Cloudtrail

cloudtrail-authentication

Vendor: AWS

Type: Cloudtrail Authentication

Subtype: cloudtrail-authentication

OCSF Version: 1.6.0

Created by: buer shen

Templates provide pre-built configurations for transforming common log formats into OCSF. They save you time by handling the complex mapping logic for popular security tools and services. Learn more about using templates →

Mapping Configuration

The mapping configuration transforms parsed log fields into OCSF format. This step is required to convert your specific log structure into OCSF's standardized schema. To define these field mappings, the configuration below uses the Fleak Eval Expression Language (FEEL). This language lets you specify how to transform data from AWS Cloudtrail Authentication logs into OCSF fields - converting timestamps to standard formats, restructuring nested data, and applying conditional logic to determine field values.

dict(
  time=ts_str_to_epoch($.eventTime, "yyyy-MM-dd'T'HH:mm:ss'Z'"),
  user=dict(
    uid=$.userIdentity.arn,
    name=$.userIdentity.userName,
    type='User',
    account=dict(
      uid=$.recipientAccountId,
      name=$.recipientAccountId,
      type='AWS Account',
      type_id=10
    ),
    type_id=1,
    uid_alt=$.userIdentity.principalId
  ),
  actor=dict(
    user=dict(
      uid=$.userIdentity.arn,
      name=$.userIdentity.userName,
      type='User',
      account=dict(
        uid=$.userIdentity.accountId,
        type='AWS Account',
        type_id=10
      ),
      type_id=1,
      uid_alt=$.userIdentity.principalId
    ),
    session=dict(
      uid=$.additionalEventData.MFAIdentifier,
      is_mfa=case(
        $.additionalEventData.MFAUsed == "Yes" => true,
        $.additionalEventData.MFAUsed == "No" => false,
        _ => null
      )
    )
  ),
  is_mfa=case(
    $.additionalEventData.MFAUsed == "Yes" => true,
    $.additionalEventData.MFAUsed == "No" => false,
    _ => null
  ),
  status=case(
    $.responseElements.ConsoleLogin == 'Success' => 'Success',
    $.responseElements.ConsoleLogin == 'Failure' => 'Failure',
    _ => 'Other'
  ),
  message=case(
    $.responseElements.ConsoleLogin == "Success" => "AWS Console login successful",
    $.responseElements.ConsoleLogin == "Failure" => "AWS Console login failed",
    _ => "AWS Console " + $.eventName + " event"
  ),
  service=dict(
    name=$.eventSource
  ),
  session=dict(
    uid=$.additionalEventData.MFAIdentifier,
    is_mfa=case(
      $.additionalEventData.MFAUsed == "Yes" => true,
      $.additionalEventData.MFAUsed == "No" => false,
      _ => null
    )
  ),
  metadata=dict(
    uid=$.eventID,
    product=dict(
      name="AWS Console",
      vendor_name="Amazon Web Services"
    ),
    version="1.6.0",
    log_name="CloudTrail",
    log_version=$.eventVersion,
    logged_time=ts_str_to_epoch($.eventTime, "yyyy-MM-dd'T'HH:mm:ss'Z'"),
    log_provider=$.eventSource,
    original_time=$.eventTime
  ),
  raw_data=to_str($),
  severity="Informational",
  type_uid=case(
    $.eventName == "ConsoleLogin" => 300201,
    _ => 300299
  ),
  unmapped=dict(
    awsRegion=$.awsRegion,
    eventType=$.eventType,
    eventCategory=$.eventCategory,
    requestParameters=$.requestParameters
  ),
  class_uid=3002,
  is_remote=true,
  status_id=case(
    $.responseElements.ConsoleLogin == "Success" => 1,
    $.responseElements.ConsoleLogin == "Failure" => 2,
    _ => 99
  ),
  type_name=case(
    $.eventName == "ConsoleLogin" => 'Authentication: Logon',
    _ => 'Authentication: Other'
  ),
  class_name='Authentication',
  logon_type=case(
    $.eventName == 'ConsoleLogin' => 'Interactive',
    _ => 'Unknown'
  ),
  activity_id=case(
    $.eventName == "ConsoleLogin" => 1,
    _ => 99
  ),
  severity_id=1,
  status_code=case(
    $.responseElements.ConsoleLogin == "Success" => "0x0",
    $.responseElements.ConsoleLogin == "Failure" => "0x1",
    _ => null
  ),
  category_uid=3,
  http_request=dict(
    user_agent=$.userAgent
  ),
  src_endpoint=dict(
    ip=$.sourceIPAddress
  ),
  activity_name=case(
    $.eventName == "ConsoleLogin" => 'Logon',
    _ => 'Other'
  ),
  category_name='Identity & Access Management',
  logon_type_id=case(
    $.eventName == "ConsoleLogin" => 2,
    _ => 0
  ),
  status_detail=case(
    $.responseElements.ConsoleLogin == "Success" => "LOGON_SUCCESS",
    $.responseElements.ConsoleLogin == "Failure" => "LOGON_FAILURE",
    _ => null
  ),
  timezone_offset=0
)

Template ID: 3ce5663f-78e8-4021-87a2-91e36130c3b1

Text Mapping: No

Ready to use this template?