☁️
CTHFM: AWS
  • Welcome
  • Getting Started
    • Account Setup
  • AWS CLI
    • AWS CLI Overview
    • Installation
  • AWS Fundamentals
    • AWS Documentation
    • AWS Shared Responsibility Model
    • Organizational Hierarchy
    • AWS Principals
    • IAM Fundamentals
      • IAM Policy Components
      • IAM Documentation References
    • AWS Security Services Overview
    • AWS Core Services
    • AWS Frameworks
    • Regions and Availability Zones
  • SQL
    • SQL Refresher for Threat Hunting
  • Logging Reference
    • Cloudtrail
      • What is Cloudtrail?
      • Setting Up Cloudtrail
      • Cloudtrail Events Structure
      • Filtering and Searching CloudTrail Logs
      • IAM ID Prefixes
      • Additional Resources
      • API References
    • VPCFlow Logs
    • GuardDuty
      • Multi-Account Setup
      • GuardDuty Concepts
      • GuardDuty Finding References
      • S3 Protection
      • Malware Protection
        • EC2 Malware Protection
          • EC2 Protection Resources
          • Monitoring Scans
          • EC2 Malware Protection Events: CloudWatch
        • S3 Malware Protection
          • Enabling S3 Malware Protection
          • After Enabling S3 Malware Protection
          • S3 Malware Resource Plan Status
          • S3 Malware Protection Quotas
      • RDS Protection Enablement
      • Lambda Protection Enablement
      • Trusted IP Lists and Threat Lists in Amazon GuardDuty
      • Remediation Recommendations
      • GuardDuty API Reference
      • GuardDuty Quotas
    • Access Analyzer
      • Setup
      • External Access and Unused Access Analyzer Findings
      • Review Findings
      • Access Analyzer Resources
      • Access Analyzer API Reference
    • AWS Network Firewall
      • Permissions
      • Firewall Log Contents
      • Logging Destinations
      • CloudWatch Firewall Metrics
    • AWS Config
      • Resource Management in AWS Config
      • AWS Config Integrations
      • AWS Config Resources
      • Configuration Item
      • Config Rules
        • Evaluation Modes
  • CloudWatch
    • Amazon CloudWatch
      • CloudWatch Concepts
      • CloudWatch Metrics
        • Filter Pattern Syntax
      • CloudWatch Alarms
        • Alarm Recommendations
      • Subscriptions
      • CloudWatch Agent
      • CloudWatch Insights
        • Supported Logs and Discovered Fields
        • CloudWatch Insights Query Syntax
      • Anomaly Detection
        • Create Anomaly Detector
        • Alarms for Anomaly Detections
      • CloudWatch Filter Syntax
      • CloudWatch Service Quota
  • Athena For Threat Hunting
    • Introduction to Athena
    • Setting Up Athena
    • SQL For Threat Hunters
    • Automated Response
    • Query Best Practices
  • AWS Security Research and Resources
    • AWS Security Blog
    • AWS Goat
    • Cloud Goat
    • Pacu
    • Prowler
    • Scout Suite
  • Threat Hunting in AWS
    • Threat Hunting in AWS
    • Threat Hunting Introduction
    • Threat Hunting Process
      • Hypothesis Generation
      • Investigation
      • Identification
      • Resolution & Follow Up
    • Pyramid of Pain
    • MITRE Att&ck
      • MITRE Att&ck Concepts
      • MITRE Att&CK Data Sources
      • MITRE Att&CK Mitigations
    • MITRE Att&ck: AWS
      • MITRE Att&CK Matrix
      • Amazon Web Services Security Control Mappings
    • AWS Threat Hunting Ideas
      • AWS Threat Hunting Ideas: EC2
      • AWS Threat Hunting Ideas: Lambda
      • AWS Threat Hunting Ideas: SQS
      • AWS Threat Hunting Ideas: SNS
      • AWS Threat Hunting Ideas: RDS
Powered by GitBook
On this page
  • Introduction
  • Overview of a CloudTrail Event
  • Key Components of a CloudTrail Event
  1. Logging Reference
  2. Cloudtrail

Cloudtrail Events Structure

Introduction

Understanding the structure of a CloudTrail event is crucial for effectively analyzing and interpreting the logs generated by AWS CloudTrail. Each event in CloudTrail captures detailed information about actions taken in your AWS account, providing valuable insights into user activity and service operations. In this lesson, we will break down the anatomy of a CloudTrail event, exploring its key components and fields to help you gain a deeper understanding of the data captured by CloudTrail.

Overview of a CloudTrail Event

A CloudTrail event is a JSON-formatted record that provides a detailed account of an API call or activity that occurred within your AWS environment. Each event captures information such as who made the call, what action was taken, when it occurred, where it was made from, and how AWS responded.

Here’s a high-level breakdown of the structure of a typical CloudTrail event:

{
    "eventVersion": "1.08",
    "userIdentity": { ... },
    "eventTime": "2023-08-31T14:26:48Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "RunInstances",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "203.0.113.0",
    "userAgent": "aws-cli/2.0",
    "requestParameters": { ... },
    "responseElements": { ... },
    "requestID": "12345678-1234-1234-1234-123456789012",
    "eventID": "abcd1234-1234-5678-1234-abcd56781234",
    "eventType": "AwsApiCall",
    "recipientAccountId": "123456789012",
    "errorCode": null,
    "errorMessage": null,
    "resources": [ ... ],
    "additionalEventData": { ... },
    "vpcEndpointId": "vpce-1a2b3c4d",
    "eventCategory": "Management"
}

Key Components of a CloudTrail Event

  1. eventVersion

    • Description: Indicates the version of the event format. AWS may update this version as the event structure evolves over time.

    • Usage: Helps ensure compatibility with tools that process or analyze CloudTrail logs.

  2. userIdentity

    • Description: Contains information about the identity of the user or service that made the API call. This field is crucial for identifying the source of the action.

    • Subfields:

      • type: The type of identity making the call (e.g., IAM User, AssumedRole, Root, AWS Service).

      • arn: The Amazon Resource Name (ARN) of the user or service.

      • accountId: The AWS account ID of the user.

      • userName: The name of the IAM user (if applicable).

  3. eventTime

    • Description: The exact timestamp when the event occurred, in ISO 8601 format (UTC).

    • Usage: Essential for building timelines during incident response or auditing.

  4. eventSource

    • Description: The AWS service that was the target of the API call (e.g., ec2.amazonaws.com, s3.amazonaws.com).

    • Usage: Identifies the service affected by the event, helping to categorize and prioritize log analysis.

  5. eventName

    • Description: The name of the API operation that was invoked (e.g., RunInstances, PutObject, DescribeInstances).

    • Usage: Critical for understanding what action was taken, especially when identifying potentially malicious activity.

  6. awsRegion

    • Description: The AWS region where the API call was made (e.g., us-west-2, eu-central-1).

    • Usage: Helps localize the event to a specific geographic region, which can be important for compliance and operational purposes.

  7. sourceIPAddress

    • Description: The IP address from which the API call was made.

    • Usage: Useful for identifying the origin of the request, especially when investigating unauthorized access.

  8. userAgent

    • Description: The user agent string associated with the API request, indicating the tool, SDK, or method used to make the call (e.g., aws-cli/2.0, Boto3/1.17).

    • Usage: Provides context about how the request was made, which can help in understanding user behavior or detecting anomalies.

  9. requestParameters

    • Description: A JSON object containing the parameters that were passed to the API call.

    • Usage: Helps in understanding the specifics of the request, such as which resources were targeted or what configurations were set.

  10. responseElements

    • Description: A JSON object containing the response returned by the AWS service after the API call was executed.

    • Usage: Allows you to see the outcome of the request, including any data returned by the service.

  11. requestID

    • Description: A unique identifier for the API request, assigned by AWS.

    • Usage: Can be used for tracking and correlating related events, especially when troubleshooting or during forensic analysis.

  12. eventID

    • Description: A unique identifier for the CloudTrail event itself.

    • Usage: Useful for referencing specific events in logs or when discussing them with AWS Support.

  13. eventType

    • Description: The type of event, typically AwsApiCall for most API operations.

    • Usage: Helps categorize the event and understand its context within the larger set of log data.

  14. recipientAccountId

    • Description: The AWS account ID that received the event.

    • Usage: Important when monitoring cross-account activities, ensuring that the correct account is being audited.

  15. errorCode and errorMessage

    • Description: If the API call failed, these fields will contain the error code and message returned by the service.

    • Usage: Crucial for troubleshooting failed operations and understanding why a request didn’t succeed.

  16. resources

    • Description: A list of AWS resources that were affected by the API call.

    • Usage: Helps identify which resources were created, modified, or deleted as a result of the API operation.

  17. additionalEventData

    • Description: Contains supplementary information about the event, such as details specific to certain API calls or AWS services.

    • Usage: Provides more context for specialized events or actions.

  18. vpcEndpointId

    • Description: The ID of the VPC endpoint that was used to make the API call, if applicable.

    • Usage: Useful for understanding network traffic flow, especially in environments using VPC endpoints for private connectivity.

  19. eventCategory

    • Description: Categorizes the event as a Management event, Data event, or other types.

    • Usage: Helps in filtering and analyzing specific types of events.

PreviousSetting Up CloudtrailNextFiltering and Searching CloudTrail Logs

Last updated 8 months ago