{"eventVersion":"1.09","userIdentity":{"type":"AWSService","invokedBy":"87.112.176.126"},"eventTime":"2024-08-01T05:04:36Z","eventSource":"kms.amazonaws.com","eventName":"Decrypt","awsRegion":"us-east-1","sourceIPAddress":"87.112.176.126","userAgent":"87.112.176.126","requestParameters":{"encryptionAlgorithm":"SYMMETRIC_DEFAULT","encryptionContext":{"aws:acm:arn":"arn:aws:acm:us-east-1:733177541390:certificate/79c35c06-8c1c-4a1a-951e-253c28242e5f","aws:cloudfront:arn":"arn:aws:cloudfront::733177541390:distribution/E2AU547PZD5UGD"}},"responseElements":null,"requestID":"7e548af0-4596-4717-9e65-c39eb7a2a66d","eventID":"449fb6d9-1091-4a8a-b10e-8b2443d5cee7","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::KMS::Key","ARN":"arn:aws:kms:us-east-1:733177541390:key/e7962760-00a9-4f66-a458-13957dc93a26"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"dea90d63-d8a2-432a-a85a-791c8f00022c","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 87.112.176.126
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: Decrypt
senderHost: 733177541390_CloudTrail_us-east-1_3
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
vendorCode: kms.amazonaws.com