{"eventVersion":"1.08","userIdentity":{"type":"AssumedRole","principalId":"AROA2VNGJOMHPAMFZZTFP:i-08a5a36b9f59afb1c","arn":"arn:aws:sts::733177541390:assumed-role/wayne-nviwayneoprd-instance-iamrole/i-08a5a36b9f59afb1c","accountId":"733177541390","accessKeyId":"ASIA2VNGJOMHIIRK3U2M","sessionContext":{"sessionIssuer":{"type":"Role","principalId":"AROA2VNGJOMHPAMFZZTFP","arn":"arn:aws:iam::733177541390:role/wayne-nviwayneoprd-instance-iamrole","accountId":"733177541390","userName":"wayne-nviwayneoprd-instance-iamrole"},"webIdFederationData":{},"attributes":{"creationDate":"2024-08-01T04:04:37Z","mfaAuthenticated":"false"},"ec2RoleDelivery":"2.0"}},"eventTime":"2024-08-01T05:03:35Z","eventSource":"ssm.amazonaws.com","eventName":"PutInventory","awsRegion":"us-east-1","sourceIPAddress":"167.52.10.134","userAgent":"aws-sdk-go/1.51.20 (go1.21.11; windows; amd64) exec-env/EC2 amazon-ssm-agent/","requestParameters":{"instanceId":"i-08a5a36b9f59afb1c","items":[{"typeName":"AWS:WindowsRole","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"w2J6C16Oof+2YkSHXs6U+g=="},{"typeName":"AWS:Service","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"IVFEmcSEyz1+SkqYYxqtvw=="},{"typeName":"AWS:Network","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"9pgxC32LfuEMcFQhAtxt3Q=="},{"typeName":"AWS:BillingInfo","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"daS4a++VrDaYiYzxN40MRg=="},{"typeName":"AWS:WindowsUpdate","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"He1Dq72A3yJuZA4JpniHhQ=="},{"typeName":"AWS:InstanceDetailedInformation","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"6WRgR2RkZLHDGI74odFazw=="},{"typeName":"AWS:Application","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"2kPo8RmKdFlVJK5xAggaEQ=="},{"typeName":"AWS:AWSComponent","schemaVersion":"1.0","captureTime":"2024-08-01T05:03:29Z","contentHash":"RU3U+MPvb2ujYSb0sBZcVw=="}]},"responseElements":null,"requestID":"3746b5d7-a90f-46a8-852b-cfdfc9c9e6fe","eventID":"6953fad2-bb1f-4ade-b3cf-4f4f6fa6f7ee","readOnly":false,"resources":[{"accountId":"733177541390","ARN":"arn:aws:ec2:us-east-1:733177541390:instance/i-08a5a36b9f59afb1c"},{"accountId":"733177541390","ARN":"arn:aws:ssm:us-east-1:733177541390:managed-instance-inventory/i-08a5a36b9f59afb1c"}],"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"733177541390","eventCategory":"Management","tlsDetails":{"tlsVersion":"TLSv1.2","cipherSuite":"ECDHE-RSA-AES128-GCM-SHA256","clientProvidedHostHeader":"ssm.us-east-1.amazonaws.com"}}
This is a syslog message from a product called aws_cloud_trail by aws_cloud_trail. The following fields were extracted from the message:
clientIP: 167.52.10.134
fieldExtractorName: aws_cloud_trail
messageType: audit_log
ruleCategory: AwsApiCall
ruleName: PutInventory
senderHost: 733177541390_CloudTrail_us-east-1_3
sensitivity: normal
sourceInfo: unknown
streamName: aws_cloud_trail
tags: ['us-east-1', 'aws_cloud_trail', 'audit_log']
vendorCode: ssm.amazonaws.com