{"eventVersion":"1.08","userIdentity":{"type":"AssumedRole","principalId":"AROA2VNGJOMHDCGY42K33:AssumeRoleSession","arn":"arn:aws:sts::733177541390:assumed-role/Onica-CloudHealth/AssumeRoleSession","accountId":"733177541390","accessKeyId":"ASIA2VNGJOMHNCTI4PHX","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"AROA2VNGJOMHDCGY42K33","arn":"arn:aws:iam::733177541390:role/Onica-CloudHealth","accountId":"733177541390","userName":"Onica-CloudHealth"},"webIdFederationData":{},"attributes":{"creationDate":"2024-07-29T19:16:50Z","mfaAuthenticated":"false"}}},"eventTime":"2024-07-29T19:46:23Z","eventSource":"cloudformation.amazonaws.com","eventName":"ListStacks","awsRegion":"us-east-2","sourceIPAddress":"60.110.13.13","userAgent":"aws-sdk-ruby3/3.185.2 ua/2.0 api/cloudformation#1.47.0 os/linux#1.8 md/x86_64 lang/jruby#9.2.5.0 md/2.5.0 cfg/retry-mode#legacy cloudhealth","requestParameters":{"stackStatusFilter":["CREATE_IN_PROGRESS","CREATE_FAILED","CREATE_COMPLETE","ROLLBACK_IN_PROGRESS","ROLLBACK_FAILED","ROLLBACK_COMPLETE","DELETE_IN_PROGRESS","UPDATE_IN_PROGRESS","UPDATE_COMPLETE_CLEANUP_IN_PROGRESS","UPDATE_COMPLETE","UPDATE_ROLLBACK_IN_PROGRESS","UPDATE_ROLLBACK_FAILED","UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS","UPDATE_ROLLBACK_COMPLETE","REVIEW_IN_PROGRESS"]},"responseElements":null,"requestID":"eddef933-7e38-4bbb-becf-00fa7daf50a9","eventID":"1384c590-57ea-4e61-88d9-8ad91c949da4","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-SHA","clientProvidedHostHeader":"cloudformation.us-east-2.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 60.110.13.13
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: ListStacks
senderHost: 733177541390_CloudTrail_us-east-1_4
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: cloudformation.amazonaws.com