aws cloudtrail

Expression

product = "aws cloudtrail"

Fields

Field	Core	Detection	Informational
aws_email_address			✓
service_name		✓
aws_account		✓
vpc			✓
mfa		✓
fallback_user_name
domain_user_name
user_arn			✓
src_host			✓
aws_user			✓
event_category		✓
principal_id			✓
src_ip		✓
user_type		✓
readonly		✓
domain			✓
region		✓
operation		✓
user		✓
user_agent		✓
policy			✓

Activity Types

Activity Type	Field	Status	Core	Detection	Informational
app-login	result	Default			✓
	mobile_version	Default			✓
	mfa	Default			✓
	url	Default			✓
bucket-accessblock-modify	block_public_policy	Default			✓
	block_public_acls	Default			✓
	bucket_arn	Default			✓
	ignore_public_acls	Default			✓
	bucket_host	Default			✓
	restrict_public_buckets	Default			✓
bucket-create	bucket_host	Default			✓
bucket-list
bucket-permission-modify	acl_content	Default			✓
	allowed_ids	Default			✓
	allowed_user_types	Default			✓
	bucket_arn	Default			✓
	allowed_uris	Default			✓
	owner_id	Default			✓
	bucket_host	Default			✓
	allowed_permissions	Default			✓
bucket-permission-read	acl_content	Default			✓
	bucket_arn	Default			✓
	owner_id	Default			✓
	bucket_host	Default			✓
bucket-policy-modify	allowed_users	Default			✓
	bucket_arn	Default			✓
	bucket_host	Default			✓
	denied_permissions	Default			✓
	denied_users	Default			✓
	allowed_permissions	Default			✓
	allowed_resources	Default			✓
	denied_resources	Default			✓
bucket-policy-read	bucket_arn	Default			✓
	bucket_host	Default			✓
bucket-property-read	bucket_arn	Default			✓
	bucket_host	Default			✓
disk-attach	instance_id	Default			✓
	volume_device	Default			✓
	resource_id	Default			✓
disk-create	volume_type	Default			✓
	src_resource	Default			✓
	resource_id	Default			✓
	volume_size	Default			✓
	volume_zone	Default			✓
disk-list
disk-modify	old_size	Default			✓
	old_multiattach	Default			✓
	volume_type	Default			✓
	new_size	Default			✓
	resource_id	Default			✓
	new_multiattach	Default			✓
endpoint-command	document_name	Default			✓
	resource_id	Default			✓
	playbook_files	Default			✓
endpoint-create	key_name	Default			✓
	new_host	Default			✓
	availabilty_zone	Default			✓
	src_resource	Default			✓
	resource_id	Default			✓
	security_group	Default			✓
	instance_type	Default			✓
	new_ip	Default			✓
	instance_profile_arn	Default			✓
endpoint-key-create	key_name	Default			✓
	key_type	Default			✓
	resource_id	Default			✓
endpoint-list
endpoint-login	resource_id	Default			✓
	dest_user	Default		✓
endpoint-modify	userdata			✓
	modified_keys			✓
	added_keys			✓
	resource_id				✓
endpoint-screenshot	resource_id	Default			✓
file-copy	bucket_arn	Default			✓
	bytes_out	Default			✓
	src_bucket_arn	Default			✓
	bytes_in	Default			✓
	bucket_name	Default			✓
	file_arn	Default			✓
	bucket_host	Default			✓
	src_file_arn	Default			✓
file-list
file-permission-modify	acl_content			✓
	allowed_ids
	allowed_user_types
	bucket_arn
	bytes_out
	allowed_uris
	owner_id
	bucket_name			✓
	file_arn
	bucket_host
	allowed_permissions
file-read	bucket_arn				✓
	bytes_out				✓
	bucket_name			✓
	file_arn				✓
	bucket_host				✓
file-write	bucket_arn				✓
	bytes_in				✓
	bucket_name			✓
	file_arn				✓
	bucket_host				✓
function-create	hash_sha256	Default			✓
	code_size	Default			✓
	function_name	Default			✓
	function_arn	Default			✓
	function_runtime	Default			✓
	function_role	Default			✓
function-modify	hash_sha256	Default			✓
	code_size	Default			✓
	function_name	Default			✓
	function_arn	Default			✓
	function_runtime	Default			✓
	function_role	Default			✓
group-create	group_id				✓
	group_arn				✓
group-list
group-member-add
image-create	src_resource	Default			✓
	image_publisher			✓
	description	Default			✓
	resource_id	Default			✓
image-list
image-modify	removed_users	Default			✓
	added_users	Default			✓
	resource	Default			✓
	resource_id	Default			✓
policy-attach	policy_arn	Default			✓
	dest_role	Default			✓
	dest_group	Default			✓
	dest_user	Default		✓
policy-create	policy_arn	Default			✓
	policy_content	Default			✓
	dest_role	Default			✓
	policy_id	Default			✓
	dest_group	Default			✓
	set_as_defualt	Default			✓
	dest_user	Default		✓
	denied_permissions	Default			✓
	allowed_permissions	Default			✓
	allowed_resources	Default			✓
	policy_version_id	Default			✓
	denied_resources	Default			✓
policy-list	dest_role	Default			✓
	dest_group	Default			✓
	dest_user	Default		✓
role-assume	session_name	Default			✓
	transistive_tags	Default			✓
	role_arn	Default			✓
	session_arn	Default			✓
	src_role	Default			✓
	session_expiration	Default			✓
	url	Default			✓
	session_tag	Default			✓
role-create	policy_content	Default			✓
	allowed_users	Default			✓
	role_arn	Default			✓
	denied_users	Default			✓
role-list
role-policy-modify	policy_content	Default			✓
	dest_role	Default			✓
	allowed_users	Default			✓
	denied_users	Default			✓
snapshot-create	src_resource	Default			✓
	owner_id	Default			✓
	description	Default			✓
	resource_id	Default			✓
snapshot-list
snapshot-modify	removed_users	Default			✓
	added_users	Default			✓
	resource_id	Default			✓
user-create	dest_user_arn				✓
	dest_user_id		✓
user-key-create	key_id	Default			✓
	dest_user_id	Default			✓
	key_status	Default			✓
user-list
user-modify
user-password-read	resource_id				✓