Skip to content

Update cloudtrail.md #5292

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
May 5, 2025
Merged

Update cloudtrail.md #5292

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
6e8e93e
Update cloudtrail.md
JV0812 Apr 21, 2025
2ac57d0
Update cloudtrail.md
JV0812 Apr 24, 2025
2587d28
Merge branch 'main' into add-nodrop-to-the-query
JV0812 Apr 28, 2025
8fc6a6b
Merge branch 'main' into add-nodrop-to-the-query
JV0812 Apr 30, 2025
5c1a778
Update cloudtrail.md
JV0812 May 5, 2025
2000fea
Merge branch 'main' into add-nodrop-to-the-query
JV0812 May 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions docs/integrations/amazon-aws/cloudtrail.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,14 +83,13 @@ Once you begin uploading data, your daily data usage will increase. It's a good
### Field Extraction Template

```sql
| parse "\"sourceIPAddress\":\"*\"" as source_ipaddress
| parse "\"eventName\":\"*\"" as event_name
| parse "\"eventSource\":\"*\"" as event_source
| parse "\"awsRegion\":\"*\"" as aws_Region
| parse "\"userName\":\"*\"" as user
| parse "\"sourceIPAddress\":\"*\"" as source_ipaddress nodrop
| parse "\"eventName\":\"*\"" as event_name nodrop
| parse "\"eventSource\":\"*\"" as event_source nodrop
| parse "\"awsRegion\":\"*\"" as aws_Region nodrop
| parse "\"userName\":\"*\"" as user nodrop
```


### Enable Sumo Logic to track AWS Admin Activity

To track Admin activity in your AWS account, and to provide data for all Administrator Activity panels in the User Monitoring Dashboard, you'll need to inform Sumo Logic for the Admin AWS account. You can do this by uploading a CSV file via HTTP Source.
Expand Down Expand Up @@ -309,4 +308,4 @@ See information about S3 public objects and buckets, including counts of new pub
## Additional resources

* Blog: [What is AWS CloudTrail?](https://www.sumologic.com/blog/what-is-aws-cloudtrail/)
* App description: [Logs for Security app for AWS CloudTrail](https://www.sumologic.com/application/aws-cloudtrail/)
* App description: [Logs for Security app for AWS CloudTrail](https://www.sumologic.com/application/aws-cloudtrail/)