{"eventVersion":"1.08","userIdentity":{"type":"AssumedRole","principalId":"AROA2VNGJOMHDCGY42K33:AssumeRoleSession","arn":"arn:aws:sts::733177541390:assumed-role/Onica-CloudHealth/AssumeRoleSession","accountId":"733177541390","accessKeyId":"ASIA2VNGJOMHHVDQEH5Q","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"AROA2VNGJOMHDCGY42K33","arn":"arn:aws:iam::733177541390:role/Onica-CloudHealth","accountId":"733177541390","userName":"Onica-CloudHealth"},"webIdFederationData":{},"attributes":{"creationDate":"2024-07-27T00:59:33Z","mfaAuthenticated":"false"}}},"eventTime":"2024-07-27T01:14:48Z","eventSource":"elasticoscorpe.amazonaws.com","eventName":"DescribeReservedCoscorpeNodes","awsRegion":"ap-south-1","sourceIPAddress":"63.229.139.105","userAgent":"aws-sdk-ruby3/3.185.2 ua/2.0 api/elasticoscorpe#1.79.0 os/linux#1.8 md/x86_64 lang/jruby#9.2.5.0 md/2.5.0 cfg/retry-mode#legacy cloudhealth","requestParameters":{"maxRecords":100},"responseElements":null,"requestID":"56683122-0bed-4b8f-9b3e-0e6eb8366e39","eventID":"b6da747c-3713-458e-8650-e79c072be329","readOnly":true,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-SHA","clientProvidedHostHeader":"elasticoscorpe.ap-south-1.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 63.229.139.105
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: DescribeReservedCacheNodes
senderHost: 733177541390_CloudTrail_us-east-1_2
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['ap-south-1', 'aws_cloud_trail', 'audit_log']
vendorCode: elasticache.amazonaws.com