Cloudtrail

api-activity

Vendor: AWS

Type: Api Activity

Subtype: api-activity

OCSF Version: 1.6.0

Created by: buer shen

Templates provide pre-built configurations for transforming common log formats into OCSF. They save you time by handling the complex mapping logic for popular security tools and services. Learn more about using templates →

Mapping Configuration

The mapping configuration transforms parsed log fields into OCSF format. This step is required to convert your specific log structure into OCSF's standardized schema. To define these field mappings, the configuration below uses the Fleak Eval Expression Language (FEEL). This language lets you specify how to transform data from AWS Api Activity logs into OCSF fields - converting timestamps to standard formats, restructuring nested data, and applying conditional logic to determine field values.

dict(
  api=dict(
    request=dict(
      uid=$.requestID
    ),
    service=dict(
      name=$.eventSource
    ),
    response=dict(
      data=$.responseElements
    ),
    operation=$.eventName
  ),
  time=ts_str_to_epoch($.eventTime, "yyyy-MM-dd'T'HH:mm:ss'Z'"),
  actor=dict(
    user=dict(
      uid=$.userIdentity.principalId,
      name=$.userIdentity.userName,
      type=$.userIdentity.type,
      account=dict(
        uid=$.userIdentity.accountId,
        name=$.userIdentity.userName,
        type='AWS Account',
        type_id=10
      )
    )
  ),
  status=case(
    $.errorCode != null => 'Failure',
    $.responseElements != null => 'Success',
    _ => 'Success'
  ),
  message=case(
    $.responseElements != null => to_str($.responseElements),
    $.eventName != null => $.eventName,
    _ => 'No description available'
  ),
  metadata=dict(
    uid=$.eventID,
    product=dict(
      name='AWS CloudTrail',
      vendor_name='Amazon Web Services'
    ),
    version="1.6.0",
    event_code=$.eventName,
    log_version=$.eventVersion,
    logged_time=ts_str_to_epoch($.eventTime, "yyyy-MM-dd'T'HH:mm:ss'Z'"),
    original_time=$.eventTime
  ),
  type_uid=6003 * 100 + 2,
  unmapped=dict(
    eventType=$.eventType,
    requestParameters=$.requestParameters
  ),
  class_uid=6003,
  resources=array(
    dict(
      uid=$.recipientAccountId,
      type="AWS Account"
    )
  ),
  status_id=case(
    $.errorCode != null => 2,
    $.responseElements != null => 1,
    _ => 1
  ),
  type_name=case(
    6003 * 100 + 2 == 600300 => 'API Activity: Unknown',
    6003 * 100 + 2 == 600301 => 'API Activity: Create',
    6003 * 100 + 2 == 600302 => 'API Activity: Read',
    6003 * 100 + 2 == 600303 => 'API Activity: Update',
    6003 * 100 + 2 == 600304 => 'API Activity: Delete',
    6003 * 100 + 2 == 600399 => 'API Activity: Other',
    _ => 'API Activity: Unknown'
  ),
  class_name='API Activity',
  activity_id=2,
  severity_id=1,
  category_uid=6,
  http_request=dict(
    user_agent=$.userAgent
  ),
  src_endpoint=dict(
    ip=$.sourceIPAddress
  ),
  activity_name='Read',
  category_name='Application Activity',
  status_detail=case(
    $.errorCode != null => $.errorCode,
    $.errorMessage != null => $.errorMessage,
    $.responseElements != null and size_of($.responseElements) > 0 => to_str($.responseElements),
    _ => null
  )
)

Template ID: 10e4d83c-fd0d-43fa-93a3-7f5f7192ed57

Text Mapping: No

Ready to use this template?