diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index 75529878a9f..e8ea6e65f24 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "4.4.0" + changes: + - description: Normalize user fields for AWS CloudTrail events. + type: enhancement + link: https://github.com/elastic/integrations/pull/15601 - version: "4.3.0" changes: - description: Improve documentation to align with new guidelines. diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json index dfdcd585f60..0411e1adf34 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json @@ -68,7 +68,6 @@ "session_issuer": { "account_id": "111111111111", "arn": "arn:aws:iam::111111111111:role/JohnRole1", - "principal_id": "AROAIN5ATK5U7KEXAMPLE", "type": "Role" } }, @@ -112,8 +111,9 @@ "arn:aws:iam::111111111111:role/JohnRole2" ], "user": [ - "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe" + "AROAIN5ATK5U7KEXAMPLE", + "JohnDoe", + "JohnRole1" ] }, "source": { @@ -144,7 +144,10 @@ } }, "user": { - "id": "AROAIN5ATK5U7KEXAMPLE:JohnRole1", + "changes": { + "name": "JohnRole1" + }, + "id": "AROAIN5ATK5U7KEXAMPLE", "name": "JohnDoe" }, "user_agent": { @@ -234,7 +237,6 @@ "session_issuer": { "account_id": "111111111111", "arn": "arn:aws:iam::111111111111:role/JohnRole1", - "principal_id": "AROAIN5ATK5U7KEXAMPLE", "type": "Role" } }, @@ -277,8 +279,9 @@ "arn:aws:iam::111111111111:role/JohnRole2" ], "user": [ - "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe" + "AROAIN5ATK5U7KEXAMPLE", + "JohnDoe", + "JohnRole1" ] }, "source": { @@ -309,7 +312,10 @@ } }, "user": { - "id": "AROAIN5ATK5U7KEXAMPLE:JohnRole1", + "changes": { + "name": "JohnRole1" + }, + "id": "AROAIN5ATK5U7KEXAMPLE", "name": "JohnDoe" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json index c9113d4b2d6..8850c75c3c6 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json @@ -33,7 +33,6 @@ "session_issuer": { "account_id": "000000000", "arn": "arn:aws:iam::000000000:role/ec2-instance-role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -77,8 +76,9 @@ ], "user": [ "pwncloud-backdoor-user", - "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role" + "PRINCIPALID", + "ec2-instance-role", + "i-06815aa7cf7d21f8f" ] }, "source": { @@ -121,7 +121,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-06815aa7cf7d21f8f", + "changes": { + "name": "i-06815aa7cf7d21f8f" + }, + "id": "PRINCIPALID", "name": "ec2-instance-role", "target": { "name": "pwncloud-backdoor-user" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json index d89061181b7..cbef1667a68 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json @@ -68,7 +68,6 @@ "session_issuer": { "account_id": "000000000", "arn": "arn:aws:iam::000000000:role/ec2-instance-role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -107,8 +106,9 @@ "sg-038ccc3a1f7b05f42" ], "user": [ - "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role" + "PRINCIPALID", + "ec2-instance-role", + "i-06815aa7cf7d21f8f" ] }, "source": { @@ -151,7 +151,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-06815aa7cf7d21f8f", + "changes": { + "name": "i-06815aa7cf7d21f8f" + }, + "id": "PRINCIPALID", "name": "ec2-instance-role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json index 684cfb65618..521ee5281d6 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json @@ -271,7 +271,6 @@ "session_issuer": { "account_id": "123456789012", "arn": "arn:aws:iam::123456789012:role/RoleToBeAssumed", - "principal_id": "AROAIDPPEZS35WEXAMPLE", "type": "Role" } }, @@ -311,8 +310,9 @@ "RoleToBeAssumed" ], "user": [ - "AROAIDPPEZS35WEXAMPLE:AssumedRoleSessionName", - "RoleToBeAssumed" + "AROAIDPPEZS35WEXAMPLE", + "RoleToBeAssumed", + "MySessionName" ] }, "source": { @@ -342,7 +342,10 @@ "actor_target_mapping" ], "user": { - "id": "AROAIDPPEZS35WEXAMPLE:AssumedRoleSessionName", + "changes": { + "name": "MySessionName" + }, + "id": "AROAIDPPEZS35WEXAMPLE", "name": "RoleToBeAssumed" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json index b606bc22697..391a9f74e57 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json @@ -32,7 +32,6 @@ "session_issuer": { "account_id": "00000000000", "arn": "arn:aws:iam::00000000000:role/private-ec2-instance-role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -70,8 +69,9 @@ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae" ], "user": [ - "PRINCIPALID:i-03cd6b2a7eb4bf3ae", - "private-ec2-instance-role" + "PRINCIPALID", + "private-ec2-instance-role", + "i-03cd6b2a7eb4bf3ae" ] }, "source": { @@ -113,7 +113,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-03cd6b2a7eb4bf3ae", + "changes": { + "name": "i-03cd6b2a7eb4bf3ae" + }, + "id": "PRINCIPALID", "name": "private-ec2-instance-role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json index 124e91d0141..434c568faac 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json @@ -35,7 +35,6 @@ "session_issuer": { "account_id": "00000000000", "arn": "arn:aws:iam::00000000000:role/bedrock_ec2_role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -76,8 +75,9 @@ "arn:aws:ssmmessages:us-east-2:00000000000:control-channel/i-05e14c76fdb335957" ], "user": [ - "PRINCIPALID:i-05e14c76fdb335957", - "bedrock_ec2_role" + "PRINCIPALID", + "bedrock_ec2_role", + "i-05e14c76fdb335957" ] }, "source": { @@ -119,7 +119,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-05e14c76fdb335957", + "changes": { + "name": "i-05e14c76fdb335957" + }, + "id": "PRINCIPALID", "name": "bedrock_ec2_role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json index 4c681bead94..6c7d94b647a 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json @@ -174,6 +174,9 @@ "subnet-fee506df", "subnet-bf6ab5b1", "subnet-8bdf6bc6" + ], + "user": [ + "544894e8-80c1-707f-60e3-3ba6510dfac1" ] }, "source": { @@ -207,6 +210,9 @@ "version": "1.3", "version_protocol": "tls" }, + "user": { + "id": "544894e8-80c1-707f-60e3-3ba6510dfac1" + }, "user_agent": { "device": { "name": "Other" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json index f8231e1e62b..20b79cadda6 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json @@ -30,7 +30,6 @@ "session_issuer": { "account_id": "777788889999", "arn": "arn:aws:iam::777788889999:role/AssumeNothing", - "principal_id": "AIDAQRSTUVWXYZEXAMPLE", "type": "Role" } }, @@ -71,8 +70,9 @@ "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk" ], "user": [ - "AIDAQRSTUVWXYZEXAMPLE:devdsk", - "AssumeNothing" + "AIDAQRSTUVWXYZEXAMPLE", + "AssumeNothing", + "devdsk" ] }, "source": { @@ -102,7 +102,10 @@ "actor_target_mapping" ], "user": { - "id": "AIDAQRSTUVWXYZEXAMPLE:devdsk", + "changes": { + "name": "devdsk" + }, + "id": "AIDAQRSTUVWXYZEXAMPLE", "name": "AssumeNothing" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json index db340cb3b2a..57f7a033e1c 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json @@ -50,7 +50,6 @@ "session_issuer": { "account_id": "0000000000", "arn": "arn:aws:iam::0000000000:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -90,8 +89,9 @@ "ACCESSKEY" ], "user": [ - "PRINCIPALID:AWSConfig-Describe", - "AWSServiceRoleForConfig" + "PRINCIPALID", + "AWSServiceRoleForConfig", + "AWSConfig-Describe" ] }, "source": { @@ -109,7 +109,10 @@ } }, "user": { - "id": "PRINCIPALID:AWSConfig-Describe", + "changes": { + "name": "AWSConfig-Describe" + }, + "id": "PRINCIPALID", "name": "AWSServiceRoleForConfig" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json index 1da0fc65891..285b5ad4e30 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json @@ -32,7 +32,6 @@ "session_issuer": { "account_id": "00000000000", "arn": "arn:aws:iam::00000000000:role/Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -73,8 +72,9 @@ "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" ], "user": [ - "PRINCIPALID:i-00486a46a6d8692b9", - "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" + "PRINCIPALID", + "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9", + "i-00486a46a6d8692b9" ] }, "source": { @@ -116,7 +116,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-00486a46a6d8692b9", + "changes": { + "name": "i-00486a46a6d8692b9" + }, + "id": "PRINCIPALID", "name": "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json index 09d8f848286..8082fea06f5 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json @@ -45,7 +45,6 @@ "session_issuer": { "account_id": "000000000000", "arn": "arn:aws:iam::000000000000:role/ec2-instance-role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -86,8 +85,9 @@ "arn:aws:ssmmessages:us-east-1:000000000000:control-channel/i-021987ab2dbf04585" ], "user": [ - "PRINCIPALID:i-021987ab2dbf04585", - "ec2-instance-role" + "PRINCIPALID", + "ec2-instance-role", + "i-021987ab2dbf04585" ] }, "source": { @@ -126,7 +126,10 @@ } }, "user": { - "id": "PRINCIPALID:i-021987ab2dbf04585", + "changes": { + "name": "i-021987ab2dbf04585" + }, + "id": "PRINCIPALID", "name": "ec2-instance-role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json index b448c164268..ca057ab4841 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json @@ -44,7 +44,6 @@ "session_issuer": { "account_id": "00000000000", "arn": "arn:aws:iam::00000000000:role/private-ec2-instance-role", - "principal_id": "PRINCIPALID", "type": "Role" } }, @@ -82,8 +81,9 @@ "arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration" ], "user": [ - "PRINCIPALID:i-0ddf9acf8eeb33959", - "private-ec2-instance-role" + "PRINCIPALID", + "private-ec2-instance-role", + "i-0ddf9acf8eeb33959" ] }, "source": { @@ -125,7 +125,10 @@ "version_protocol": "tls" }, "user": { - "id": "PRINCIPALID:i-0ddf9acf8eeb33959", + "changes": { + "name": "i-0ddf9acf8eeb33959" + }, + "id": "PRINCIPALID", "name": "private-ec2-instance-role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json index 58c06fe008c..4921dfc0d5e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json @@ -78,7 +78,6 @@ "session_issuer": { "account_id": "00000000000", "arn": "arn:aws:iam::00000000000:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM", - "principal_id": "PRINCIPAL", "type": "Role" } }, @@ -116,8 +115,9 @@ "arn:aws:iam::00000000000:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "user": [ - "PRINCIPAL:StateManagerService", - "AWSServiceRoleForAmazonSSM" + "PRINCIPAL", + "AWSServiceRoleForAmazonSSM", + "StateManagerService" ] }, "source": { @@ -135,7 +135,10 @@ } }, "user": { - "id": "PRINCIPAL:StateManagerService", + "changes": { + "name": "StateManagerService" + }, + "id": "PRINCIPAL", "name": "AWSServiceRoleForAmazonSSM" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json index 182a97d80d1..d835b824ba2 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json @@ -250,7 +250,6 @@ "session_issuer": { "account_id": "001122334455", "arn": "arn:aws:iam::001122334455:role/aws-reserved/sso.amazonaws.com/eu-west-1/Some_AWS_Role", - "principal_id": "REDACTED", "type": "Role" } }, @@ -287,8 +286,9 @@ "arn:aws:sts::001122334455:assumed-role/Some_AWS_Role/some.user@example.com" ], "user": [ - "REDACTED:some.user@example.com", - "Some_AWS_Role" + "REDACTED", + "Some_AWS_Role", + "some.user@example.com" ] }, "source": { @@ -307,7 +307,10 @@ "version": "1.3" }, "user": { - "id": "REDACTED:some.user@example.com", + "changes": { + "name": "some.user@example.com" + }, + "id": "REDACTED", "name": "Some_AWS_Role" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json index 247921a3d49..0959e773335 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json @@ -58,6 +58,7 @@ "related": { "entity": [], "user": [ + "redacted", "redacted@example.com" ] }, @@ -70,6 +71,7 @@ ], "user": { "email": "redacted@example.com", + "id": "redacted", "name": "redacted@example.com" }, "user_agent": { diff --git a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml index 8ca248a405b..0777eeef409 100644 --- a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml @@ -776,15 +776,18 @@ processors: - rename: field: json.userIdentity.type target_field: aws.cloudtrail.user_identity.type - ignore_failure: true + ignore_missing: true + tag: rename_user_identity_type - rename: field: json.userIdentity.userName target_field: user.name - ignore_failure: true + ignore_missing: true + tag: rename_user_identity_user_name_iam_user - rename: field: json.userIdentity.principalId target_field: user.id - ignore_failure: true + ignore_missing: true + tag: rename_user_identity_principal_id - rename: field: json.userIdentity.arn target_field: aws.cloudtrail.user_identity.arn @@ -815,11 +818,30 @@ processors: - rename: field: json.userIdentity.sessionContext.sessionIssuer.userName target_field: user.name - ignore_failure: true + ignore_missing: true + override: true + if: ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' + tag: rename_user_name_assumed_role - rename: field: json.userIdentity.sessionContext.sessionIssuer.principalId - target_field: aws.cloudtrail.user_identity.session_context.session_issuer.principal_id - ignore_failure: true + target_field: user.id + ignore_missing: true + override: true + if: ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' + tag: rename_user_id_assumed_role + - grok: + field: aws.cloudtrail.user_identity.arn + patterns: + - "arn:aws:sts:.*/%{GREEDYDATA:user.changes.name}$" + ignore_missing: true + if: ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' && ctx.aws?.cloudtrail?.user_identity?.arn != null + tag: extract_user_name_from_arn + - rename: + field: json.userIdentity.onBehalfOf.userId + target_field: user.id + ignore_missing: true + if: ctx.aws?.cloudtrail?.user_identity?.type == 'IdentityCenterUser' && ctx.user?.id == null + tag: rename_user_id_identity_center_user - rename: field: json.userIdentity.sessionContext.sessionIssuer.arn target_field: aws.cloudtrail.user_identity.session_context.session_issuer.arn @@ -1734,6 +1756,13 @@ processors: allow_duplicates: false ignore_failure: true + - append: + field: related.user + value: '{{{user.changes.name}}}' + if: ctx.user?.changes?.name != null + allow_duplicates: false + ignore_failure: true + # Remove the fields that the user does not want. # In the case that we did not want the flattened fields our work is already # done, since we did not retain them. Otherwise we remove the relevant fields diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index d204519f21c..0ff01b28a1f 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: aws title: AWS -version: "4.3.0" +version: 4.4.0 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration categories: