Cloudtrail

api-activity

Auto-generated mapping for AWS CloudTrail API Activity

Vendor: AWS

Type: Api Activity

OCSF Version: 1.0.0

Created by: Rajas Panat, Adam Plotzker

Templates provide pre-built configurations for transforming common log formats into OCSF. They save you time by handling the complex mapping logic for popular security tools and services. Learn more about using templates →

Mapping Configuration

The mapping configuration transforms parsed log fields into OCSF format. This step is required to convert your specific log structure into OCSF's standardized schema. To define these field mappings, the configuration below uses the Fleak Eval Expression Language (FEEL). This language lets you specify how to transform data from AWS Api Activity logs into OCSF fields - converting timestamps to standard formats, restructuring nested data, and applying conditional logic to determine field values.

dict(
  api=dict(
    request=dict(
      uid=$.requestID
    ),
    service=dict(
      name=$.eventSource
    ),
    version=$.apiVersion,
    operation=$.eventName
  ),
  actor=dict(
    user=dict(
      uid=$.userIdentity.principalId,
      name=$.userIdentity.userName,
      type=$.userIdentity.type,
      uuid=$.userIdentity.arn,
      account_uid=$.userIdentity.accountId,
      credential_uid=$.userIdentity.accessKeyId
    )
  ),
  metadata=dict(
    uid=$.eventID,
    product=dict(
      name="CloudTrail",
      vendor_name="AWS"
    ),
    version="1.0.0"
  ),
  type_uid=600302,
  class_uid=6003,
  status_id=case(
    $.errorCode == null => 1,
    _ => 2
  ),
  activity_id=case(
    str_contains($.eventName, "Describe") => 2,
    _ => 99
  ),
  category_uid=6
)

Template ID: aa001a66-3422-41a7-93cc-c8a3761cb477

Text Mapping: No

Ready to use this template?