Skip to content

Commit 23044d9

Browse files
romuletsromulets
authored
Cloudtrail add actor and target (#12685)
* Add Cloudtrail Actor and Target * Update toggle description * Fix accountId typo * Add versioning * Fix ec2 events without complete response elements * Improve error handling * Improve error handling (add tag to the document on error) * Use onBehalfOf in case of arn is not available in the user identity section * Bump manifest version
1 parent 04712a9 commit 23044d9

File tree

200 files changed

+12882
-259
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

200 files changed

+12882
-259
lines changed

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "2.44.0"
3+
changes:
4+
- description: Add `actor.entity.id` and `target.entity.id`
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/12685
27
- version: "2.43.0"
38
changes:
49
- description: Set `event.type` and `event.action` fields in vpcflow logs.

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"awsRegion":"us-east-1","eventCategory":"Management","eventID":"98675cf5-df23-4169-8411-58429782c464","eventName":"AddPermission20150331v2","eventSource":"lambda.amazonaws.com","eventTime":"2024-10-10T15:07:03Z","eventType":"AwsApiCall","eventVersion":"1.08","readOnly":false,"recipientAccountId":"000000000","requestID":"84a87304-e9d7-4a99-ae71-dfc74faf5f12","requestParameters":{"action":"lambda:InvokeFunction","functionName":"cloudtrail-events-test","principal":"sns.amazonaws.com","statementId":"sns"},"responseElements":{"statement":"{\"Sid\":\"sns\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-east-1:000000000:function:cloudtrail-events-test\"}"},"sourceIPAddress":"216.160.83.56","tlsDetails":{"cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"lambda.us-east-1.amazonaws.com","tlsVersion":"TLSv1.3"},"userAgent":"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_8ce3f005-c362-4713-912a-4d6f5c122258 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#lambda.add-permission","userIdentity":{"accessKeyId":"ACCESSKEYID","accountId":"000000000","arn":"arn:aws:iam::000000000:user/[email protected]","principalId":"PRINCIPALID","type":"IAMUser","userName":"[email protected]"}}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-permission-json.log-expected.json‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2024-10-10T15:07:03.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"arn:aws:iam::000000000:user/[email protected]"
9+
]
10+
}
11+
},
12+
"aws": {
13+
"cloudtrail": {
14+
"event_category": "Management",
15+
"event_type": "AwsApiCall",
16+
"event_version": "1.08",
17+
"flattened": {
18+
"request_parameters": {
19+
"action": "lambda:InvokeFunction",
20+
"functionName": "cloudtrail-events-test",
21+
"principal": "sns.amazonaws.com",
22+
"statementId": "sns"
23+
},
24+
"response_elements": {
25+
"statement": "{\"Sid\":\"sns\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-east-1:000000000:function:cloudtrail-events-test\"}"
26+
}
27+
},
28+
"read_only": false,
29+
"recipient_account_id": "000000000",
30+
"request_id": "84a87304-e9d7-4a99-ae71-dfc74faf5f12",
31+
"request_parameters": "{principal=sns.amazonaws.com, functionName=cloudtrail-events-test, statementId=sns, action=lambda:InvokeFunction}",
32+
"response_elements": "{statement={\"Sid\":\"sns\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"sns.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-east-1:000000000:function:cloudtrail-events-test\"}}",
33+
"user_identity": {
34+
"access_key_id": "ACCESSKEYID",
35+
"arn": "arn:aws:iam::000000000:user/[email protected]",
36+
"type": "IAMUser"
37+
}
38+
}
39+
},
40+
"cloud": {
41+
"account": {
42+
"id": "000000000"
43+
},
44+
"region": "us-east-1"
45+
},
46+
"ecs": {
47+
"version": "8.11.0"
48+
},
49+
"event": {
50+
"action": "AddPermission20150331v2",
51+
"created": "2021-11-11T01:02:03.123456789Z",
52+
"id": "98675cf5-df23-4169-8411-58429782c464",
53+
"kind": "event",
54+
"original": "{\"awsRegion\":\"us-east-1\",\"eventCategory\":\"Management\",\"eventID\":\"98675cf5-df23-4169-8411-58429782c464\",\"eventName\":\"AddPermission20150331v2\",\"eventSource\":\"lambda.amazonaws.com\",\"eventTime\":\"2024-10-10T15:07:03Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.08\",\"readOnly\":false,\"recipientAccountId\":\"000000000\",\"requestID\":\"84a87304-e9d7-4a99-ae71-dfc74faf5f12\",\"requestParameters\":{\"action\":\"lambda:InvokeFunction\",\"functionName\":\"cloudtrail-events-test\",\"principal\":\"sns.amazonaws.com\",\"statementId\":\"sns\"},\"responseElements\":{\"statement\":\"{\\\"Sid\\\":\\\"sns\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":{\\\"Service\\\":\\\"sns.amazonaws.com\\\"},\\\"Action\\\":\\\"lambda:InvokeFunction\\\",\\\"Resource\\\":\\\"arn:aws:lambda:us-east-1:000000000:function:cloudtrail-events-test\\\"}\"},\"sourceIPAddress\":\"216.160.83.56\",\"tlsDetails\":{\"cipherSuite\":\"TLS_AES_128_GCM_SHA256\",\"clientProvidedHostHeader\":\"lambda.us-east-1.amazonaws.com\",\"tlsVersion\":\"TLSv1.3\"},\"userAgent\":\"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_8ce3f005-c362-4713-912a-4d6f5c122258 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#lambda.add-permission\",\"userIdentity\":{\"accessKeyId\":\"ACCESSKEYID\",\"accountId\":\"000000000\",\"arn\":\"arn:aws:iam::000000000:user/[email protected]\",\"principalId\":\"PRINCIPALID\",\"type\":\"IAMUser\",\"userName\":\"[email protected]\"}}",
55+
"outcome": "success",
56+
"provider": "lambda.amazonaws.com",
57+
"type": [
58+
"info"
59+
]
60+
},
61+
"related": {
62+
"entity": [
63+
"[email protected]",
64+
"ACCESSKEYID",
65+
"arn:aws:iam::000000000:user/[email protected]",
66+
"cloudtrail-events-test"
67+
],
68+
"user": [
69+
"[email protected]"
70+
]
71+
},
72+
"source": {
73+
"address": "216.160.83.56",
74+
"as": {
75+
"number": 209
76+
},
77+
"geo": {
78+
"city_name": "Milton",
79+
"continent_name": "North America",
80+
"country_iso_code": "US",
81+
"country_name": "United States",
82+
"location": {
83+
"lat": 47.2513,
84+
"lon": -122.3149
85+
},
86+
"region_iso_code": "US-WA",
87+
"region_name": "Washington"
88+
},
89+
"ip": "216.160.83.56"
90+
},
91+
"tags": [
92+
"preserve_original_event",
93+
"actor_target_mapping"
94+
],
95+
"target": {
96+
"entity": {
97+
"id": [
98+
"cloudtrail-events-test"
99+
]
100+
}
101+
},
102+
"tls": {
103+
"cipher": "TLS_AES_128_GCM_SHA256",
104+
"client": {
105+
"server_name": "lambda.us-east-1.amazonaws.com"
106+
},
107+
"version": "1.3",
108+
"version_protocol": "tls"
109+
},
110+
"user": {
111+
"id": "PRINCIPALID",
112+
"name": "[email protected]"
113+
},
114+
"user_agent": {
115+
"device": {
116+
"name": "Other"
117+
},
118+
"name": "aws-cli",
119+
"original": "aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_8ce3f005-c362-4713-912a-4d6f5c122258 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#lambda.add-permission",
120+
"version": "2.17.60"
121+
}
122+
}
123+
]
124+
}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
"expected": [
33
{
44
"@timestamp": "2014-03-25T21:08:14.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"arn:aws:iam::123456789012:user/Alice"
9+
]
10+
}
11+
},
512
"aws": {
613
"cloudtrail": {
714
"event_version": "1.0",
@@ -52,7 +59,6 @@
5259
},
5360
"related": {
5461
"entity": [
55-
"EX_PRINCIPAL_ID",
5662
"arn:aws:iam::123456789012:user/Alice",
5763
"Bob",
5864
"EXAMPLE_KEY_ID",
@@ -68,7 +74,8 @@
6874
"ip": "127.0.0.1"
6975
},
7076
"tags": [
71-
"preserve_original_event"
77+
"preserve_original_event",
78+
"actor_target_mapping"
7279
],
7380
"user": {
7481
"id": "EX_PRINCIPAL_ID",
@@ -86,4 +93,4 @@
8693
}
8794
}
8895
]
89-
}
96+
}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,13 @@
22
"expected": [
33
{
44
"@timestamp": "2019-10-02T22:12:29.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"arn:aws:iam::111111111111:role/JohnRole1"
9+
]
10+
}
11+
},
512
"aws": {
613
"cloudtrail": {
714
"event_type": "AwsApiCall",
@@ -95,7 +102,6 @@
95102
},
96103
"related": {
97104
"entity": [
98-
"AROAIN5ATK5U7KEXAMPLE:JohnRole1",
99105
"arn:aws:sts::111111111111:assumed-role/JohnDoe/JohnRole1",
100106
"Role2WithTags",
101107
"AKIAI44QH8DHBEXAMPLE",
@@ -123,8 +129,16 @@
123129
"ip": "81.2.69.144"
124130
},
125131
"tags": [
126-
"preserve_original_event"
132+
"preserve_original_event",
133+
"actor_target_mapping"
127134
],
135+
"target": {
136+
"entity": {
137+
"id": [
138+
"arn:aws:iam::111111111111:role/JohnRole2"
139+
]
140+
}
141+
},
128142
"user": {
129143
"id": "AROAIN5ATK5U7KEXAMPLE:JohnRole1",
130144
"name": "JohnDoe"
@@ -145,6 +159,13 @@
145159
},
146160
{
147161
"@timestamp": "2019-10-02T22:12:29.000Z",
162+
"actor": {
163+
"entity": {
164+
"id": [
165+
"arn:aws:iam::111111111111:role/JohnRole1"
166+
]
167+
}
168+
},
148169
"aws": {
149170
"cloudtrail": {
150171
"event_type": "AwsApiCall",
@@ -243,7 +264,6 @@
243264
},
244265
"related": {
245266
"entity": [
246-
"AROAIN5ATK5U7KEXAMPLE:JohnRole1",
247267
"arn:aws:sts::111111111111:assumed-role/JohnDoe/JohnRole1",
248268
"Role2WithTags",
249269
"AKIAI44QH8DHBEXAMPLE",
@@ -270,8 +290,16 @@
270290
"ip": "81.2.69.144"
271291
},
272292
"tags": [
273-
"preserve_original_event"
293+
"preserve_original_event",
294+
"actor_target_mapping"
274295
],
296+
"target": {
297+
"entity": {
298+
"id": [
299+
"arn:aws:iam::111111111111:role/JohnRole2"
300+
]
301+
}
302+
},
275303
"user": {
276304
"id": "AROAIN5ATK5U7KEXAMPLE:JohnRole1",
277305
"name": "JohnDoe"
@@ -291,4 +319,4 @@
291319
}
292320
}
293321
]
294-
}
322+
}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-group-policy-json.log‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
{"awsRegion":"us-east-1","eventCategory":"Management","eventID":"6bf9a009-b248-415d-a8a9-63b7fe5621c0","eventName":"AttachGroupPolicy","eventSource":"iam.amazonaws.com","eventTime":"2024-10-08T14:12:17Z","eventType":"AwsApiCall","eventVersion":"1.10","readOnly":false,"recipientAccountId":"000000000","requestID":"01d08e9a-35d9-4790-97a7-b41d30aa86bf","requestParameters":{"groupName":"TestGroupPolicy","policyArn":"arn:aws:iam::aws:policy/ReadOnlyAccess"},"responseElements":null,"sourceIPAddress":"216.160.83.56","tlsDetails":{"cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"iam.amazonaws.com","tlsVersion":"TLSv1.3"},"userAgent":"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_5bca7082-50b2-4c08-b5e2-1ecf49a48a2b cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#iam.attach-group-policy","userIdentity":{"accessKeyId":"ACCESSKEYID","accountId":"000000000","arn":"arn:aws:iam::000000000:user/[email protected]","principalId":"PRINCIPALID","type":"IAMUser","userName":"[email protected]"}}
2+

0 commit comments

Comments
 (0)