{"eventVersion":"1.09","userIdentity":{"type":"AWSService","invokedBy":"12.244.168.218"},"eventTime":"2024-08-01T05:04:46Z","eventSource":"kms.amazonaws.com","eventName":"GenerateDataKey","awsRegion":"us-east-1","sourceIPAddress":"12.244.168.218","userAgent":"12.244.168.218","requestParameters":{"encryptionContext":{"aws:cloudtrail:arn":"arn:aws:cloudtrail:us-east-1:733177541390:trail/CloudTrailGlobal","aws:s3:arn":"arn:aws:s3:::aws-controltower-logs-987021955101-us-east-1/o-174unnqi5v/AWSLogs/733177541390/CloudTrail/eu-central-1/2024/08/01/733177541390_CloudTrail_eu-central-1_20240801T0505Z_X2XLqxFJOW8ZSGX7.json.gz"},"keySpec":"AES_256","keyId":"arn:aws:kms:us-east-1:733177541390:key/7413d106-7308-4d72-9dbc-c2ae227e1cd9"},"responseElements":null,"requestID":"ec8f8c4e-e558-471b-b4da-2e728d517e76","eventID":"a93c4127-f358-4159-92a1-5e1c5a68eb01","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::KMS::Key","ARN":"arn:aws:kms:us-east-1:733177541390:key/7413d106-7308-4d72-9dbc-c2ae227e1cd9"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","sharedEventID":"56bff8a3-58fa-4483-b5ca-dcb8fedb3d69","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 12.244.168.218
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: GenerateDataKey
senderHost: 733177541390_CloudTrail_us-east-1_3
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
vendorCode: kms.amazonaws.com