aws.cloudtrail: improve CloudTrail user identity processing #15601
+147
−63
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
chemamartinez
added
enhancement
|
Pinging @elastic/security-service-integrations (Team:Security-Service Integrations) |
🚀 Benchmarks reportTo see the full report comment with |
chemamartinez
force-pushed
the
25241-aws_cloudtrail-normalize-user-fields
branch
from
6b2aa19 to
6f4b104
Compare
💚 Build Succeeded
History
|
Kavindu-Dodan
approved these changes
Oct 21, 2025
|
|
||
| - append: | ||
| field: related.user | ||
| value: '{{{user.changes.name}}}' |
There was a problem hiding this comment.
nit : Given we extract this from sessionContext arn with following description,
arn
The Amazon Resource Name (ARN) of the principal that made the call. The last section of the arn contains the user or role that made the call.
Wouldn't a name like user.arn.principal better match this?
There was a problem hiding this comment.
Anyway not a blocker to get this merged
efd6
reviewed
Oct 21, 2025
| "JohnDoe" | ||
| "AROAIN5ATK5U7KEXAMPLE", | ||
| "JohnDoe", | ||
| "JohnRole1" |
There was a problem hiding this comment.
It seems odd to me to map a role as a user.
| "private-ec2-instance-role" | ||
| "PRINCIPALID", | ||
| "private-ec2-instance-role", | ||
| "i-03cd6b2a7eb4bf3ae" |
There was a problem hiding this comment.
This seems more odd, since this is a session now.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed commit message
For CloudTrail events, it has been updated how IAM users are handled.
In particular, for the user identity
IAMUsertype, theuser.nameanduser.idarepopulated with the user fields that made the action/request.
For the user identity
AssumedRoletype, AWS SIEM rules need roles to be treated as IAMUsers in order to work fine. So the role identifies insidesessionIssuerpopulateuser.*fields. Then, the session name is being mapped asuser.changes.nameas it can be interpreted as the name the user is taking for that particular session, and it's the closest approach in ECS.References:
Checklist
changelog.ymlfile.Related issues