Data Mapping: Cloud Activity Data

Field

General Field

Example

Notes

eventID

-

b7d4398e-b2f0-4faa-9c76-e2d316a8d67f

 

eventName

-

StopInstances

 

eventSource

-

http://ec2.amazonaws.com

 

filterRiskLevel

-

high

 

productCode

-

sct

 

readOnly

-

"false"

 

resources

-

"arn:aws:iam::542634465565:role/event-forwarding-lambdaConsumerIAMRole-4C7JQGBFWBNS"

 

responseElements

-

"arn:aws:iam::123456789012:user/Bob"

 

sourceIPAddress

-

205.251.233.176

 

tags

-

MITRE.T1134

 

userAgent

-

aws-cli/1.3.2 Python/2.7.5 Windows/7

 

userIdentity

-

"ADFS-ADMIN"

 

uuid

-

3cb19564-0854-4dd0-9d31-753eeef643e9

 

VpcEndpointIp

-

vpce-01234567890123456