{"eventVersion":"1.09","userIdentity":{"type":"IAMUser","principalId":"AIDAIGS6OA73WDHY2VERC","arn":"arn:aws:iam::733177541390:user/johndoe","accountId":"733177541390","accessKeyId":"AKIA2VNGJOMHDUVJGPFA","userName":"johndoe"},"eventTime":"2024-07-28T17:10:10Z","eventSource":"ec2.amazonaws.com","eventName":"DescribeInstances","awsRegion":"us-east-1","sourceIPAddress":"78.199.178.68","userAgent":"aws-sdk-java/1.11.968 Linux/5.10.220-209.869.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.401-b03 java/1.8.0_401 vendor/Azul_Systems,_Inc.","requestParameters":{"instancesSet":{},"filterSet":{"items":[{"name":"subnet-id","valueSet":{"items":[{"value":"subnet-0fd639b9537a9b855"}]}}]}},"responseElements":null,"requestID":"9e285bf3-a6b9-49b7-a8ee-51d4ab676622","eventID":"2da308f5-b899-42ef-b4c7-19d885e923fc","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"ec2.us-east-1.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 78.199.178.68
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: DescribeInstances
senderHost: 733177541390_CloudTrail_us-east-1_3
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
userName: johndoe
vendorCode: ec2.amazonaws.com