{"eventVersion":"1.09","userIdentity":{"type":"IAMUser","principalId":"AIDA2VNGJOMHBFM3A2Z57","arn":"arn:aws:iam::733177541390:user/fish","accountId":"733177541390","accessKeyId":"AKIA2VNGJOMHGCISQSCD","userName":"fish"},"eventTime":"2024-07-27T12:00:52Z","eventSource":"logs.amazonaws.com","eventName":"DescribeLogStreams","awsRegion":"us-east-1","sourceIPAddress":"45.249.184.193","userAgent":"aws-sdk-java/1.12.452 Linux/6.5.0-1023-aws OpenJDK_64-Bit_Server_VM/11.0.23+9-post-Ubuntu-1ubuntu120.04.2 java/11.0.23 scala/2.13.10 vendor/Ubuntu cfg/retry-mode/legacy","requestParameters":{"logGroupName":"/aws/lambda/VPCFlowLogsToFirehose","orderBy":"LastEventTime","descending":true,"limit":50},"responseElements":null,"requestID":"ed0f832d-6c2b-4991-8ca7-529abeb167e5","eventID":"9c8723b0-9a22-490b-b27b-c45107b75514","readOnly":true,"resources":[{"accountId":"733177541390","type":"AWS::Logs::LogGroup","ARN":"arn:aws:logs:us-east-1:733177541390:log-group:/aws/lambda/VPCFlowLogsToFirehose:log-stream:"}],"eventType":"AwsApiCall","apiVersion":"20140328","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.3","cipherSuite":"TLS_AES_128_GCM_SHA256","clientProvidedHostHeader":"logs.us-east-1.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 45.249.184.193
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: DescribeLogStreams
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
userName: fish
vendorCode: logs.amazonaws.com