{"eventVersion":"1.09","userIdentity":{"type":"AssumedRole","principalId":"AROAI4TSRELAFLOMQOMX6:TrustedAdvisor_733177541390_970a8914-e3dd-4c5e-a6b4-87e81209b44c","arn":"arn:aws:sts::733177541390:assumed-role/AWSServiceRoleForTrustedAdvisor/TrustedAdvisor_733177541390_970a8914-e3dd-4c5e-a6b4-87e81209b44c","accountId":"733177541390","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"AROAI4TSRELAFLOMQOMX6","arn":"arn:aws:iam::733177541390:role/aws-service-role/86.1.181.62/AWSServiceRoleForTrustedAdvisor","accountId":"733177541390","userName":"AWSServiceRoleForTrustedAdvisor"},"attributes":{"creationDate":"2024-07-31T23:59:48Z","mfaAuthenticated":"false"}},"invokedBy":"86.1.181.62"},"eventTime":"2024-07-31T23:59:48Z","eventSource":"ec2.amazonaws.com","eventName":"DescribeAddresses","awsRegion":"us-east-2","sourceIPAddress":"86.1.181.62","userAgent":"86.1.181.62","requestParameters":{"publicIpsSet":{},"filterSet":{},"allocationIdsSet":{}},"responseElements":null,"requestID":"64a8352c-4556-4aaf-b3ee-613ea4f0a2cf","eventID":"d402d204-f10b-44a9-ac64-f0248a275ab6","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management"}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 86.1.181.62
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: DescribeAddresses
senderHost: 733177541390_CloudTrail_us-east-1
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-2', 'aws_cloud_trail', 'audit_log']
vendorCode: ec2.amazonaws.com