Data Mapping: Cloud Activity Data

Field

General Field

Example

Notes

eventID

-

b7d4398e-b2f0-4faa-9c76-e2d316a8d67f

  

eventName

-

StopInstances

  

eventSource

-

http://ec2.amazonaws.com

  

filterRiskLevel

-

high

  

productCode

-

sct

  

readOnly

-

"false"

  

resources

-

"arn:aws:iam::542634465565:role/event-forwarding-lambdaConsumerIAMRole-4C7JQGBFWBNS"

  

responseElements

-

"arn:aws:iam::123456789012:user/Bob"

  

sourceIPAddress

-

205.251.233.176

  

tags

-

MITRE.T1134

  

userAgent

-

aws-cli/1.3.2 Python/2.7.5 Windows/7

  

userIdentity

-

"ADFS-ADMIN"

  

uuid

-

3cb19564-0854-4dd0-9d31-753eeef643e9

  

VpcEndpointIp

-

vpce-01234567890123456

  
Parent topic: Search Method Data Sources