.MFAUsed: 'No'
          Vendor.responseElements.ConsoleLogin: Success
          Vendor.additionalEventData.LoginTo: https://console.aws.amazon.com/sns
          event.id: 3fcfb182-98f8-4744-bd45-10a395ab61cb
          Vendor.eventType: AwsConsoleSignIn
          user.id: AIDACKCEVSQ6C2EXAMPLE
          Vendor.eventID: 3fcfb182-98f8-4744-bd45-10a395ab61cb
          Vendor.sourceIPAddress: 192.0.2.0
          cloud.account.id: '111122223333'
          source.ip: 192.0.2.0
          Vendor.eventTime: '2022-11-10T16:24:34Z'
          Vendor.eventVersion: '1.05'
          user_agent.original: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:62.0)
            Gecko/20100101 Firefox/62.0
          Vendor.eventName: ConsoleLogin
          Vendor.awsRegion: us-east-2
          Vendor.userIdentity.accountId: '111122223333'
          cloud.region: us-east-2
          event.action: ConsoleLogin
          Vendor.userIdentity.type: IAMUser
          cloud.provider: aws
          Vendor.userIdentity.userName: anaya
          Vendor.additionalEventData.MobileVersion: 'No'
    event:
      rawString: '{"eventVersion":"1.05","userIdentity":{"type":"IAMUser","principalId":"AIDACKCEVSQ6C2EXAMPLE","arn":"arn:aws:iam::111122223333:user/anaya","accountId":"111122223333","userName":"anaya"},"eventTime":"2022-11-10T16:24:34Z","eventSource":"signin.amazonaws.com","eventName":"ConsoleLogin","awsRegion":"us-east-2","sourceIPAddress":"192.0.2.0","userAgent":"Mozilla/5.0
      (Macintosh; Intel Mac OS X 10.12; rv:62.0) Gecko/20100101 Firefox/62.0","requestParameters":null,"responseElements":{"ConsoleLogin":"Success"},"additionalEventData":{"MobileVersion":"No","LoginTo":"https://console.aws.amazon.com/sns","MFAUsed":"No"},"eventID":"3fcfb182-98f8-4744-bd45-10a395ab61cb","eventType":"AwsConsoleSignIn"}'
  - assertions:
      - fieldsHaveValues:
          Vendor.userIdentity.arn: arn:aws:iam::123456789012:user/Alice
          Vendor.userIdentity.accessKeyId: EXAMPLE_KEY_ID
          event.provider: ec2.amazonaws.com
          Vendor.requestParameters.keyName: mykeypair
          event.type[0]: admin
          '#event.outcome': success
          Vendor.userIdentity.principalId: EX_PRINCIPAL_ID
          Vendor.responseElements.keyFingerprint: 30:1d:46:d0:5b:ad:7e:1b:b6:70:62:8b:ff:38:b5:e9:ab:5d:b8:21
          Vendor.responseElements.keyName: mykeypair
          Vendor.userAgent: EC2ConsoleBackend, aws-sdk-java/Linux/x.xx.fleetxen Java_HotSpot(TM)_64-Bit_Server_VM/xx
          source.address: 72.21.198.64
          Vendor.eventSource: ec2.amazonaws.com
          user.name: alice
          user.id: EX_PRINCIPAL_ID
          Vendor.userIdentity.sessionContext.attributes.creationDate: '2014-03-06T15:15:06Z'
          Vendor.sourceIPAddress: 72.21.198.64
          cloud.account.id: '123456789012'
          Vendor.userIdentity.sessionContext.attributes.mfaAuthenticated: 'false'
          event.category[0]: iam
          '#event.dataset': cloudtrail.s3
          Vendor.responseElements.keyMaterial: <sensitiveDataRemoved>
          event.type[1]: creation
          source.ip: 72.21.198.64
          Vendor.eventTime: '2014-03-06T17:10:34Z'
          Vendor.eventVersion: '1.0'
          user_agent.original: EC2ConsoleBackend, aws-sdk-java/Linux/x.xx.fleetxen Java_HotSpot(TM)_64-Bit_Server_VM/xx
          Vendor.eventName: CreateKeyPair
          Vendor.awsRegion: us-east-2
          Vendor.userIdentity.accountId: '123456789012'
          cloud.region: us-east-2
          event.action: CreateKeyPair
          Vendor.userIdentity.type: IAMUser
          cloud.provider: aws
          Vendor.userIdentity.userName: Alice
    event:
      rawString: '{"eventVersion":"1.0","userIdentity":{"type":"IAMUser","principalId":"EX_PRINCIPAL_ID","arn":"arn:aws:iam::123456789012:user/Alice","accountId":"123456789012","accessKeyId":"EXAMPLE_KEY_ID","userName":"Alice","sessionContext":{"attributes":{"mfaAuthenticated":"false","creationDate":"2014-03-06T15:15:06Z"}}},"eventTime":"2014-03-06T17:10:34Z","eventSource":"ec2.amazonaws.com","eventName":"CreateKeyPair","awsRegion":"us-east-2","sourceIPAddress":"72.21.198.64","userAgent":"EC2ConsoleBackend,
      aws-sdk-java/Linux/x.xx.fleetxen Java_HotSpot(TM)_64-Bit_Server_VM/xx","requestParameters":{"keyName":"mykeypair"},"responseElements":{"keyName":"mykeypair","keyFingerprint":"30:1d:46:d0:5b:ad:7e:1b:b6:70:62:8b:ff:38:b5:e9:ab:5d:b8:21","keyMaterial":"<sensitiveDataRemoved>"}}'
  - assertions:
      - fieldsHaveValues:
          event.provider: sts.amazonaws.com
          Vendor.requestParameters.roleSessionName: TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61
          '#event.outcome': success
          Vendor.recipientAccountId: '517716713836'
          Vendor.responseElements.credentials.expiration: Mar 23, 2023, 6:17:59 PM
          event.category[0]: authentication
          source.address: trustedadvisor.amazonaws.com
          Vendor.eventSource: sts.amazonaws.com
          '#event.dataset': cloudtrail.iam
          user.name: trustedadvisor.amazonaws.com
          Vendor.resources[0].type: AWS::IAM::Role
          Vendor.responseElements.assumedRoleUser.assumedRoleId: AROAIL5KOFJKJPRVHHV3Y:TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61
          Vendor.responseElements.credentials.sessionToken: IQoJb3JpZ2luX2VjEPr//////////wEaCXVzLXdlc3QtMiJIMEYCIQDcDf6HQp1SS+zIB3bpGCZA0Ftz1ahEFLlBC14j7y2AjgIhAKYFI97L/PGNs6ELStuaH9lT4Z35oAHYZrEbO8ZBXitwKpwDCMP//////////wEQAhoMNTE3NzE2NzEzODM2IgxegainB0MXUhxt0EEq8AK3FQUoRZ7GCe7NTdtxMMM9+GJGbQqOLH9kESLYkZ84e5dqMbKQzRNpTynuT0IAwxjX3uWdUlqy0Xmd1rzMjPDJxHw5eu01ydASXvr485VHbOa86hI+K/6oIZOFlWs18xR9CnsOhmQPcGA7V7pHDjCP3NPTRQy+dct62AKVAGQ0tSOUQDkGZsxcREtxBOFAZCbJN1XNK8fI3yIpmeNyWA2/K+lAB+J/+7fAve9Zw/2cQhTdbeWdnQvYFreLFu14ZEXkQPNK+ctLMP5eiu40JIP1JnXH+2EpYtYLfnoLBlzqUqKB+Eg+DZVHcliS5rb3CX9dZucNXb3ben+IpWt1w/TLu6nQxl3hdoCXaRXFjO6gIAhcOmsd6uS7C9fHZ6NEAVXJpUIjqgvrPa3IBJfG97e1vCC9JxRpXaLob++OTXPwc3ups4j3iB5tByA2Kmuy6DLfnus/tBZrU2tGBZgMesxxbsmYr5DP3tNlWQq7+y7pKTDTqPKgBjq+AffSFsjaVxdWt42zAL0UvEJfLiMdTRIsI0AXtx2BFW79KD3oZJNafF3vh024Xc2QBbbK1LECLnaHM3Xzc+bpMTD39Y714JNT6EQbhLMVG9V12Z3ziyGkjOd+/K96yh602v7CDXexq9iFGNNDCBwWmANDoZ51twi+RdQfle1Sa3C0BXUwTaNR7rvSjLW2j8lUAv7G/08qrkgRP2WF+MLoObsUVHN4Xz28blVr7oN8eTOBhrHo4RkQS2CQQdoQ6Eg=
          Vendor.managementEvent: 'true'
          event.type[0]: info
          event.id: 97e66b9b-9636-41c7-a8bc-8abe4c61cf5e
          Vendor.userIdentity.invokedBy: trustedadvisor.amazonaws.com
          Vendor.eventType: AwsApiCall
          Vendor.resources[0].accountId: '517716713836'
          Vendor.eventID: 97e66b9b-9636-41c7-a8bc-8abe4c61cf5e
          Vendor.eventCategory: Management
          user.roles[0]: arn:aws:iam::517716713836:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor
          Vendor.userAgent: trustedadvisor.amazonaws.com
          Vendor.sourceIPAddress: trustedadvisor.amazonaws.com
          cloud.account.id: '517716713836'
          source.ip: trustedadvisor.amazonaws.com
          Vendor.sharedEventID: 6a3ba4af-a893-47a1-bf21-b3dfa21c54a9
          Vendor.eventTime: '2023-03-23T18:02:59Z'
          Vendor.eventVersion: '1.08'
          user_agent.original: trustedadvisor.amazonaws.com
          Vendor.eventName: AssumeRole
          Vendor.awsRegion: us-west-2
          Vendor.requestID: 841c3c5a-fb7b-4e72-b5e4-a0b4d1192e2a
          cloud.region: us-west-2
          Vendor.readOnly: 'true'
          event.action: AssumeRole
          Vendor.requestParameters.durationSeconds: '900'
          Vendor.userIdentity.type: AWSService
          Vendor.resources[0].ARN: arn:aws:iam::517716713836:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor
          cloud.provider: aws
          Vendor.responseElements.credentials.accessKeyId: MY_ACCESS_KEY
          Vendor.responseElements.assumedRoleUser.arn: arn:aws:sts::517716713836:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61
          Vendor.requestParameters.roleArn: arn:aws:iam::517716713836:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "AWSService", "invokedBy":
      "trustedadvisor.amazonaws.com"}, "eventTime": "2023-03-23T18:02:59Z", "eventSource":
      "sts.amazonaws.com", "eventName": "AssumeRole", "awsRegion": "us-west-2", "sourceIPAddress":
      "trustedadvisor.amazonaws.com", "userAgent": "trustedadvisor.amazonaws.com",
      "requestParameters": {"roleArn": "arn:aws:iam::517716713836:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor",
      "roleSessionName": "TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61",
      "durationSeconds": 900}, "responseElements": {"credentials": {"accessKeyId":
      "MY_ACCESS_KEY", "sessionToken": "IQoJb3JpZ2luX2VjEPr//////////wEaCXVzLXdlc3QtMiJIMEYCIQDcDf6HQp1SS+zIB3bpGCZA0Ftz1ahEFLlBC14j7y2AjgIhAKYFI97L/PGNs6ELStuaH9lT4Z35oAHYZrEbO8ZBXitwKpwDCMP//////////wEQAhoMNTE3NzE2NzEzODM2IgxegainB0MXUhxt0EEq8AK3FQUoRZ7GCe7NTdtxMMM9+GJGbQqOLH9kESLYkZ84e5dqMbKQzRNpTynuT0IAwxjX3uWdUlqy0Xmd1rzMjPDJxHw5eu01ydASXvr485VHbOa86hI+K/6oIZOFlWs18xR9CnsOhmQPcGA7V7pHDjCP3NPTRQy+dct62AKVAGQ0tSOUQDkGZsxcREtxBOFAZCbJN1XNK8fI3yIpmeNyWA2/K+lAB+J/+7fAve9Zw/2cQhTdbeWdnQvYFreLFu14ZEXkQPNK+ctLMP5eiu40JIP1JnXH+2EpYtYLfnoLBlzqUqKB+Eg+DZVHcliS5rb3CX9dZucNXb3ben+IpWt1w/TLu6nQxl3hdoCXaRXFjO6gIAhcOmsd6uS7C9fHZ6NEAVXJpUIjqgvrPa3IBJfG97e1vCC9JxRpXaLob++OTXPwc3ups4j3iB5tByA2Kmuy6DLfnus/tBZrU2tGBZgMesxxbsmYr5DP3tNlWQq7+y7pKTDTqPKgBjq+AffSFsjaVxdWt42zAL0UvEJfLiMdTRIsI0AXtx2BFW79KD3oZJNafF3vh024Xc2QBbbK1LECLnaHM3Xzc+bpMTD39Y714JNT6EQbhLMVG9V12Z3ziyGkjOd+/K96yh602v7CDXexq9iFGNNDCBwWmANDoZ51twi+RdQfle1Sa3C0BXUwTaNR7rvSjLW2j8lUAv7G/08qrkgRP2WF+MLoObsUVHN4Xz28blVr7oN8eTOBhrHo4RkQS2CQQdoQ6Eg=",
      "expiration": "Mar 23, 2023, 6:17:59 PM"}, "assumedRoleUser": {"assumedRoleId":
      "AROAIL5KOFJKJPRVHHV3Y:TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61",
      "arn": "arn:aws:sts::517716713836:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_517716713836_5a141c5b-1642-431c-9f96-a6a1e2108f61"}},
      "requestID": "841c3c5a-fb7b-4e72-b5e4-a0b4d1192e2a", "eventID": "97e66b9b-9636-41c7-a8bc-8abe4c61cf5e",
      "readOnly": true, "resources": [{"accountId": "517716713836", "type": "AWS::IAM::Role",
      "ARN": "arn:aws:iam::517716713836:role/aws-service-role/trustedadvisor.amazonaws.com/AWSServiceRoleForTrustedAdvisor"}],
      "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "517716713836",
      "sharedEventID": "6a3ba4af-a893-47a1-bf21-b3dfa21c54a9", "eventCategory": "Management"}'
  - assertions:
      - fieldsHaveValues:
          event.provider: sts.amazonaws.com
          Vendor.requestParameters.roleSessionName: splunk_ta_aws
          '#event.outcome': success
          Vendor.userIdentity.principalId: AIDAIMAXIDWFD5T3Y5JVY
          Vendor.recipientAccountId: '517716713836'
          event.category[0]: authentication
          source.address: 208.42.231.60
          Vendor.eventSource: sts.amazonaws.com
          '#event.dataset': cloudtrail.iam
          user.name: splunk_ta_aws
          Vendor.resources[0].type: AWS::IAM::Role
          Vendor.responseElements.assumedRoleUser.assumedRoleId: AROAXRCSSEFWOMMH2PEY2:splunk_ta_aws
          Vendor.responseElements.credentials.sessionToken: FwoGZXIvYXdzEAsaDDCg/kahN7C5NirdwSKxAXknJuoD7QkLqxvVlnKq3mccr+9+WOO5Z2I+/4dIltYAdvBMvwP3vNgLFNRJWvSRGbDkRqCTSExmFc0o8THP/vETjWDzsn3n2g7yD4HVBh6qd6DB03BesfyqBaYaBvBzFGySfKmLpjA93hIFSWhldyEHwmHnBLHcoP3EOZlBUr23L5edhFVhx+zxns8SlYqKFGwJHu4ZZz6OFYAE8Pbzda5qNcHdFk01rKSvibsmkgO67Cj6p/KgBjIt/dZdiuBMzmneXq732yZNHGVQDF+Lve7Mj86CspzoTiL7dhn462GVVsqODrpt
          Vendor.managementEvent: 'true'
          event.type[0]: info
          Vendor.tlsDetails.cipherSuite: ECDHE-RSA-AES128-GCM-SHA256
          Vendor.tlsDetails.clientProvidedHostHeader: sts.amazonaws.com
          event.id: a05fb1bf-78ee-43a2-86f9-d0608f260687
          Vendor.eventType: AwsApiCall
          user.id: AIDAIMAXIDWFD5T3Y5JVY
          Vendor.resources[0].accountId: '517716713836'
          Vendor.eventID: a05fb1bf-78ee-43a2-86f9-d0608f260687
          Vendor.eventCategory: Management
          Vendor.responseElements.credentials.expiration: Mar 23, 2023, 7:01:30 PM
          Vendor.tlsDetails.tlsVersion: TLSv1.2
          user.roles[0]: arn:aws:iam::517716713836:role/CS-AR-CORPSEC-SEIM
          Vendor.userAgent: Boto3/1.10.23 Python/3.7.4 Linux/5.4.0-137-generic Botocore/1.13.50
          Vendor.sourceIPAddress: 208.42.231.60
          cloud.account.id: '093619269037'
          source.ip: 208.42.231.60
          Vendor.sharedEventID: 82820856-99bd-4e06-bdde-d35283f9d7de
          Vendor.eventTime: '2023-03-23T18:01:30Z'
          Vendor.eventVersion: '1.08'
          user_agent.original: Boto3/1.10.23 Python/3.7.4 Linux/5.4.0-137-generic Botocore/1.13.50
          Vendor.eventName: AssumeRole
          Vendor.awsRegion: us-east-1
          Vendor.requestID: c04bd645-c8a4-4a60-b80a-ce3e840e2c85
          Vendor.userIdentity.accountId: '093619269037'
          cloud.region: us-east-1
          Vendor.readOnly: 'true'
          event.action: AssumeRole
          Vendor.requestParameters.durationSeconds: '3600'
          Vendor.userIdentity.type: AWSAccount
          Vendor.resources[0].ARN: arn:aws:iam::517716713836:role/CS-AR-CORPSEC-SEIM
          cloud.provider: aws
          Vendor.responseElements.credentials.accessKeyId: MY_ACCESS_KEY
          Vendor.responseElements.assumedRoleUser.arn: arn:aws:sts::517716713836:assumed-role/CS-AR-CORPSEC-SEIM/splunk_ta_aws
          Vendor.requestParameters.roleArn: arn:aws:iam::517716713836:role/CS-AR-CORPSEC-SEIM
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "AWSAccount", "principalId":
      "AIDAIMAXIDWFD5T3Y5JVY", "accountId": "093619269037"}, "eventTime": "2023-03-23T18:01:30Z",
      "eventSource": "sts.amazonaws.com", "eventName": "AssumeRole", "awsRegion":
      "us-east-1", "sourceIPAddress": "208.42.231.60", "userAgent": "Boto3/1.10.23
      Python/3.7.4 Linux/5.4.0-137-generic Botocore/1.13.50", "requestParameters":
      {"roleArn": "arn:aws:iam::517716713836:role/CS-AR-CORPSEC-SEIM", "roleSessionName":
      "splunk_ta_aws", "durationSeconds": 3600}, "responseElements": {"credentials":
      {"accessKeyId": "MY_ACCESS_KEY", "sessionToken": "FwoGZXIvYXdzEAsaDDCg/kahN7C5NirdwSKxAXknJuoD7QkLqxvVlnKq3mccr+9+WOO5Z2I+/4dIltYAdvBMvwP3vNgLFNRJWvSRGbDkRqCTSExmFc0o8THP/vETjWDzsn3n2g7yD4HVBh6qd6DB03BesfyqBaYaBvBzFGySfKmLpjA93hIFSWhldyEHwmHnBLHcoP3EOZlBUr23L5edhFVhx+zxns8SlYqKFGwJHu4ZZz6OFYAE8Pbzda5qNcHdFk01rKSvibsmkgO67Cj6p/KgBjIt/dZdiuBMzmneXq732yZNHGVQDF+Lve7Mj86CspzoTiL7dhn462GVVsqODrpt",
      "expiration": "Mar 23, 2023, 7:01:30 PM"}, "assumedRoleUser": {"assumedRoleId":
      "AROAXRCSSEFWOMMH2PEY2:splunk_ta_aws", "arn": "arn:aws:sts::517716713836:assumed-role/CS-AR-CORPSEC-SEIM/splunk_ta_aws"}},
      "requestID": "c04bd645-c8a4-4a60-b80a-ce3e840e2c85", "eventID": "a05fb1bf-78ee-43a2-86f9-d0608f260687",
      "readOnly": true, "resources": [{"accountId": "517716713836", "type": "AWS::IAM::Role",
      "ARN": "arn:aws:iam::517716713836:role/CS-AR-CORPSEC-SEIM"}], "eventType": "AwsApiCall",
      "managementEvent": true, "recipientAccountId": "517716713836", "sharedEventID":
      "82820856-99bd-4e06-bdde-d35283f9d7de", "eventCategory": "Management", "tlsDetails":
      {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader":
      "sts.amazonaws.com"}}'
  - assertions:
      - fieldsHaveValues:
          Vendor.resources[1].type: AWS::IAM::SAMLProvider
          Vendor.requestParameters.roleSessionName: asteigleder@crowdstrike.sys
          Vendor.recipientAccountId: '517716713836'
          event.category[0]: authentication
          source.address: aws internal
          Vendor.eventSource: sts.amazonaws.com
          '#event.dataset': cloudtrail.log
          Vendor.resources[0].type: AWS::IAM::Role
          Vendor.responseElements.assumedRoleUser.assumedRoleId: AROAXRCSSEFWGO3EVJKM5:asteigleder@crowdstrike.sys
          Vendor.responseElements.credentials.sessionToken: IQoJb3JpZ2luX2VjEPj//////////wEaCXVzLWVhc3QtMSJHMEUCIQCyRxYvaLaw4vEYC9CBWQHKmb9cNf2ef+BP07MAtdDu/AIgBQxaifnoEjgDta5ckPItj1IxXd9/zjms6cs1KE+IySMq7AIIwf//////////ARACGgw1MTc3MTY3MTM4MzYiDEnZShgoz3c8Od2LsCrAAkX9JM1Umf7VS/6AuEbqEg6KcUYGJk+EVRBRS1DkO/hgmL+R1QEsvIGMJAeDzLZlDupruhPp5A7SlvjEtx3oX3kYkfmPp8x/i8pEeQZmwKrHNAO2/bAM7F7F+M4Wo81KhLT5K2kxMa6HnZGh1haQv9KQodf0lnQQEPCHdy9fJdNw76vQRB130mGOZDTrbiP2wwxOpw5Sdrb4AHVLOZXIuUjXvrIkiH8DSxwYXE1vp/J3ThAVZJlHBZ91YBZpLVzA9XI3GiwKBCYXMMuAAaZW7psNQ/aF9iVlIfpCZVb1lf0k+AucaCxkfiLpwg5J0U6YPTqMl2bZkb5wn1Xsc3oLhmeQaLxQVJb9sKRvI0MhGqGRNjigqJ8p409keudedjDrI7PnPtr9zvb3y2deaunXO0DbLvLavA1otMBcBE2e4cSrMOLd8aAGOpsBwHL+0BVUKEr6q8Ui8BkAav5rW/dClznI/V896Sw7CRGyakQH9y7HCpZdkyt08Wgvgbj3XLamOdfFsNMCsMRBd/OxDi3r96o159NZedNhH/R7bUI5RfH7x/pkGuBoXzVP4eVpV5K6cH5vIHPEU5CqN3Be+GOa4kx+BuLG6CWBkEmIcnLPQFX92TXcsNmf4LM38frHGrHJk9iTQGw=
          event.provider: sts.amazonaws.com
          Vendor.userIdentity.identityProvider: ABc7OXZi9WuV3FVY5tB0UGo6sk8=
          Vendor.managementEvent: 'true'
          event.type[0]: info
          Vendor.tlsDetails.cipherSuite: ECDHE-RSA-AES128-GCM-SHA256
          Vendor.responseElements.subject: asteigleder@crowdstrike.sys
          '#event.outcome': success
          Vendor.responseElements.audience: https://signin.aws.amazon.com/saml
          Vendor.userIdentity.principalId: ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys
          Vendor.tlsDetails.clientProvidedHostHeader: sts.us-east-1.amazonaws.com
          event.id: 28072cfd-60aa-4f8f-a7a4-633893c0bb1a
          Vendor.responseElements.nameQualifier: ABc7OXZi9WuV3FVY5tB0UGo6sk8=
          Vendor.eventType: AwsApiCall
          user.id: ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys
          Vendor.resources[0].accountId: '517716713836'
          Vendor.eventID: 28072cfd-60aa-4f8f-a7a4-633893c0bb1a
          Vendor.eventCategory: Management
          Vendor.responseElements.credentials.expiration: Mar 23, 2023, 4:23:14 PM
          Vendor.tlsDetails.tlsVersion: TLSv1.2
          user.roles[0]: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
          Vendor.requestParameters.principalArn: arn:aws:iam::517716713836:saml-provider/CSIT-Okta
          Vendor.resources[1].accountId: '517716713836'
          Vendor.userAgent: aws-internal/3 aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64
            OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation
            cfg/retry-mode/standard
          Vendor.sourceIPAddress: AWS Internal
          Vendor.responseElements.issuer: http://www.okta.com/exkncv87fhU72BIR20x7
          cloud.account.id: '517716713836'
          source.ip: AWS Internal
          Vendor.eventTime: '2023-03-23T15:23:14Z'
          Vendor.eventVersion: '1.08'
          user_agent.original: aws-internal/3 aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64
            OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation
            cfg/retry-mode/standard
          Vendor.eventName: AssumeRoleWithSAML
          Vendor.awsRegion: us-east-1
          Vendor.requestID: 6d84493f-fb1e-4331-b868-ac2780f4e011
          Vendor.requestParameters.sAMLAssertionID: id18724469679795641113028510
          cloud.region: us-east-1
          Vendor.readOnly: 'true'
          event.action: AssumeRoleWithSAML
          Vendor.requestParameters.durationSeconds: '3600'
          Vendor.responseElements.subjectType: unspecified
          Vendor.userIdentity.type: SAMLUser
          Vendor.resources[0].ARN: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
          cloud.provider: aws
          Vendor.userIdentity.userName: asteigleder@crowdstrike.sys
          Vendor.resources[1].ARN: arn:aws:iam::517716713836:saml-provider/CSIT-Okta
          user.name: asteigleder@crowdstrike.sys
          Vendor.responseElements.credentials.accessKeyId: ASIAXRCSSEFWJILLZEZ7
          Vendor.responseElements.assumedRoleUser.arn: arn:aws:sts::517716713836:assumed-role/CS-Okta-Full-Admins-Write/asteigleder@crowdstrike.sys
          Vendor.requestParameters.roleArn: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "principalId":
      "ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys", "userName": "asteigleder@crowdstrike.sys",
      "identityProvider": "ABc7OXZi9WuV3FVY5tB0UGo6sk8="}, "eventTime": "2023-03-23T15:23:14Z",
      "eventSource": "sts.amazonaws.com", "eventName": "AssumeRoleWithSAML", "awsRegion":
      "us-east-1", "sourceIPAddress": "AWS Internal", "userAgent": "aws-internal/3
      aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.362-b10
      java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation cfg/retry-mode/standard",
      "requestParameters": {"sAMLAssertionID": "id18724469679795641113028510", "roleSessionName":
      "asteigleder@crowdstrike.sys", "roleArn": "arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write",
      "principalArn": "arn:aws:iam::517716713836:saml-provider/CSIT-Okta", "durationSeconds":
      3600}, "responseElements": {"credentials": {"accessKeyId": "ASIAXRCSSEFWJILLZEZ7",
      "sessionToken": "IQoJb3JpZ2luX2VjEPj//////////wEaCXVzLWVhc3QtMSJHMEUCIQCyRxYvaLaw4vEYC9CBWQHKmb9cNf2ef+BP07MAtdDu/AIgBQxaifnoEjgDta5ckPItj1IxXd9/zjms6cs1KE+IySMq7AIIwf//////////ARACGgw1MTc3MTY3MTM4MzYiDEnZShgoz3c8Od2LsCrAAkX9JM1Umf7VS/6AuEbqEg6KcUYGJk+EVRBRS1DkO/hgmL+R1QEsvIGMJAeDzLZlDupruhPp5A7SlvjEtx3oX3kYkfmPp8x/i8pEeQZmwKrHNAO2/bAM7F7F+M4Wo81KhLT5K2kxMa6HnZGh1haQv9KQodf0lnQQEPCHdy9fJdNw76vQRB130mGOZDTrbiP2wwxOpw5Sdrb4AHVLOZXIuUjXvrIkiH8DSxwYXE1vp/J3ThAVZJlHBZ91YBZpLVzA9XI3GiwKBCYXMMuAAaZW7psNQ/aF9iVlIfpCZVb1lf0k+AucaCxkfiLpwg5J0U6YPTqMl2bZkb5wn1Xsc3oLhmeQaLxQVJb9sKRvI0MhGqGRNjigqJ8p409keudedjDrI7PnPtr9zvb3y2deaunXO0DbLvLavA1otMBcBE2e4cSrMOLd8aAGOpsBwHL+0BVUKEr6q8Ui8BkAav5rW/dClznI/V896Sw7CRGyakQH9y7HCpZdkyt08Wgvgbj3XLamOdfFsNMCsMRBd/OxDi3r96o159NZedNhH/R7bUI5RfH7x/pkGuBoXzVP4eVpV5K6cH5vIHPEU5CqN3Be+GOa4kx+BuLG6CWBkEmIcnLPQFX92TXcsNmf4LM38frHGrHJk9iTQGw=",
      "expiration": "Mar 23, 2023, 4:23:14 PM"}, "assumedRoleUser": {"assumedRoleId":
      "AROAXRCSSEFWGO3EVJKM5:asteigleder@crowdstrike.sys", "arn": "arn:aws:sts::517716713836:assumed-role/CS-Okta-Full-Admins-Write/asteigleder@crowdstrike.sys"},
      "subject": "asteigleder@crowdstrike.sys", "subjectType": "unspecified", "issuer":
      "http://www.okta.com/exkncv87fhU72BIR20x7", "audience": "https://signin.aws.amazon.com/saml",
      "nameQualifier": "ABc7OXZi9WuV3FVY5tB0UGo6sk8="}, "requestID": "6d84493f-fb1e-4331-b868-ac2780f4e011",
      "eventID": "28072cfd-60aa-4f8f-a7a4-633893c0bb1a", "readOnly": true, "resources":
      [{"accountId": "517716713836", "type": "AWS::IAM::Role", "ARN": "arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write"},
      {"accountId": "517716713836", "type": "AWS::IAM::SAMLProvider", "ARN": "arn:aws:iam::517716713836:saml-provider/CSIT-Okta"}],
      "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "517716713836",
      "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite":
      "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "sts.us-east-1.amazonaws.com"}}'
  - assertions:
      - fieldsHaveValues:
          event.provider: ec2.amazonaws.com
          Vendor.userIdentity.sessionContext.sessionIssuer.principalId: AROAXRCSSEFWP4BHNTPJI
          '#event.outcome': success
          Vendor.recipientAccountId: '517716713836'
          source.address: 34.208.230.162
          Vendor.eventSource: ec2.amazonaws.com
          '#event.dataset': cloudtrail.log
          user.name: talon1-openshift4dot6-lzkbp-master-role
          Vendor.userIdentity.arn: arn:aws:sts::517716713836:assumed-role/talon1-openshift4dot6-lzkbp-master-role/i-082c72d107771f52b
          Vendor.userIdentity.sessionContext.ec2RoleDelivery: '2.0'
          Vendor.userIdentity.accessKeyId: MY_ACCESS_KEY
          Vendor.userIdentity.sessionContext.sessionIssuer.userName: talon1-openshift4dot6-lzkbp-master-role
          Vendor.managementEvent: 'true'
          event.type[0]: info
          Vendor.tlsDetails.cipherSuite: ECDHE-RSA-AES128-GCM-SHA256
          Vendor.userIdentity.sessionContext.sessionIssuer.arn: arn:aws:iam::517716713836:role/talon1-openshift4dot6-lzkbp-master-role
          Vendor.userIdentity.principalId: AROAXRCSSEFWP4BHNTPJI:i-082c72d107771f52b
          Vendor.tlsDetails.clientProvidedHostHeader: ec2.us-west-2.amazonaws.com
          event.id: 9d747a92-ebdf-4cc8-9abc-3ea84c36983b
          Vendor.eventType: AwsApiCall
          user.id: AROAXRCSSEFWP4BHNTPJI:i-082c72d107771f52b
          Vendor.userIdentity.sessionContext.attributes.creationDate: '2023-03-23T16:08:04Z'
          Vendor.eventID: 9d747a92-ebdf-4cc8-9abc-3ea84c36983b
          Vendor.eventCategory: Management
          Vendor.userIdentity.sessionContext.sessionIssuer.type: Role
          Vendor.tlsDetails.tlsVersion: TLSv1.2
          Vendor.userIdentity.sessionContext.sessionIssuer.accountId: '517716713836'
          Vendor.requestParameters.instancesSet.items[0].instanceId: i-082c72d107771f52b
          user.roles[0]: arn:aws:iam::517716713836:role/talon1-openshift4dot6-lzkbp-master-role
          Vendor.userAgent: kubernetes/v1.19.0+4c3480d aws-sdk-go/1.28.2 (go1.15.14; linux;
            amd64)
          Vendor.sourceIPAddress: 34.208.230.162
          cloud.account.id: '517716713836'
          Vendor.userIdentity.sessionContext.attributes.mfaAuthenticated: 'false'
          event.category[0]: configuration
          source.ip: 34.208.230.162
          Vendor.eventTime: '2023-03-23T18:02:57Z'
          Vendor.eventVersion: '1.08'
          user_agent.original: kubernetes/v1.19.0+4c3480d aws-sdk-go/1.28.2 (go1.15.14;
            linux; amd64)
          Vendor.eventName: DescribeInstances
          Vendor.awsRegion: us-west-2
          Vendor.requestID: 4578e3f1-1dc1-44d9-b9bf-876548a6edfc
          Vendor.userIdentity.accountId: '517716713836'
          cloud.region: us-west-2
          Vendor.readOnly: 'true'
          event.action: DescribeInstances
          Vendor.userIdentity.type: AssumedRole
          cloud.provider: aws
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId":
      "AROAXRCSSEFWP4BHNTPJI:i-082c72d107771f52b", "arn": "arn:aws:sts::517716713836:assumed-role/talon1-openshift4dot6-lzkbp-master-role/i-082c72d107771f52b",
      "accountId": "517716713836", "accessKeyId": "MY_ACCESS_KEY", "sessionContext":
      {"sessionIssuer": {"type": "Role", "principalId": "AROAXRCSSEFWP4BHNTPJI", "arn":
      "arn:aws:iam::517716713836:role/talon1-openshift4dot6-lzkbp-master-role", "accountId":
      "517716713836", "userName": "talon1-openshift4dot6-lzkbp-master-role"}, "webIdFederationData":
      {}, "attributes": {"creationDate": "2023-03-23T16:08:04Z", "mfaAuthenticated":
      "false"}, "ec2RoleDelivery": "2.0"}}, "eventTime": "2023-03-23T18:02:57Z", "eventSource":
      "ec2.amazonaws.com", "eventName": "DescribeInstances", "awsRegion": "us-west-2",
      "sourceIPAddress": "34.208.230.162", "userAgent": "kubernetes/v1.19.0+4c3480d
      aws-sdk-go/1.28.2 (go1.15.14; linux; amd64)", "requestParameters": {"instancesSet":
      {"items": [{"instanceId": "i-082c72d107771f52b"}]}, "filterSet": {}}, "responseElements":
      null, "requestID": "4578e3f1-1dc1-44d9-b9bf-876548a6edfc", "eventID": "9d747a92-ebdf-4cc8-9abc-3ea84c36983b",
      "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId":
      "517716713836", "eventCategory": "Management", "tlsDetails": {"tlsVersion":
      "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader":
      "ec2.us-west-2.amazonaws.com"}}'
  - assertions:
      - fieldsHaveValues:
          Vendor.userIdentity.arn: arn:aws:iam::123456789012:user/Alice
          Vendor.userIdentity.accessKeyId: EXAMPLE_KEY_ID
          event.provider: cloudtrail.amazonaws.com
          event.type[0]: change
          Vendor.errorCode: TrailNotFoundException
          '#event.outcome': failure
          Vendor.userIdentity.principalId: EX_PRINCIPAL_ID
          Vendor.recipientAccountId: '123456789012'
          Vendor.userAgent: aws-cli/1.10.32 Python/2.7.9 Windows/7 botocore/1.4.22
          event.category[0]: configuration
          source.address: 205.251.233.182
          '#event.dataset': cloudtrail.log
          user.name: alice
          event.id: b7d4398e-b2f0-4faa-9c76-e2d316a8d67f
          Vendor.eventType: AwsApiCall
          error.code: TrailNotFoundException
          user.id: EX_PRINCIPAL_ID
          Vendor.eventID: b7d4398e-b2f0-4faa-9c76-e2d316a8d67f
          Vendor.errorMessage: 'Unknown trail: myTrail2 for the user: 123456789012'
          Vendor.sourceIPAddress: 205.251.233.182
          cloud.account.id: '123456789012'
          Vendor.requestParameters.name: myTrail2
          error.message: 'Unknown trail: myTrail2 for the user: 123456789012'
          Vendor.eventSource: cloudtrail.amazonaws.com
          source.ip: 205.251.233.182
          Vendor.eventTime: '2016-07-14T19:15:45Z'
          Vendor.eventVersion: '1.04'
          user_agent.original: aws-cli/1.10.32 Python/2.7.9 Windows/7 botocore/1.4.22
          Vendor.eventName: UpdateTrail
          Vendor.awsRegion: us-east-2
          Vendor.requestID: 5d40662a-49f7-11e6-97e4-d9cb6ff7d6a3
          Vendor.userIdentity.accountId: '123456789012'
          cloud.region: us-east-2
          event.action: UpdateTrail
          Vendor.userIdentity.type: IAMUser
          cloud.provider: aws
          Vendor.userIdentity.userName: Alice
          event.reason: 'Unknown trail: myTrail2 for the user: 123456789012'
    event:
      rawString: '{"eventVersion":"1.04","userIdentity":{"type":"IAMUser","principalId":"EX_PRINCIPAL_ID","arn":"arn:aws:iam::123456789012:user/Alice","accountId":"123456789012","accessKeyId":"EXAMPLE_KEY_ID","userName":"Alice"},"eventTime":"2016-07-14T19:15:45Z","eventSource":"cloudtrail.amazonaws.com","eventName":"UpdateTrail","awsRegion":"us-east-2","sourceIPAddress":"205.251.233.182","userAgent":"aws-cli/1.10.32
      Python/2.7.9 Windows/7 botocore/1.4.22","errorCode":"TrailNotFoundException","errorMessage":"Unknown
      trail: myTrail2 for the user: 123456789012","requestParameters":{"name":"myTrail2"},"responseElements":null,"requestID":"5d40662a-49f7-11e6-97e4-d9cb6ff7d6a3","eventID":"b7d4398e-b2f0-4faa-9c76-e2d316a8d67f","eventType":"AwsApiCall","recipientAccountId":"123456789012"}'
  - assertions:
      - fieldsHaveValues:
          Vendor.userIdentity.accessKeyId: EXAMPLE_KEY_ID
          event.provider: ec2.amazonaws.com
          event.type[0]: info
          '#event.outcome': success
          Vendor.userIdentity.principalId: EX_PRINCIPAL_ID
          Vendor.requestParameters.instancesSet.items[0].instanceId: i-ebeaf9e2
          Vendor.responseElements.instancesSet.items[0].previousState.name: stopped
          Vendor.userAgent: ec2-api-tools 1.6.12.2
          event.category[0]: configuration
          source.address: 205.251.233.176
          Vendor.eventSource: ec2.amazonaws.com
          Vendor.responseElements.instancesSet.items[0].currentState.name: pending
          user.name: alice
          Vendor.responseElements.instancesSet.items[0].instanceId: i-ebeaf9e2
          Vendor.responseElements.instancesSet.items[0].previousState.code: '80'
          Vendor.userIdentity.arn: arn:aws:iam::123456789012:user/Alice
          user.id: EX_PRINCIPAL_ID
          Vendor.responseElements.instancesSet.items[0].currentState.code: '0'
          Vendor.sourceIPAddress: 205.251.233.176
          cloud.account.id: '123456789012'
          '#event.dataset': cloudtrail.s3
          event.type[1]: start
          source.ip: 205.251.233.176
          Vendor.eventTime: '2014-03-06T21:22:54Z'
          Vendor.eventVersion: '1.0'
          user_agent.original: ec2-api-tools 1.6.12.2
          Vendor.eventName: StartInstances
          Vendor.awsRegion: us-east-2
          Vendor.userIdentity.accountId: '123456789012'
          cloud.region: us-east-2
          event.action: StartInstances
          Vendor.userIdentity.type: IAMUser
          cloud.provider: aws
          Vendor.userIdentity.userName: Alice
    event:
      rawString: '{"eventVersion":"1.0","userIdentity":{"type":"IAMUser","principalId":"EX_PRINCIPAL_ID","arn":"arn:aws:iam::123456789012:user/Alice","accessKeyId":"EXAMPLE_KEY_ID","accountId":"123456789012","userName":"Alice"},"eventTime":"2014-03-06T21:22:54Z","eventSource":"ec2.amazonaws.com","eventName":"StartInstances","awsRegion":"us-east-2","sourceIPAddress":"205.251.233.176","userAgent":"ec2-api-tools
      1.6.12.2","requestParameters":{"instancesSet":{"items":[{"instanceId":"i-ebeaf9e2"}]}},"responseElements":{"instancesSet":{"items":[{"instanceId":"i-ebeaf9e2","currentState":{"code":0,"name":"pending"},"previousState":{"code":80,"name":"stopped"}}]}}}'
  - assertions:
      - fieldsHaveValues:
          Vendor.resources[1].type: AWS::IAM::SAMLProvider
          Vendor.requestParameters.roleSessionName: asteigleder@crowdstrike.sys
          Vendor.recipientAccountId: '517716713836'
          event.category[0]: authentication
          source.address: aws internal
          Vendor.eventSource: sts.amazonaws.com
          '#event.dataset': cloudtrail.log
          Vendor.resources[0].type: AWS::IAM::Role
          Vendor.responseElements.assumedRoleUser.assumedRoleId: AROAXRCSSEFWGO3EVJKM5:asteigleder@crowdstrike.sys
          Vendor.responseElements.credentials.sessionToken: IQoJb3JpZ2luX2VjEPj//////////wEaCXVzLWVhc3QtMSJHMEUCIQCyRxYvaLaw4vEYC9CBWQHKmb9cNf2ef+BP07MAtdDu/AIgBQxaifnoEjgDta5ckPItj1IxXd9/zjms6cs1KE+IySMq7AIIwf//////////ARACGgw1MTc3MTY3MTM4MzYiDEnZShgoz3c8Od2LsCrAAkX9JM1Umf7VS/6AuEbqEg6KcUYGJk+EVRBRS1DkO/hgmL+R1QEsvIGMJAeDzLZlDupruhPp5A7SlvjEtx3oX3kYkfmPp8x/i8pEeQZmwKrHNAO2/bAM7F7F+M4Wo81KhLT5K2kxMa6HnZGh1haQv9KQodf0lnQQEPCHdy9fJdNw76vQRB130mGOZDTrbiP2wwxOpw5Sdrb4AHVLOZXIuUjXvrIkiH8DSxwYXE1vp/J3ThAVZJlHBZ91YBZpLVzA9XI3GiwKBCYXMMuAAaZW7psNQ/aF9iVlIfpCZVb1lf0k+AucaCxkfiLpwg5J0U6YPTqMl2bZkb5wn1Xsc3oLhmeQaLxQVJb9sKRvI0MhGqGRNjigqJ8p409keudedjDrI7PnPtr9zvb3y2deaunXO0DbLvLavA1otMBcBE2e4cSrMOLd8aAGOpsBwHL+0BVUKEr6q8Ui8BkAav5rW/dClznI/V896Sw7CRGyakQH9y7HCpZdkyt08Wgvgbj3XLamOdfFsNMCsMRBd/OxDi3r96o159NZedNhH/R7bUI5RfH7x/pkGuBoXzVP4eVpV5K6cH5vIHPEU5CqN3Be+GOa4kx+BuLG6CWBkEmIcnLPQFX92TXcsNmf4LM38frHGrHJk9iTQGw=
          event.provider: sts.amazonaws.com
          Vendor.userIdentity.identityProvider: ABc7OXZi9WuV3FVY5tB0UGo6sk8=
          Vendor.managementEvent: 'true'
          event.type[0]: info
          Vendor.tlsDetails.cipherSuite: ECDHE-RSA-AES128-GCM-SHA256
          Vendor.responseElements.subject: asteigleder@crowdstrike.sys
          '#event.outcome': success
          Vendor.responseElements.audience: https://signin.aws.amazon.com/saml
          Vendor.userIdentity.principalId: ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys
          Vendor.tlsDetails.clientProvidedHostHeader: sts.us-east-1.amazonaws.com
          event.id: 28072cfd-60aa-4f8f-a7a4-633893c0bb1a
          Vendor.responseElements.nameQualifier: ABc7OXZi9WuV3FVY5tB0UGo6sk8=
          Vendor.eventType: AwsApiCall
          user.id: ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys
          Vendor.resources[0].accountId: '517716713836'
          Vendor.eventID: 28072cfd-60aa-4f8f-a7a4-633893c0bb1a
          Vendor.eventCategory: Management
          Vendor.responseElements.credentials.expiration: Mar 23, 2023, 4:23:14 PM
          Vendor.tlsDetails.tlsVersion: TLSv1.2
          user.roles[0]: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
          Vendor.requestParameters.principalArn: arn:aws:iam::517716713836:saml-provider/CSIT-Okta
          Vendor.resources[1].accountId: '517716713836'
          Vendor.userAgent: aws-internal/3 aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64
            OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation
            cfg/retry-mode/standard
          Vendor.sourceIPAddress: AWS Internal
          Vendor.responseElements.issuer: http://www.okta.com/exkncv87fhU72BIR20x7
          cloud.account.id: '517716713836'
          source.ip: AWS Internal
          Vendor.eventTime: '2023-03-23T15:23:14Z'
          Vendor.eventVersion: '1.08'
          user_agent.original: aws-internal/3 aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64
            OpenJDK_64-Bit_Server_VM/25.362-b10 java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation
            cfg/retry-mode/standard
          Vendor.eventName: AssumeRoleWithSAML
          Vendor.awsRegion: us-east-1
          Vendor.requestID: 6d84493f-fb1e-4331-b868-ac2780f4e011
          Vendor.requestParameters.sAMLAssertionID: id18724469679795641113028510
          cloud.region: us-east-1
          Vendor.readOnly: 'true'
          event.action: AssumeRoleWithSAML
          Vendor.requestParameters.durationSeconds: '3600'
          Vendor.responseElements.subjectType: unspecified
          Vendor.userIdentity.type: SAMLUser
          Vendor.resources[0].ARN: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
          cloud.provider: aws
          Vendor.userIdentity.userName: asteigleder@crowdstrike.sys
          Vendor.resources[1].ARN: arn:aws:iam::517716713836:saml-provider/CSIT-Okta
          user.name: asteigleder@crowdstrike.sys
          Vendor.responseElements.credentials.accessKeyId: EXAMPLE_ACCESS_KEY
          Vendor.responseElements.assumedRoleUser.arn: arn:aws:sts::517716713836:assumed-role/CS-Okta-Full-Admins-Write/asteigleder@crowdstrike.sys
          Vendor.requestParameters.roleArn: arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write
    event:
      rawString: '{"eventVersion": "1.08", "userIdentity": {"type": "SAMLUser", "principalId":
      "ABc7OXZi9WuV3FVY5tB0UGo6sk8=:asteigleder@crowdstrike.sys", "userName": "asteigleder@crowdstrike.sys",
      "identityProvider": "ABc7OXZi9WuV3FVY5tB0UGo6sk8="}, "eventTime": "2023-03-23T15:23:14Z",
      "eventSource": "sts.amazonaws.com", "eventName": "AssumeRoleWithSAML", "awsRegion":
      "us-east-1", "sourceIPAddress": "AWS Internal", "userAgent": "aws-internal/3
      aws-sdk-java/1.12.430 Linux/5.4.231-145.341.amzn2int.x86_64 OpenJDK_64-Bit_Server_VM/25.362-b10
      java/1.8.0_362 kotlin/1.3.72 vendor/Oracle_Corporation cfg/retry-mode/standard",
      "requestParameters": {"sAMLAssertionID": "id18724469679795641113028510", "roleSessionName":
      "asteigleder@crowdstrike.sys", "roleArn": "arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write",
      "principalArn": "arn:aws:iam::517716713836:saml-provider/CSIT-Okta", "durationSeconds":
      3600}, "responseElements": {"credentials": {"accessKeyId": "EXAMPLE_ACCESS_KEY",
      "sessionToken": "IQoJb3JpZ2luX2VjEPj//////////wEaCXVzLWVhc3QtMSJHMEUCIQCyRxYvaLaw4vEYC9CBWQHKmb9cNf2ef+BP07MAtdDu/AIgBQxaifnoEjgDta5ckPItj1IxXd9/zjms6cs1KE+IySMq7AIIwf//////////ARACGgw1MTc3MTY3MTM4MzYiDEnZShgoz3c8Od2LsCrAAkX9JM1Umf7VS/6AuEbqEg6KcUYGJk+EVRBRS1DkO/hgmL+R1QEsvIGMJAeDzLZlDupruhPp5A7SlvjEtx3oX3kYkfmPp8x/i8pEeQZmwKrHNAO2/bAM7F7F+M4Wo81KhLT5K2kxMa6HnZGh1haQv9KQodf0lnQQEPCHdy9fJdNw76vQRB130mGOZDTrbiP2wwxOpw5Sdrb4AHVLOZXIuUjXvrIkiH8DSxwYXE1vp/J3ThAVZJlHBZ91YBZpLVzA9XI3GiwKBCYXMMuAAaZW7psNQ/aF9iVlIfpCZVb1lf0k+AucaCxkfiLpwg5J0U6YPTqMl2bZkb5wn1Xsc3oLhmeQaLxQVJb9sKRvI0MhGqGRNjigqJ8p409keudedjDrI7PnPtr9zvb3y2deaunXO0DbLvLavA1otMBcBE2e4cSrMOLd8aAGOpsBwHL+0BVUKEr6q8Ui8BkAav5rW/dClznI/V896Sw7CRGyakQH9y7HCpZdkyt08Wgvgbj3XLamOdfFsNMCsMRBd/OxDi3r96o159NZedNhH/R7bUI5RfH7x/pkGuBoXzVP4eVpV5K6cH5vIHPEU5CqN3Be+GOa4kx+BuLG6CWBkEmIcnLPQFX92TXcsNmf4LM38frHGrHJk9iTQGw=",
      "expiration": "Mar 23, 2023, 4:23:14 PM"}, "assumedRoleUser": {"assumedRoleId":
      "AROAXRCSSEFWGO3EVJKM5:asteigleder@crowdstrike.sys", "arn": "arn:aws:sts::517716713836:assumed-role/CS-Okta-Full-Admins-Write/asteigleder@crowdstrike.sys"},
      "subject": "asteigleder@crowdstrike.sys", "subjectType": "unspecified", "issuer":
      "http://www.okta.com/exkncv87fhU72BIR20x7", "audience": "https://signin.aws.amazon.com/saml",
      "nameQualifier": "ABc7OXZi9WuV3FVY5tB0UGo6sk8="}, "requestID": "6d84493f-fb1e-4331-b868-ac2780f4e011",
      "eventID": "28072cfd-60aa-4f8f-a7a4-633893c0bb1a", "readOnly": true, "resources":
      [{"accountId": "517716713836", "type": "AWS::IAM::Role", "ARN": "arn:aws:iam::517716713836:role/CS-Okta-Full-Admins-Write"},
      {"accountId": "517716713836", "type": "AWS::IAM::SAMLProvider", "ARN": "arn:aws:iam::517716713836:saml-provider/CSIT-Okta"}],
      "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "517716713836",
      "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite":
      "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "sts.us-east-1.amazonaws.com"}}'
$schema: https://schemas.humio.com/parser/v0.3.0
script: |-
  // #region PREPARSE
    /************************************************************
    ****** Parse timestamp and log headers
    ****** Extract message field for parsing
    ****** Parse structured data
    ************************************************************/

  parseJson(prefix="Vendor.", excludeEmpty="true", handleNull="discard")
  | case{
      Vendor.eventTime=*
          | parseTimestamp(field=Vendor.eventTime);
      Vendor.digestStartTime=*
          | parseTimestamp(field="Vendor.digestStartTime");
      *;
  }

  // #endregion

  // #region METADATA
    /************************************************************
    ****** Static Metadata Definitions
    ************************************************************/
  | Parser.version := "2.0.0"
  | Vendor := "aws"
  | event.module := "cloudtrail"
  | event.dataset := "cloudtrail.log"
  | event.kind := "event"
  | ecs.version := "8.11.0"
  | Cps.version := "1.0.0"

  // #endregion

  // #region NORMALIZATION
    /************************************************************
    ****** Parse unstructured data (i.e. message field)
    ****** Normalize fields to data model
    ************************************************************/
  // user agent core fields
  | user_agent.original := Vendor.userAgent

  // source core fields
  | source.ip := Vendor.sourceIPAddress
  | source.address := lower(Vendor.sourceIPAddress)
  | case {
      cidr("source.address", subnet=["0.0.0.0/0", "::/0"])
          | source.ip := source.address;
      *;
  }

  // cloud extended fields
  | cloud.region := Vendor.awsRegion
  | cloud.provider := "aws"
  | case {
      Vendor.awsAccountId = * | cloud.account.id := Vendor.awsAccountId;
      Vendor.userIdentity.accountId = * | cloud.account.id := Vendor.userIdentity.accountId;
      Vendor.recipientAccountId = * | cloud.account.id := Vendor.recipientAccountId;
      *
  }

  // event core fields
  | case {
      (Vendor.errorCode = * or Vendor.errorMessage = *)
          | event.outcome := "failure"
          | event.reason:=Vendor.errorMessage;
      event.action="ConsoleLogin"
          | event.outcome:=lower(Vendor.responseElements.ConsoleLogin);
      *
          | event.outcome := "success";
  }
  | event.id :=  Vendor.eventID

  // event extended fields
  | event.provider := Vendor.eventSource
  | event.action := Vendor.eventName

  // error core fields
  | error.code := Vendor.errorCode
  | error.message := Vendor.errorMessage

  // file fields
  | file.path := Vendor.digestS3Object
  | case {
      file.path=/.*\/(?<file.name>.*)/;
      *;
  }
  | case {
      Vendor.previousDigestHashAlgorithm = "SHA-256"
          | file.hash.sha256 := lower(Vendor.previousDigestSignature);
      *
  }

  // host fields
  | host.name:=lower(requestParameters.Host)

  // user fields
  | user.id :=  Vendor.userIdentity.principalId
  | Vendor.userIdentity.type match {
      "IAMUser" => user.name := lower(Vendor.userIdentity.userName);
      "AssumedRole" => user.name := lower(Vendor.userIdentity.sessionContext.sessionIssuer.userName)
          | user.roles[0]:=Vendor.userIdentity.sessionContext.sessionIssuer.arn;
      "SAMLUser" => user.name := lower(Vendor.userIdentity.userName)
          | user.roles[0]:=Vendor.requestParameters.roleArn;
      "AWSAccount" => user.name:=lower(Vendor.requestParameters.roleSessionName)
          | user.roles[0]:=Vendor.requestParameters.roleArn;
      "AWSService" => user.name:=lower(Vendor.userIdentity.invokedBy)
          | user.roles[0]:=Vendor.requestParameters.roleArn;
      * => *;
  }

  | case{
      Vendor.requestParameters.bucketName = *
          | cloud.Storage.bucket_name := Vendor.requestParameters.bucketName;
      Vendor.digestS3Bucket = *
          | cloud.Storage.bucket_name := Vendor.digestS3Bucket;
      *;
  }

  // Based on the action we can apply event categorization and typing
  | event.action match {
      // AWS Identity and Access Management actions
      in(values=["AttachGroupPolicy", "DetachGroupPolicy", "PutGroupPolicy", "RemoveUserFromGroup", "UpdateGroup"]) => event.category[0]:="iam"
          | event.type[0]:="group"
          | event.type[1]:="change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["DeleteGroupPolicy", "DeleteGroup"]) => event.category[0]:="iam"
          | event.type[0]:="group"
          | event.type[1]:="change"
          | event.type[2]:="deletion"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "AssumeRole" => event.category[0]:="authentication"
          | event.type[0]:="info"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "ConsoleLogin" => event.category[0]:="authentication"
          | event.type[0]:="start"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["AttachUserPolicy", "ChangePassword", "DeactivateMFADevice", "DetachUserPolicy", "EnableMFADevice", "PutUserPermissionsBoundary", "PutUserPolicy", "TagUser", "UntagUser", "UpdateAccessKey", "UpdateAccountPasswordPolicy", "UpdateLoginProfile"]) => event.category[0] := "iam"
          | event.type[0] := "user"
          | event.type[1] := "change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["CreateAccessKey", "CreateVirtualMFADevice"]) => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="change"
          | event.type[2]:="creation"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["DeleteAccessKey", "DeleteSSHPublicKey", "DeleteUserPermissionsBoundary", "DeleteUserPolicy", "DeleteVirtualMFADevice", "DeleteUser"]) => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="change"
          | event.type[2]:="deletion"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["GetGroup", "GetGroupPolicy", "ListAttachedGroupPolicies", "ListGroupPolicies", "ListGroups"]) => event.category[0]:="iam"
          | event.type[0]:="group"
          | event.type[1]:="info"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["GetUser", "GetUserPolicy", "ListAttachedUserPolicies", "ListUserPolicies", "ListUsers", "ListUserTags"]) => event.category[0] := "iam"
          | event.type[0] := "user"
          | event.type[1] := "info"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "ListGroupsForUser" => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="group"
          | event.type[2]:="info"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["AddUserToGroup","RemoveUserFromGroup"]) => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="group"
          | event.type[2]:="change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["SetDefaultPolicyVersion", "SetSecurityTokenServicePreferences"]) => event.category[0]:="iam"
          | event.type[0]:="admin"
          | event.type[1]:="change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      // AWS S3 actions
      in(values=["DescribeMultiRegionAccessPointOperation","GetStorageLensConfiguration","GetStorageLensConfigurationTagging","GetStorageLensGroup","ListStorageLensConfigurations","ListStorageLensGroups","ListTagsForResource"]) => event.category[0]:="configuration"
          | event.type[0]:="access"
          | event.dataset:="cloudtrail.s3";
      in(values=["PutStorageLensConfiguration","PutStorageLensConfigurationTagging","TagResource","UntagResource","UpdateStorageLensGroup"]) => event.category[0]:="configuration"
          | event.type[0]:="change"
          | event.dataset:="cloudtrail.s3";
      in(values=["DeleteStorageLensConfiguration","DeleteStorageLensConfigurationTagging","DeleteStorageLensGroup"]) => event.category[0]:="configuration"
          | event.type[0]:="deletion"
          | event.dataset:="cloudtrail.s3";
      in(values=["GetBucketAccelerateConfiguration","GetBucketAcl","GetBucketAnalyticsConfiguration","GetBucketCors","GetBucketEncryption","GetBucketIntelligentTieringConfiguration","GetBucketInventoryConfiguration","GetBucketLifecycle","GetBucketLifecycleConfiguration","GetBucketLifecycleConfiguration","GetBucketLocation","GetBucketLogging","GetBucketMetricsConfiguration","GetBucketNotification","GetBucketNotificationConfiguration","GetBucketOwnershipControls","GetBucketPolicy","GetBucketPolicyStatus","GetBucketReplication","GetBucketRequestPayment","GetBucketTagging","GetBucketVersioning","GetBucketWebsite","GetObjectAcl","GetObjectAttributes","GetObjectLegalHold","GetObjectLockConfiguration","GetObjectRetention","GetObjectTagging","GetObjectTorrent","GetPublicAccessBlock","ListBucketAnalyticsConfigurations","ListBucketIntelligentTieringConfigurations","ListBucketInventoryConfigurations","ListBucketMetricsConfigurations","ListObjectVersions"]) => event.category[0]:="configuration"
          | event.category[1]:="file"
          | event.type[0]:="access"
          | event.dataset:="cloudtrail.s3";
      in(values=["PutBucketAccelerateConfiguration","PutBucketAcl","PutBucketAnalyticsConfiguration","PutBucketCors","PutBucketEncryption","PutBucketIntelligentTieringConfiguration","PutBucketInventoryConfiguration","PutBucketLifecycle","PutBucketLifecycleConfiguration","PutBucketLogging","PutBucketMetricsConfiguration","PutBucketNotification","PutBucketNotificationConfiguration","PutBucketOwnershipControls","PutBucketPolicy","PutBucketPolicy","PutBucketReplication","PutBucketReplication","PutBucketRequestPayment","PutBucketTagging","PutBucketTagging","PutBucketVersioning","PutBucketVersioning","PutBucketWebsite","PutObjectAcl","PutObjectLegalHold","PutObjectLockConfiguration","PutObjectRetention","PutObjectTagging","PutPublicAccessBlock"]) => event.category[0]:="configuration"
          | event.category[1]:="file"
          | event.type[0]:="change"
          | event.dataset:="cloudtrail.s3";
      in(values=["DeleteBucketAnalyticsConfiguration","DeleteBucketCors","DeleteBucketEncryption","DeleteBucketIntelligentTieringConfiguration","DeleteBucketInventoryConfiguration","DeleteBucketLifecycle","DeleteBucketLifecycleConfiguration","DeleteBucketMetricsConfiguration","DeleteBucketOwnershipControls","DeleteBucketPolicy","DeleteBucketReplication","DeleteBucketTagging","DeleteBucketWebsite","DeleteObjectTagging","DeletePublicAccessBlock"]) => event.category[0]:="configuration"
          | event.category[1]:="file"
          | event.type[0]:="deletion"
          | event.dataset:="cloudtrail.s3";
      in(values=["GetAccessGrant","GetAccessGrantsInstance","GetAccessGrantsInstanceForPrefix","GetAccessGrantsInstanceResourcePolicy","GetAccessGrantsLocation","GetAccessPoint","GetAccessPointConfigurationForObjectLambda","GetAccessPointForObjectLambda","GetAccessPointPolicy","GetAccessPointPolicyForObjectLambda","GetAccessPointPolicyStatus","GetAccessPointPolicyStatusForObjectLambda","GetMultiRegionAccessPoint","GetMultiRegionAccessPointPolicy","GetMultiRegionAccessPointPolicyStatus","GetMultiRegionAccessPointRoutes","ListAccessGrants","ListAccessGrantsInstances","ListAccessGrantsLocations","ListAccessPoints","ListAccessPointsForObjectLambda","ListMultiRegionAccessPoints"]) => event.category[0]:="configuration"
          | event.category[1]:="iam"
          | event.type[0]:="access"
          | event.dataset:="cloudtrail.s3";
      in(values=["DissociateAccessGrantsIdentityCenter","PutAccessGrantsInstanceResourcePolicy","PutAccessPointConfigurationForObjectLambda","PutAccessPointPolicy","PutAccessPointPolicyForObjectLambda","PutMultiRegionAccessPointPolicy","SubmitMultiRegionAccessPointRoutes","UpdateAccessGrantsLocation"]) => event.category[0]:="configuration"
          | event.category[1]:="iam"
          | event.type[0]:="change"
          | event.dataset:="cloudtrail.s3";
      "GetDataAccess" => event.category[0]:="configuration"
          | event.category[1]:="iam"
          | event.type[0]:="creation"
          | event.dataset:="cloudtrail.s3";
      in(values=["DescribeJob","GetJobTagging"]) => event.category[0]:="configuration"
          | event.category[1]:="process"
          | event.type[0]:="access"
          | event.dataset:="cloudtrail.s3";
      in(values=["PutJobTagging","UpdateJobPriority","UpdateJobStatus"]) => event.category[0]:="configuration"
          | event.category[1]:="process"
          | event.type[0]:="change"
          | event.dataset:="cloudtrail.s3";
      "DeleteJobTagging" => event.category[0]:="configuration"
          | event.category[1]:="process"
          | event.type[0]:="deletion"
          | event.dataset:="cloudtrail.s3";
      in(values=["GetBucket","GetObject","HeadBucket","HeadObject","ListBuckets","ListDirectoryBuckets","ListObjects","ListObjectsV2","ListRegionalBuckets","SelectObjectContent","WriteGetObjectResponse"]) => event.category[0]:="file"
          | event.type[0]:="access"
          | event.dataset:="cloudtrail.s3";
      "CopyObject" => event.category[0]:="file"
          | event.type[0]:="access"
          | event.type[1]:="creation"
          | event.dataset:="cloudtrail.s3";
      in(values=["PutObject","RestoreObject"]) => event.category[0]:="file"
          | event.type[0]:="change"
          | event.dataset:="cloudtrail.s3";
      in(values=["CreateBucket","UploadPart","UploadPartCopy"]) => event.category[0]:="file"
          | event.type[0]:="creation"
          | event.dataset:="cloudtrail.s3";
      in(values=["DeleteBucket","DeleteObject","DeleteObjects"]) => event.category[0]:="file"
          | event.type[0]:="deletion"
          | event.dataset:="cloudtrail.s3";
      "CompleteMultipartUpload" => event.category[0]:="file"
          | event.category[1]:="network"
          | event.type[0]:="creation"
          | event.ype[1]:="end"
          | event.dataset:="cloudtrail.s3";
      "AbortMultipartUpload" => event.category[0]:="file"
          | event.category[1]:="network"
          | event.type[0]:="creation"
          | event.ype[1]:="end"
          | event.dataset:="cloudtrail.s3";
      in(values=["CreateAccessGrant","CreateAccessGrantsInstance","CreateAccessGrantsLocation","CreateAccessPoint","CreateAccessPointForObjectLambda","CreateMultiRegionAccessPoint","CreateStorageLensGroup"]) => event.category[0]:="iam"
          | event.type[0]:="creation"
          | event.dataset:="cloudtrail.s3";
      in(values=["DeleteAccessGrant","DeleteAccessGrantsInstance","DeleteAccessGrantsInstanceResourcePolicy","DeleteAccessGrantsLocation","DeleteAccessPoint","DeleteAccessPointForObjectLambda","DeleteAccessPointPolicy","DeleteAccessPointPolicyForObjectLambda","DeleteMultiRegionAccessPoint"]) => event.category[0]:="iam"
          | event.type[0]:="deletion"
          | event.dataset:="cloudtrail.s3";
      "CreateMultipartUpload" => event.category[0]:="file"
          | event.category[1]:="network"
          | event.type[0]:="creation"
          | event.ype[1]:="start"
          | event.dataset:="cloudtrail.s3";
      "CreateSession" => event.category[0]:="file"
          | event.category[1]:="session"
          | event.type[0]:="start"
          | event.dataset:="cloudtrail.s3";
      in(values=["ListJobs","ListMultipartUploads","ListParts"]) => event.category[0]:="process"
          | event.type[0]:="info"
          | event.dataset:="cloudtrail.s3";
      "CreateJob" => event.category[0]:="process"
          | event.type[0]:="start"
          | event.dataset:="cloudtrail.s3";
      in(values=["StartInstances", "RunInstances"]) => event.category[0]:="configuration"
          | event.type[0]:="info"
          | event.type[1]:="start"
          | event.dataset:="cloudtrail.s3";
      "CreateKeyPair" => event.category[0]:="iam"
          | event.type[0]:="admin"
          | event.type[1]:="creation"
          | event.dataset:="cloudtrail.s3";
      "AssumeRoleWithSAML" => event.category[0]:="authentication"
          | event.type[0]:="info";
      "DescribeInstances" => event.category[0]:="configuration"
          | event.type[0]:="info";
      "UpdateTrail" => event.category[0]:="configuration"
          | event.type[0]:="change";
      "CreateGroup" => event.category[0]:="iam"
          | event.type[0]:="group"
          | event.type[1]:="creation"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "CreateKeyPair" => event.category[0]:="iam"
          | event.type[0]:="admin"
          | event.type[1]:="creation"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "CreateUser" => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="creation"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      "UpdateRole" => event.category[0]:="iam"
          | event.type[0]:="admin"
          | event.type[1]:="change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      in(values=["UpdateSSHPublicKey", "UpdateUser"]) => event.category[0]:="iam"
          | event.type[0]:="user"
          | event.type[1]:="change"
          | event.dataset:="cloudtrail.iam"
          | observer.type := "iam";
      * => *
          | event.type[0] := "info";
  }
  // #endregion

  // #region POST-NORMALIZATION
    /************************************************************
    ****** Post Normalization
    ****** Custom parser logic needed after normalization
    ************************************************************/

  // #endregion
tagFields:
  - Cps.version
  - Vendor
  - ecs.version
  - event.dataset
  - event.kind
  - event.module
  - event.outcome
  - observer.type
