AWS CloudTrail
Collect AWS CloudTrail logs with Elastic Agent
Version | 2.24.0 (View all) |
Compatible Kibana version(s) | 8.14.0 or higher |
Supported Serverless project types | Security Observability |
Subscription level | Basic |
The AWS CloudTrail integration allows you to monitor AWS CloudTrail.
Use the AWS CloudTrail integration to collect and parse logs related to account activity across your AWS infrastructure. Then visualize that data in Kibana, create alerts to notify you if something goes wrong, and reference logs when troubleshooting an issue.
For example, you could use the data from this integration to spot unusual activity in your AWS accounts—like excessive failed AWS console sign in attempts.
IMPORTANT: Extra AWS charges on AWS API requests will be generated by this integration. Please refer to the AWS integration for more details.
Data streams
The AWS CloudTrail integration collects one type of data: logs.
Logs help you keep a record of every event that CloudTrail receives. These logs are useful for many scenarios, including security and access audits. See more details in the Logs reference.
Requirements
You need Elasticsearch for storing and searching your data and Kibana for visualizing and managing it. You can use our hosted Elasticsearch Service on Elastic Cloud, which is recommended, or self-manage the Elastic Stack on your own hardware.
Before using any AWS integration you will need:
- AWS Credentials to connect with your AWS account.
- AWS Permissions to make sure the user you're using to connect has permission to share the relevant data.
For more details about these requirements, please take a look at the AWS integration documentation.
Setup
Use this integration if you only need to collect data from the AWS CloudTrail service.
If you want to collect data from two or more AWS services, consider using the AWS integration. When you configure the AWS integration, you can collect data from as many AWS services as you'd like.
For step-by-step instructions on how to set up an integration, see the Getting started guide.
Advanced options
CloudWatch
The CloudWatch logs input has several advanced options to fit specific use cases.
Latency
AWS CloudWatch Logs sometimes takes extra time to make the latest logs available to clients like the Agent.
The CloudWatch integration offers the latency
setting to address this scenario. Latency translates the query's time range to consider the CloudWatch Logs latency. For example, a 5m
latency means the integration will query CloudWatch for logs available 5 minutes ago.
Number of workers
If you are collecting log events from multiple log groups using log_group_name_prefix
, you should review the value of the number_of_workers
.
The number_of_workers
setting defines the number of workers assigned to reading from log groups. Each log group matching the log_group_name_prefix
requires a worker to keep log ingestion as close to real-time as possible. For example, if log_group_name_prefix
matches five log groups, then number_of_workers
should be set to 5
. The default value is 1
.
Logs reference
The cloudtrail
data stream collects AWS CloudTrail logs. CloudTrail monitors events like
user activity and API usage in AWS services. If a user creates a trail, it delivers those events as log
files to a specific Amazon S3 bucket.
Note: Use the CloudTrail Digest Logs regex setting to define regex to match the path of the CloudTrail Digest S3 Objects you'd like to read. If blank, CloudTrail Digest logs will be skipped.
ECS Field Reference
Please refer to the following document for detailed information on ECS fields.
Exported fields
Field | Description | Type |
---|---|---|
@timestamp | Event timestamp. | date |
aws.cloudtrail.additional_eventdata | Additional data about the event that was not part of the request or response. | keyword |
aws.cloudtrail.additional_eventdata.text | Multi-field of aws.cloudtrail.additional_eventdata . | text |
aws.cloudtrail.api_version | Identifies the API version associated with the AwsApiCall eventType value. | keyword |
aws.cloudtrail.console_login.additional_eventdata.login_to | URL for ConsoleLogin | keyword |
aws.cloudtrail.console_login.additional_eventdata.mfa_used | Identifies whether multi factor authentication was used during ConsoleLogin | boolean |
aws.cloudtrail.console_login.additional_eventdata.mobile_version | Identifies whether ConsoleLogin was from mobile version | boolean |
aws.cloudtrail.error_code | The AWS service error if the request returns an error. | keyword |
aws.cloudtrail.error_message | If the request returns an error, the description of the error. | keyword |
aws.cloudtrail.event_category | The CloudTrail event category. | keyword |
aws.cloudtrail.event_type | Identifies the type of event that generated the event record. | keyword |
aws.cloudtrail.event_version | The CloudTrail version of the log event format. | keyword |
aws.cloudtrail.flattened.additional_eventdata | Additional data about the event that was not part of the request or response. | flattened |
aws.cloudtrail.flattened.digest | Additional digest information. | flattened |
aws.cloudtrail.flattened.insight_details | Additional insight details. | flattened |
aws.cloudtrail.flattened.request_parameters | The parameters, if any, that were sent with the request. | flattened |
aws.cloudtrail.flattened.response_elements | The response element for actions that make changes (create, update, or delete actions). | flattened |
aws.cloudtrail.flattened.service_event_details | Identifies the service event, including what triggered the event and the result. | flattened |
aws.cloudtrail.management_event | A Boolean value that identifies whether the event is a management event. | keyword |
aws.cloudtrail.read_only | Identifies whether this operation is a read-only operation. | boolean |
aws.cloudtrail.recipient_account_id | Represents the account ID that received this event. | keyword |
aws.cloudtrail.request_id | The value that identifies the request. The service being called generates this value. | keyword |
aws.cloudtrail.request_parameters | The parameters, if any, that were sent with the request. | keyword |
aws.cloudtrail.request_parameters.text | Multi-field of aws.cloudtrail.request_parameters . | text |
aws.cloudtrail.resources.account_id | Account ID of the resource owner | keyword |
aws.cloudtrail.resources.arn | Resource ARNs | keyword |
aws.cloudtrail.resources.type | Resource type identifier in the format: AWS::aws-service-name::data-type-name | keyword |
aws.cloudtrail.response_elements | The response element for actions that make changes (create, update, or delete actions). | keyword |
aws.cloudtrail.response_elements.text | Multi-field of aws.cloudtrail.response_elements . | text |
aws.cloudtrail.service_event_details | Identifies the service event, including what triggered the event and the result. | keyword |
aws.cloudtrail.service_event_details.text | Multi-field of aws.cloudtrail.service_event_details . | text |
aws.cloudtrail.shared_event_id | GUID generated by CloudTrail to uniquely identify CloudTrail events from the same AWS action that is sent to different AWS accounts. | keyword |
aws.cloudtrail.user_identity.access_key_id | The access key ID that was used to sign the request. | keyword |
aws.cloudtrail.user_identity.arn | The Amazon Resource Name (ARN) of the principal that made the call. | keyword |
aws.cloudtrail.user_identity.invoked_by | The name of the AWS service that made the request, such as Amazon EC2 Auto Scaling or AWS Elastic Beanstalk. | keyword |
aws.cloudtrail.user_identity.session_context.creation_date | The date and time when the temporary security credentials were issued. | date |
aws.cloudtrail.user_identity.session_context.mfa_authenticated | The value is true if the root user or IAM user whose credentials were used for the request also was authenticated with an MFA device; otherwise, false. | keyword |
aws.cloudtrail.user_identity.session_context.session_issuer.account_id | The account that owns the entity that was used to get credentials. | keyword |
aws.cloudtrail.user_identity.session_context.session_issuer.arn | The ARN of the source (account, IAM user, or role) that was used to get temporary security credentials. | keyword |
aws.cloudtrail.user_identity.session_context.session_issuer.principal_id | The internal ID of the entity that was used to get credentials. | keyword |
aws.cloudtrail.user_identity.session_context.session_issuer.type | The source of the temporary security credentials, such as Root, IAMUser, or Role. | keyword |
aws.cloudtrail.user_identity.type | The type of the identity | keyword |
aws.cloudtrail.vpc_endpoint_id | Identifies the VPC endpoint in which requests were made from a VPC to another AWS service, such as Amazon S3. | keyword |
aws.s3.bucket.arn | ARN of the S3 bucket that this log retrieved from. | keyword |
aws.s3.bucket.name | Name of a S3 bucket. | keyword |
aws.s3.metadata | AWS S3 object metadata values. | flattened |
aws.s3.object.key | Name of the S3 object that this log retrieved from. | keyword |
cloud.image.id | Image ID for the cloud instance. | keyword |
data_stream.dataset | Data stream dataset. | constant_keyword |
data_stream.namespace | Data stream namespace. | constant_keyword |
data_stream.type | Data stream type. | constant_keyword |
event.module | Event module | constant_keyword |
host.containerized | If the host is a container. | boolean |
host.os.build | OS build information. | keyword |
host.os.codename | OS codename, if any. | keyword |
input.type | Input type | keyword |
log.offset | Log offset | long |
An example event for cloudtrail
looks as following:
{
"@timestamp": "2020-09-11T19:36:49.000Z",
"agent": {
"ephemeral_id": "66f9cd95-19fa-49fa-8ea4-5b8c8f96ef61",
"id": "acba78ef-1401-4689-977c-d8c2e5d6a8fa",
"name": "docker-fleet-agent",
"type": "filebeat",
"version": "8.10.1"
},
"aws": {
"cloudtrail": {
"flattened": {
"digest": {
"end_time": "2020-09-11T19:36:49.000Z",
"log_files": [
{
"hashAlgorithm": "SHA-256",
"hashValue": "420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c",
"newestEventTime": "2020-09-11T19:26:24Z",
"oldestEventTime": "2020-09-11T19:26:24Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196",
"newestEventTime": "2020-09-11T19:11:18Z",
"oldestEventTime": "2020-09-11T19:11:18Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70",
"newestEventTime": "2020-09-11T18:32:04Z",
"oldestEventTime": "2020-09-11T18:32:04Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689",
"newestEventTime": "2020-09-11T19:21:28Z",
"oldestEventTime": "2020-09-11T19:21:28Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097",
"newestEventTime": "2020-09-11T18:51:21Z",
"oldestEventTime": "2020-09-11T18:51:21Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b",
"newestEventTime": "2020-09-11T18:46:45Z",
"oldestEventTime": "2020-09-11T18:46:45Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5",
"newestEventTime": "2020-09-11T19:01:06Z",
"oldestEventTime": "2020-09-11T19:01:06Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7",
"newestEventTime": "2020-09-11T19:16:12Z",
"oldestEventTime": "2020-09-11T19:16:12Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba",
"newestEventTime": "2020-09-11T18:56:05Z",
"oldestEventTime": "2020-09-11T18:56:05Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7",
"newestEventTime": "2020-09-11T19:06:31Z",
"oldestEventTime": "2020-09-11T19:06:31Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6",
"newestEventTime": "2020-09-11T18:41:58Z",
"oldestEventTime": "2020-09-11T18:41:58Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz"
},
{
"hashAlgorithm": "SHA-256",
"hashValue": "9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771",
"newestEventTime": "2020-09-11T18:37:10Z",
"oldestEventTime": "2020-09-11T18:37:10Z",
"s3Bucket": "alice-bucket",
"s3Object": "AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz"
}
],
"newest_event_time": "2020-09-11T19:26:24.000Z",
"oldest_event_time": "2020-09-11T18:32:04.000Z",
"previous_hash_algorithm": "SHA-256",
"previous_s3_bucket": "alice-bucket",
"s3_bucket": "alice-bucket",
"signature_algorithm": "SHA256withRSA",
"start_time": "2020-09-11T18:36:49.000Z"
}
}
},
"s3": {
"bucket": {
"arn": "arn:aws:s3:::elastic-package-aws-bucket-64547",
"name": "elastic-package-aws-bucket-64547"
},
"object": {
"key": "cloudtrail-digest.log"
}
}
},
"cloud": {
"account": {
"id": "123456789123"
},
"region": "us-east-1"
},
"data_stream": {
"dataset": "aws.cloudtrail",
"namespace": "ep",
"type": "logs"
},
"ecs": {
"version": "8.11.0"
},
"elastic_agent": {
"id": "acba78ef-1401-4689-977c-d8c2e5d6a8fa",
"snapshot": false,
"version": "8.10.1"
},
"event": {
"agent_id_status": "verified",
"created": "2023-11-03T14:36:58.706Z",
"dataset": "aws.cloudtrail",
"ingested": "2023-11-03T14:37:00Z",
"kind": "event",
"original": "{\"awsAccountId\":\"123456789123\",\"digestStartTime\":\"2020-09-11T18:36:49Z\",\"digestEndTime\":\"2020-09-11T19:36:49Z\",\"digestS3Bucket\":\"alice-bucket\",\"digestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz\",\"digestPublicKeyFingerprint\":\"47aaa19f7eec22e9bd0b5e58cfade8cb\",\"digestSignatureAlgorithm\":\"SHA256withRSA\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\",\"previousDigestS3Bucket\":\"alice-bucket\",\"previousDigestS3Object\":\"AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T183649Z.json.gz\",\"previousDigestHashValue\":\"531914fcfa0dbacf0c9dd1475a1fdcb5dea6e85921409f3c3ec0ba39063c860\",\"previousDigestHashAlgorithm\":\"SHA-256\",\"previousDigestSignature\":\"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987\",\"logFiles\":[{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1930Z_l2pGqVS53QcGdAkp.json.gz\",\"hashValue\":\"420784a5bbc12e9ac442451e8ec1356744fdeabf4fee0d2222508db6d448139c\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:26:24Z\",\"oldestEventTime\":\"2020-09-11T19:26:24Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1915Z_TIKlbLnJ6IwUxqxw.json.gz\",\"hashValue\":\"4e1eb2a8b41d032cbb16e5449fc8f3eac304e7d43017a391b37c788c77336196\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:11:18Z\",\"oldestEventTime\":\"2020-09-11T19:11:18Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1835Z_OPJhVNodH1gY760s.json.gz\",\"hashValue\":\"2695aeb3b4c1f021fe76e0b36f5ac15e557c41c58af6eef282d77ef056210d70\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:32:04Z\",\"oldestEventTime\":\"2020-09-11T18:32:04Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1925Z_zJNGzQovyNAImZV9.json.gz\",\"hashValue\":\"45a2906f55cbfc912584e9425f8d3d8d6fabf571a45a5ecd7d2a0f4132b81689\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:21:28Z\",\"oldestEventTime\":\"2020-09-11T19:21:28Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1855Z_RqN9YzoKAJCKbejj.json.gz\",\"hashValue\":\"515cc8be750d815266b4fc799c7600765f22502d29f5bb9d5c8969ffc5ab7097\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:51:21Z\",\"oldestEventTime\":\"2020-09-11T18:51:21Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1850Z_jLldN7U8XrspES8p.json.gz\",\"hashValue\":\"18650414e79e084dff02da66253f071347f7bb5c4863279bafe7762a980f7c0b\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:46:45Z\",\"oldestEventTime\":\"2020-09-11T18:46:45Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1905Z_jBNdmg4bSGxZ3wC8.json.gz\",\"hashValue\":\"54050ec665636f1985f5b51ae43c74a58282cb2e500492a45f20a4dc1bf8a6d5\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:01:06Z\",\"oldestEventTime\":\"2020-09-11T19:01:06Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1920Z_bj5DRrmILF6jK23a.json.gz\",\"hashValue\":\"6e0d8fcbd712d3f6d1caf4a872681f4290b05ed8a8f1c9450a0a6db92ccab4d7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:16:12Z\",\"oldestEventTime\":\"2020-09-11T19:16:12Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1900Z_6LjrkrhsLQMzCiSN.json.gz\",\"hashValue\":\"b2b0e2804d1c6b92d76eee203d7eba32d3d003e6967f175723a83ecc2d7ad4ba\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:56:05Z\",\"oldestEventTime\":\"2020-09-11T18:56:05Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1910Z_DLyqye8LaeoD204N.json.gz\",\"hashValue\":\"4397a13565a67d9ed6e57737b98eb7e61ca52bb191c9b5da0423136dfc5581c7\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T19:06:31Z\",\"oldestEventTime\":\"2020-09-11T19:06:31Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1845Z_TSDKyASOn2ejOq5n.json.gz\",\"hashValue\":\"94f09d2398632c7b0c0066ed5d56768632dd2e06ed9c80af9d0c2c5f59bd60b6\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:41:58Z\",\"oldestEventTime\":\"2020-09-11T18:41:58Z\"},{\"s3Bucket\":\"alice-bucket\",\"s3Object\":\"AWSLogs/123456789123/CloudTrail/us-west-2/2020/09/11/123456789123_CloudTrail_us-west-2_20200911T1840Z_btJydJ2t7hCRnjsN.json.gz\",\"hashValue\":\"9044f9a05d70688bc6f6048d5f8d00764ab65e132b8ffefb193b22ca4394d771\",\"hashAlgorithm\":\"SHA-256\",\"newestEventTime\":\"2020-09-11T18:37:10Z\",\"oldestEventTime\":\"2020-09-11T18:37:10Z\"}]}",
"outcome": "success",
"type": [
"info"
]
},
"file": {
"hash": {
"sha256": "10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987"
},
"path": "AWSLogs/123456789123/CloudTrail-Digest/us-west-2/2020/09/11/123456789123_CloudTrail-Digest_us-west-2_leh-ct-test_us-west-2_20200911T193649Z.json.gz"
},
"input": {
"type": "aws-s3"
},
"log": {
"file": {
"path": "https://elastic-package-aws-bucket-64547.s3.us-east-1.amazonaws.com/cloudtrail-digest.log"
},
"offset": 0
},
"related": {
"hash": [
"10e0872f32fa1d299d0cc98e94d4c88a6a2eada9d9fc3ae6d53dfe8d54c7caf807072f1e1eec47efdeecfcc22483887f8fddfc954ae587fba43e7676b5547f432fa8722ba1c5baa6b233bcb528ce7c01e3748aab8f28c16c024de79da820128b4c9e5ce65e98a9c4e631687ecc89c224a11bb3df06ce441ff740e4ac9fbd41159e77f5863550118284121f193e357866fbd0463faffb56e194af196e35a7675c3bbd0a398f43159343c3f59129d6339a281a8fdb3192f3fffea9bd21dbb0a705ebfae1921f2133aab0ad29522aea6df0828c1780d3f3ed6b8270ab3ba24459916b0fbbe82fba6ff9677bafe7306e0f5edcc0f1508cdb4e36f3e3b30e653e9987"
]
},
"tags": [
"preserve_original_event",
"forwarded",
"aws-cloudtrail"
]
}
Changelog
Version | Details | Kibana version(s) |
---|---|---|
2.24.0 | Enhancement View pull request | 8.14.0 or higher |
2.23.0 | Enhancement View pull request | 8.14.0 or higher |
2.22.1 | Bug fix View pull request | 8.14.0 or higher |
2.22.0 | Enhancement View pull request | 8.14.0 or higher |
2.21.0 | Enhancement View pull request | 8.14.0 or higher |
2.20.0 | Enhancement View pull request | 8.14.0 or higher |
2.19.0 | Enhancement View pull request | 8.14.0 or higher |
2.18.0 | Enhancement View pull request | 8.14.0 or higher |
2.17.0 | Enhancement View pull request | 8.13.0 or higher |
2.16.0 | Enhancement View pull request | 8.12.0 or higher |
2.15.4 | Bug fix View pull request | 8.12.0 or higher |
2.15.3 | Enhancement View pull request | 8.12.0 or higher |
2.15.2 | Bug fix View pull request | 8.12.0 or higher |
2.15.1 | Bug fix View pull request | 8.12.0 or higher |
2.15.0 | Enhancement View pull request | 8.12.0 or higher |
2.14.2 | Bug fix View pull request | 8.12.0 or higher |
2.14.1 | Enhancement View pull request | 8.12.0 or higher |
2.14.0 | Enhancement View pull request | 8.12.0 or higher |
2.13.1 | Enhancement View pull request | 8.12.0 or higher |
2.13.0 | Enhancement View pull request | 8.12.0 or higher |
2.12.2 | Bug fix View pull request | 8.12.0 or higher |
2.12.1 | Enhancement View pull request | 8.12.0 or higher |
2.12.0 | Enhancement View pull request | 8.12.0 or higher |
2.11.3 | Bug fix View pull request | 8.10.2 or higher |
2.11.2 | Bug fix View pull request | 8.10.2 or higher |
2.11.1 | Enhancement View pull request | 8.10.2 or higher |
2.11.0 | Enhancement View pull request | 8.10.2 or higher |
2.10.2 | Bug fix View pull request | 8.10.2 or higher |
2.10.1 | Bug fix View pull request | 8.10.2 or higher |
2.10.0 | Enhancement View pull request | 8.10.2 or higher |
2.9.1 | Bug fix View pull request | 8.9.0 or higher |
2.9.0 | Enhancement View pull request | 8.9.0 or higher |
2.8.6 | Bug fix View pull request | 8.9.0 or higher |
2.8.5 | Enhancement View pull request | 8.9.0 or higher |
2.8.4 | Bug fix View pull request | 8.9.0 or higher |
2.8.3 | Bug fix View pull request | 8.9.0 or higher |
2.8.2 | Bug fix View pull request | 8.9.0 or higher |
2.8.1 | Bug fix View pull request | 8.9.0 or higher |
2.8.0 | Enhancement View pull request | 8.9.0 or higher |
2.7.0 | Enhancement View pull request | 8.9.0 or higher |
2.6.1 | Bug fix View pull request | 8.9.0 or higher |
2.6.0 | Enhancement View pull request | 8.9.0 or higher |
2.5.0 | Enhancement View pull request | 8.9.0 or higher |
2.4.1 | Bug fix View pull request | 8.9.0 or higher |
2.4.0 | Bug fix View pull request | 8.9.0 or higher |
2.3.0 | Enhancement View pull request | 8.9.0 or higher |
2.2.1 | Bug fix View pull request | 8.9.0 or higher |
2.2.0 | Enhancement View pull request | 8.9.0 or higher |
2.1.2 | Bug fix View pull request | 8.9.0 or higher |
2.1.1 | Enhancement View pull request | 8.9.0 or higher |
2.1.0 | Enhancement View pull request | 8.9.0 or higher |
2.0.0 | Enhancement View pull request | 8.9.0 or higher |
1.53.5 | Enhancement View pull request | 8.9.0 or higher |
1.53.4 | Enhancement View pull request | 8.9.0 or higher |
1.53.3 | Enhancement View pull request | 8.9.0 or higher |
1.53.2 | Bug fix View pull request | 8.9.0 or higher |
1.53.1 | Enhancement View pull request | 8.9.0 or higher |
1.53.0 | Enhancement View pull request | 8.9.0 or higher |
1.52.1 | Enhancement View pull request | 8.9.0 or higher |
1.52.0 | Enhancement View pull request | 8.9.0 or higher |
1.51.3 | Bug fix View pull request | 8.8.1 or higher |
1.51.2 | Enhancement View pull request | 8.8.1 or higher |
1.51.1 | Enhancement View pull request | 8.8.1 or higher |
1.51.0 | Enhancement View pull request | 8.8.1 or higher |
1.50.6 | Enhancement View pull request | 8.8.1 or higher |
1.50.5 | Enhancement View pull request | 8.8.1 or higher |
1.50.4 | Enhancement View pull request | 8.8.1 or higher |
1.50.3 | Enhancement View pull request | 8.8.1 or higher |
1.50.2 | Enhancement View pull request | 8.8.1 or higher |
1.50.1 | Enhancement View pull request | 8.8.1 or higher |
1.50.0 | Enhancement View pull request | 8.8.1 or higher |
1.49.0 | Enhancement View pull request | 8.8.1 or higher |
1.48.0 | Enhancement View pull request | 8.8.1 or higher |
1.47.1 | Enhancement View pull request | 8.8.1 or higher |
1.47.0 | Enhancement View pull request | 8.8.1 or higher |
1.46.9 | Enhancement View pull request | 8.8.1 or higher |
1.46.8 | Enhancement View pull request | 8.8.1 or higher |
1.46.7 | Enhancement View pull request | 8.8.1 or higher |
1.46.6 | Enhancement View pull request | 8.8.1 or higher |
1.46.5 | Enhancement View pull request | 8.8.1 or higher |
1.46.4 | Enhancement View pull request | — |
1.46.3 | Enhancement View pull request | 8.8.1 or higher |
1.46.2 | Enhancement View pull request | 8.8.1 or higher |
1.46.1 | Enhancement View pull request | 8.8.1 or higher |
1.46.0 | Enhancement View pull request | 8.8.1 or higher |
1.45.9 | Enhancement View pull request | 8.8.1 or higher |
1.45.8 | Enhancement View pull request | 8.8.1 or higher |
1.45.7 | Enhancement View pull request | 8.8.1 or higher |
1.45.6 | Enhancement View pull request | 8.8.1 or higher |
1.45.4 | Enhancement View pull request | 8.8.1 or higher |
1.45.3 | Bug fix View pull request | 8.8.1 or higher |
1.45.2 | Enhancement View pull request | 8.8.1 or higher |
1.45.1 | Enhancement View pull request | 8.8.1 or higher |
1.45.0 | Enhancement View pull request | 8.8.1 or higher |
1.44.4 | Enhancement View pull request | 8.8.1 or higher |
1.44.3 | Enhancement View pull request | 8.8.1 or higher |
1.44.2 | Bug fix View pull request | 8.8.1 or higher |
1.44.1 | Enhancement View pull request | 8.8.1 or higher |
1.44.0 | Enhancement View pull request | 8.8.1 or higher |
1.43.2 | Enhancement View pull request | 8.8.1 or higher |
1.43.1 | Enhancement View pull request | 8.8.1 or higher |
1.43.0 | Enhancement View pull request | 8.8.1 or higher |
1.42.0 | Enhancement View pull request | 8.7.1 or higher |
1.41.0 | Enhancement View pull request | 8.7.1 or higher |
1.40.9 | Enhancement View pull request | 8.7.1 or higher |
1.40.8 | Enhancement View pull request | 8.7.1 or higher |
1.40.7 | Enhancement View pull request | 8.7.1 or higher |
1.40.6 | Enhancement View pull request | 8.7.1 or higher |
1.40.5 | Enhancement View pull request | 8.7.1 or higher |
1.40.4 | Enhancement View pull request | 8.7.1 or higher |
1.40.3 | Enhancement View pull request | 8.7.1 or higher |
1.40.2 | Enhancement View pull request | 8.7.1 or higher |
1.40.1 | Enhancement View pull request | 8.7.1 or higher |
1.40.0 | Enhancement View pull request | 8.7.1 or higher |
1.39.0 | Enhancement View pull request | 8.7.1 or higher |
1.38.4 | Enhancement View pull request | 8.7.1 or higher |
1.38.3 | Enhancement View pull request | 8.7.1 or higher |
1.38.2 | Enhancement View pull request | 8.7.1 or higher |
1.38.1 | Enhancement View pull request | 8.7.1 or higher |
1.38.0 | Enhancement View pull request | 8.7.1 or higher |
1.37.3 | Bug fix View pull request | 8.7.1 or higher |
1.37.2 | Enhancement View pull request | 8.7.1 or higher |
1.37.1 | Enhancement View pull request | 8.7.1 or higher |
1.37.0 | Enhancement View pull request | 8.7.1 or higher |
1.36.9 | Enhancement View pull request | 8.7.1 or higher |
1.36.8 | Enhancement View pull request | 8.7.1 or higher |
1.36.7 | Enhancement View pull request | 8.7.1 or higher |
1.36.6 | Enhancement View pull request | 8.7.1 or higher |
1.36.5 | Enhancement View pull request | 8.7.1 or higher |
1.36.4 | Enhancement View pull request | 8.7.1 or higher |
1.36.3 | Enhancement View pull request | 8.7.1 or higher |
1.36.2 | Enhancement View pull request | 8.7.1 or higher |
1.36.1 | Enhancement View pull request | 8.7.1 or higher |
1.36.0 | Enhancement View pull request | 8.7.1 or higher |
1.35.1 | Bug fix View pull request | 8.7.1 or higher |
1.35.0 | Enhancement View pull request | 8.7.1 or higher |
1.34.5 | Enhancement View pull request | 8.6.0 or higher |
1.34.4 | Enhancement View pull request | 8.6.0 or higher |
1.34.3 | Enhancement View pull request | 8.6.0 or higher |
1.34.2 | Enhancement View pull request | 8.6.0 or higher |
1.34.1 | Enhancement View pull request | 8.6.0 or higher |
1.34.0 | Enhancement View pull request | 8.6.0 or higher |
1.33.3 | Enhancement View pull request | 8.6.0 or higher |
1.33.2 | Bug fix View pull request | 8.6.0 or higher |
1.33.1 | Bug fix View pull request | 8.6.0 or higher |
1.33.0 | Enhancement View pull request | 8.6.0 or higher |
1.32.2 | Bug fix View pull request | 8.6.0 or higher |
1.32.1 | Enhancement View pull request | 8.6.0 or higher |
1.32.0 | Enhancement View pull request | 8.6.0 or higher |
1.31.0 | Enhancement View pull request | 8.6.0 or higher |
1.30.0 | Enhancement View pull request | 8.6.0 or higher |
1.29.1 | Bug fix View pull request | 8.6.0 or higher |
1.29.0 | Enhancement View pull request | 8.6.0 or higher |
1.28.3 | Bug fix View pull request | 8.4.0 or higher |
1.28.2 | Bug fix View pull request | 8.4.0 or higher |
1.28.1 | Enhancement View pull request | 8.4.0 or higher |
1.28.0 | Enhancement View pull request | 8.4.0 or higher |
1.27.3 | Bug fix View pull request | 8.4.0 or higher |
1.27.2 | Enhancement View pull request | 8.4.0 or higher |
1.27.1 | Enhancement View pull request | 8.4.0 or higher |
1.27.0 | Enhancement View pull request | 8.4.0 or higher |
1.25.3 | Bug fix View pull request | 8.3.0 or higher |
1.25.2 | Bug fix View pull request | 8.3.0 or higher |
1.25.1 | Bug fix View pull request | 8.3.0 or higher |
1.25.0 | Enhancement View pull request | 8.3.0 or higher |
1.24.6 | Bug fix View pull request | 8.3.0 or higher |
1.24.5 | Bug fix View pull request | 8.3.0 or higher |
1.24.4 | Bug fix View pull request | 8.3.0 or higher |
1.24.3 | Bug fix View pull request | 8.3.0 or higher |
1.24.2 | Bug fix View pull request | 8.3.0 or higher |
1.24.1 | Bug fix View pull request | 8.3.0 or higher |
1.24.0 | Bug fix View pull request | 8.3.0 or higher |
1.23.4 | Bug fix View pull request | 8.3.0 or higher |
1.23.3 | Bug fix View pull request | 8.3.0 or higher |
1.23.2 | Bug fix View pull request | 8.3.0 or higher |
1.23.1 | Enhancement View pull request | 8.1.0 or higher |
1.23.0 | Bug fix View pull request | 8.1.0 or higher |
1.22.0 | Enhancement View pull request | 8.1.0 or higher |
1.21.0 | Enhancement View pull request | 8.1.0 or higher |
1.20.0 | Enhancement View pull request | 8.1.0 or higher |
1.19.5 | Enhancement View pull request | 7.15.0 or higher |
1.19.4 | Bug fix View pull request | 7.15.0 or higher |
1.19.3 | Bug fix View pull request | 7.15.0 or higher |
1.19.2 | Enhancement View pull request | 7.15.0 or higher |
1.19.1 | Enhancement View pull request | 7.15.0 or higher |
1.19.0 | Enhancement View pull request | 7.15.0 or higher |
1.18.2 | Enhancement View pull request | 7.15.0 or higher |
1.18.1 | Enhancement View pull request | 7.15.0 or higher |
1.18.0 | Enhancement View pull request | 7.15.0 or higher |
1.17.5 | Enhancement View pull request | 7.15.0 or higher |
1.17.4 | Bug fix View pull request | 7.15.0 or higher |
1.17.3 | Bug fix View pull request | 7.15.0 or higher |
1.17.2 | Bug fix View pull request | 7.15.0 or higher |
1.17.1 | Bug fix View pull request | 7.15.0 or higher |
1.17.0 | Enhancement View pull request | 7.15.0 or higher |
1.16.6 | Enhancement View pull request | 7.15.0 or higher |
1.16.5 | Enhancement View pull request | — |
1.16.4 | Bug fix View pull request | 7.15.0 or higher |
1.16.3 | Enhancement View pull request | — |
1.16.2 | Enhancement View pull request | — |
1.16.1 | Bug fix View pull request | — |
1.16.0 | Enhancement View pull request | 7.15.0 or higher |
1.15.0 | Enhancement View pull request | — |
1.14.8 | Bug fix View pull request | 7.15.0 or higher |
1.14.7 | Bug fix View pull request | 7.15.0 or higher |
1.14.6 | Enhancement View pull request | — |
1.14.5 | Bug fix View pull request | 7.15.0 or higher |
1.14.4 | Bug fix View pull request | — |
1.14.3 | Enhancement View pull request | — |
1.14.2 | Bug fix View pull request | — |
1.14.1 | Enhancement View pull request | — |
1.14.0 | Enhancement View pull request | 7.15.0 or higher |
1.13.1 | Bug fix View pull request | 7.15.0 or higher |
1.13.0 | Enhancement View pull request | 7.15.0 or higher |
1.12.1 | Bug fix View pull request | 7.15.0 or higher |
1.12.0 | Enhancement View pull request | — |
1.11.4 | Bug fix View pull request | — |
1.11.3 | Bug fix View pull request | — |
1.11.2 | Bug fix View pull request | — |
1.11.1 | Bug fix View pull request | — |
1.11.0 | Enhancement View pull request | 7.15.0 or higher |
1.10.2 | Enhancement View pull request | 7.15.0 or higher |
1.10.1 | Enhancement View pull request | — |
1.10.0 | Enhancement View pull request | — |
1.9.0 | Enhancement View pull request | 7.15.0 or higher |
1.8.0 | Enhancement View pull request | — |
1.7.1 | Bug fix View pull request | — |
1.7.0 | Enhancement View pull request | — |
1.6.2 | Bug fix View pull request | — |
1.6.1 | Enhancement View pull request | 7.15.0 or higher |
1.6.0 | Enhancement View pull request | — |
1.5.1 | Enhancement View pull request | 7.15.0 or higher |
1.5.0 | Enhancement View pull request | 7.15.0 or higher |
1.4.1 | Enhancement View pull request | 7.15.0 or higher |
1.4.0 | Enhancement View pull request | — |
1.3.2 | Enhancement View pull request | — |
1.3.1 | Enhancement View pull request | — |
1.3.0 | Enhancement View pull request | — |
1.2.2 | Bug fix View pull request | — |
1.2.1 | Bug fix View pull request | — |
1.2.0 | Enhancement View pull request | — |
1.1.0 | Enhancement View pull request | 7.14.0 or higher |
1.0.0 | Enhancement View pull request | 7.14.0 or higher |
0.10.7 | Enhancement View pull request | — |
0.10.6 | Bug fix View pull request | — |
0.10.5 | Bug fix View pull request | — |
0.10.4 | Enhancement View pull request | — |
0.10.3 | Enhancement View pull request | — |
0.10.2 | Enhancement View pull request | — |
0.10.1 | Enhancement View pull request | — |
0.10.0 | Enhancement View pull request | — |
0.9.3 | Bug fix View pull request | — |
0.9.2 | Enhancement View pull request | — |
0.9.1 | Bug fix View pull request | — |
0.9.0 | Enhancement View pull request | — |
0.8.0 | Enhancement View pull request | — |
0.7.0 | Enhancement View pull request | — |
0.6.4 | Enhancement View pull request | — |
0.6.3 | Bug fix View pull request | — |
0.6.2 | Bug fix View pull request | — |
0.6.1 | Enhancement View pull request | — |
0.6.0 | Enhancement View pull request | — |
0.5.6 | Bug fix View pull request | — |
0.5.5 | Enhancement View pull request | — |
0.5.4 | Enhancement View pull request | — |
0.5.3 | Enhancement View pull request | — |
0.5.2 | Enhancement View pull request | — |
0.5.1 | Bug fix View pull request | — |
0.5.0 | Enhancement View pull request | — |
0.4.2 | Enhancement View pull request | — |
0.4.1 | Bug fix View pull request | — |
0.4.0 | Enhancement View pull request | — |
0.0.3 | Enhancement View pull request | — |