{"eventVersion":"1.08","userIdentity":{"type":"AssumedRole","principalId":"AROA2VNGJOMHDCGY42K33:AssumeRoleSession","arn":"arn:aws:sts::733177541390:assumed-role/Onica-CloudHealth/AssumeRoleSession","accountId":"733177541390","accessKeyId":"ASIA2VNGJOMHAOOO6MUD","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"AROA2VNGJOMHDCGY42K33","arn":"arn:aws:iam::733177541390:role/Onica-CloudHealth","accountId":"733177541390","userName":"Onica-CloudHealth"},"webIdFederationData":{},"attributes":{"creationDate":"2024-07-27T11:46:32Z","mfaAuthenticated":"false"}}},"eventTime":"2024-07-27T12:01:21Z","eventSource":"cloudformation.amazonaws.com","eventName":"ListStacks","awsRegion":"ap-northeast-3","sourceIPAddress":"114.162.141.171","userAgent":"aws-sdk-ruby3/3.185.2 ua/2.0 api/cloudformation#1.47.0 os/linux#1.8 md/x86_64 lang/jruby#9.2.5.0 md/2.5.0 cfg/retry-mode#legacy cloudhealth","requestParameters":{"stackStatusFilter":["DELETE_FAILED","DELETE_COMPLETE"]},"responseElements":null,"requestID":"906a4ce8-e8c8-4b89-87c1-577a059a98c2","eventID":"346c57ba-00f9-4eed-ab1f-9bea265ca9ad","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-SHA","clientProvidedHostHeader":"cloudformation.ap-northeast-3.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 114.162.141.171
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: ListStacks
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['ap-northeast-3', 'aws_cloud_trail', 'audit_log']
vendorCode: cloudformation.amazonaws.com