aws.cloudtrail: improve CloudTrail user identity processing #15601
Conversation
chemamartinez
added
enhancement
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
chemamartinez
force-pushed
the
25241-aws_cloudtrail-normalize-user-fields
branch
from
6b2aa19 to
6f4b104
Compare
💚 Build Succeeded
History
|
|
|
||
| - append: | ||
| field: related.user | ||
| value: '{{{user.changes.name}}}' |
There was a problem hiding this comment.
nit : Given we extract this from sessionContext arn with following description,
arn
The Amazon Resource Name (ARN) of the principal that made the call. The last section of the arn contains the user or role that made the call.
Wouldn't a name like user.arn.principal better match this?
There was a problem hiding this comment.
Anyway not a blocker to get this merged
There was a problem hiding this comment.
We are trying to stick to current ECS available fields, unfortunately user.arn doesn't exist in ECS.
| "JohnDoe" | ||
| "AROAIN5ATK5U7KEXAMPLE", | ||
| "JohnDoe", | ||
| "JohnRole1" |
There was a problem hiding this comment.
It seems odd to me to map a role as a user.
There was a problem hiding this comment.
This come from this conversation with the trade team, where they need to treat the IAM user name and the role name as the user.name for the AWS SIEM rules.
| "private-ec2-instance-role" | ||
| "PRINCIPALID", | ||
| "private-ec2-instance-role", | ||
| "i-03cd6b2a7eb4bf3ae" |
There was a problem hiding this comment.
This seems more odd, since this is a session now.
There was a problem hiding this comment.
From this same conversation, the goal is to consider the session name as temporary user name, that's why it is being mapped as user.changes.name and therefore included into related.users.
4 participants
Proposed commit message
For CloudTrail events, it has been updated how IAM users are handled.
In particular, for the user identity
IAMUsertype, theuser.nameanduser.idarepopulated with the user fields that made the action/request.
For the user identity
AssumedRoletype, AWS SIEM rules need roles to be treated as IAMUsers in order to work fine. So the role identifies insidesessionIssuerpopulateuser.*fields. Then, the session name is being mapped asuser.changes.nameas it can be interpreted as the name the user is taking for that particular session, and it's the closest approach in ECS.References:
Checklist
changelog.ymlfile.Related issues