Skip to content

Commit db74cb2

Browse files
kcreddykcreddy
authored
aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication events. (#15436)
aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication events
1 parent f28e5ec commit db74cb2

File tree

5 files changed

+102
-1
lines changed

5 files changed

+102
-1
lines changed

‎packages/aws/changelog.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,9 @@
11
# newer versions go on top
2+
- version: "4.2.0"
3+
changes:
4+
- description: Add `user.name` to Cloudtrail's `UserAuthentication` events.
5+
type: enhancement
6+
link: https://github.com/elastic/integrations/pull/15436
27
- version: "4.1.0"
38
changes:
49
- description: Add `vulnerability_workflow` and `misconfiguration_workflow` sub category labels.

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"eventVersion":"1.09","userIdentity":{"type":"IdentityCenterUser","arn":"","accountId":"redacted","accessKeyId":"","onBehalfOf":{"userId":"redacted","identityStoreArn":"arn:aws:identitystore::redacted:identitystore/redacted"},"credentialId":"redacted"},"eventTime":"2025-09-22T12:29:21Z","eventSource":"signin.amazonaws.com","eventName":"UserAuthentication","awsRegion":"us-east-2","sourceIPAddress":"redacted","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","requestParameters":null,"responseElements":null,"additionalEventData":{"AuthWorkflowID":"redacted","UserName":"redacted@example.com","LoginTo":"https://redacted.awsapps.com/start/","CredentialType":"EXTERNAL_IDP"},"requestID":"redacted","eventID":"redacted","readOnly":false,"eventType":"AwsServiceEvent","recipientAccountId":"redacted","serviceEventDetails":{"UserAuthentication":"Success"},"eventCategory":"Management"}

‎packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log-expected.json‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
{
2+
"expected": [
3+
{
4+
"@timestamp": "2025-09-22T12:29:21.000Z",
5+
"actor": {
6+
"entity": {
7+
"id": [
8+
"redacted"
9+
]
10+
}
11+
},
12+
"aws": {
13+
"cloudtrail": {
14+
"additional_eventdata": "{AuthWorkflowID=redacted, LoginTo=https://redacted.awsapps.com/start/, CredentialType=EXTERNAL_IDP}",
15+
"event_category": "Management",
16+
"event_type": "AwsServiceEvent",
17+
"event_version": "1.09",
18+
"flattened": {
19+
"additional_eventdata": {
20+
"AuthWorkflowID": "redacted",
21+
"CredentialType": "EXTERNAL_IDP",
22+
"LoginTo": "https://redacted.awsapps.com/start/"
23+
},
24+
"service_event_details": {
25+
"UserAuthentication": "Success"
26+
}
27+
},
28+
"read_only": false,
29+
"recipient_account_id": "redacted",
30+
"request_id": "redacted",
31+
"service_event_details": "{UserAuthentication=Success}",
32+
"user_identity": {
33+
"type": "IdentityCenterUser"
34+
}
35+
}
36+
},
37+
"cloud": {
38+
"account": {
39+
"id": "redacted"
40+
},
41+
"region": "us-east-2"
42+
},
43+
"ecs": {
44+
"version": "8.11.0"
45+
},
46+
"event": {
47+
"action": "UserAuthentication",
48+
"created": "2021-11-11T01:02:03.123456789Z",
49+
"id": "redacted",
50+
"kind": "event",
51+
"original": "{\"eventVersion\":\"1.09\",\"userIdentity\":{\"type\":\"IdentityCenterUser\",\"arn\":\"\",\"accountId\":\"redacted\",\"accessKeyId\":\"\",\"onBehalfOf\":{\"userId\":\"redacted\",\"identityStoreArn\":\"arn:aws:identitystore::redacted:identitystore/redacted\"},\"credentialId\":\"redacted\"},\"eventTime\":\"2025-09-22T12:29:21Z\",\"eventSource\":\"signin.amazonaws.com\",\"eventName\":\"UserAuthentication\",\"awsRegion\":\"us-east-2\",\"sourceIPAddress\":\"redacted\",\"userAgent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\",\"requestParameters\":null,\"responseElements\":null,\"additionalEventData\":{\"AuthWorkflowID\":\"redacted\",\"UserName\":\"redacted@example.com\",\"LoginTo\":\"https://redacted.awsapps.com/start/\",\"CredentialType\":\"EXTERNAL_IDP\"},\"requestID\":\"redacted\",\"eventID\":\"redacted\",\"readOnly\":false,\"eventType\":\"AwsServiceEvent\",\"recipientAccountId\":\"redacted\",\"serviceEventDetails\":{\"UserAuthentication\":\"Success\"},\"eventCategory\":\"Management\"}",
52+
"outcome": "success",
53+
"provider": "signin.amazonaws.com",
54+
"type": [
55+
"info"
56+
]
57+
},
58+
"related": {
59+
"entity": [],
60+
"user": [
61+
"redacted@example.com"
62+
]
63+
},
64+
"source": {
65+
"address": "redacted"
66+
},
67+
"tags": [
68+
"preserve_original_event",
69+
"actor_target_mapping"
70+
],
71+
"user": {
72+
"email": "redacted@example.com",
73+
"name": "redacted@example.com"
74+
},
75+
"user_agent": {
76+
"device": {
77+
"name": "Mac"
78+
},
79+
"name": "Chrome",
80+
"original": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36",
81+
"os": {
82+
"full": "Mac OS X 10.15.7",
83+
"name": "Mac OS X",
84+
"version": "10.15.7"
85+
},
86+
"version": "140.0.0.0"
87+
}
88+
}
89+
]
90+
}

‎packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -845,6 +845,11 @@ processors:
845845
field: json.eventCategory
846846
target_field: aws.cloudtrail.event_category
847847
ignore_failure: true
848+
- rename:
849+
field: json.additionalEventData.UserName
850+
tag: rename_additionalEventData_UserName_to_username
851+
target_field: user.name
852+
if: ctx.event?.action == 'UserAuthentication' && ctx.user?.name == null && ctx.json?.additionalEventData?.UserName != null
848853
- set:
849854
field: cloud.region
850855
copy_from: json.awsRegion

‎packages/aws/manifest.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
format_version: 3.3.2
22
name: aws
33
title: AWS
4-
version: 4.1.0
4+
version: 4.2.0
55
description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent.
66
type: integration
77
categories:

0 commit comments

Comments
 (0)