diff --git a/packages/aws/changelog.yml b/packages/aws/changelog.yml index 687c1f92318..d8e4120d3ec 100644 --- a/packages/aws/changelog.yml +++ b/packages/aws/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "7.1.0" + changes: + - description: "Stop storing the assumed-role ARN session name in `user.changes.*`. The session name is now added to `related.user` for cross-source correlation; when it is an email, both the full email and the local-part prefix are added. `user.name` continues to hold the IAM role name for detection rules." + type: enhancement + link: https://github.com/elastic/integrations/pull/20318 - version: "7.0.0" changes: - description: Hide the CloudWatch, EBS, EC2, ECS, and S3 metric/log inputs when the Identity Federation setup access option is selected, since only the GuardDuty API input supports identity federation. diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log new file mode 100644 index 00000000000..279105fc782 --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log @@ -0,0 +1 @@ +{"eventVersion":"1.05","userIdentity":{"type":"AssumedRole","principalId":"AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com","arn":"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com","accountId":"111111111111","accessKeyId":"AKIAI44QH8DHBEXAMPLE","sessionContext":{"attributes":{"mfaAuthenticated":"false","creationDate":"2019-10-02T21:50:54Z"},"sessionIssuer":{"type":"Role","principalId":"AROAIN5ATK5U7KEXAMPLE","arn":"arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b","accountId":"111111111111","userName":"AWSReservedSSO_SecurityAudit_8df5ccd37b"}}},"eventTime":"2019-10-02T22:12:29Z","eventSource":"sts.amazonaws.com","eventName":"AssumeRole","awsRegion":"us-east-2","sourceIPAddress":"81.2.69.144","userAgent":"aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239","requestParameters":{"roleArn":"arn:aws:iam::111111111111:role/JohnRole2","roleSessionName":"firstname.lastname@example.com","durationSeconds":3600},"responseElements":{"credentials":{"accessKeyId":"ASIAWHOJDLGPOEXAMPLE","expiration":"Oct 2, 2019 11:12:29 PM","sessionToken":"EXAMPLETOKEN"},"assumedRoleUser":{"assumedRoleId":"AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com","arn":"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com"}},"requestID":"b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE","eventID":"2a17948f-3042-46ec-98e2-62865EXAMPLE","eventType":"AwsApiCall","recipientAccountId":"111111111111"} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json new file mode 100644 index 00000000000..1f86ee60f7b --- /dev/null +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-email-session-json.log-expected.json @@ -0,0 +1,154 @@ +{ + "expected": [ + { + "@timestamp": "2019-10-02T22:12:29.000Z", + "actor": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + } + }, + "aws": { + "cloudtrail": { + "event_type": "AwsApiCall", + "event_version": "1.05", + "flattened": { + "request_parameters": { + "durationSeconds": 3600, + "roleArn": "arn:aws:iam::111111111111:role/JohnRole2", + "roleSessionName": "firstname.lastname@example.com" + }, + "response_elements": { + "assumedRoleUser": { + "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "assumedRoleId": "AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com" + }, + "credentials": { + "accessKeyId": "ASIAWHOJDLGPOEXAMPLE", + "expiration": "Oct 2, 2019 11:12:29 PM", + "sessionToken": "EXAMPLETOKEN" + } + } + }, + "recipient_account_id": "111111111111", + "request_id": "b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE", + "request_parameters": "{durationSeconds=3600, roleArn=arn:aws:iam::111111111111:role/JohnRole2, roleSessionName=firstname.lastname@example.com}", + "response_elements": "{assumedRoleUser={assumedRoleId=AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com, arn=arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com}, credentials={accessKeyId=ASIAWHOJDLGPOEXAMPLE, sessionToken=EXAMPLETOKEN, expiration=Oct 2, 2019 11:12:29 PM}}", + "user_identity": { + "access_key_id": "AKIAI44QH8DHBEXAMPLE", + "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "session_context": { + "creation_date": "2019-10-02T21:50:54.000Z", + "mfa_authenticated": "false", + "session_issuer": { + "account_id": "111111111111", + "arn": "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b", + "principal_id": "AROAIN5ATK5U7KEXAMPLE", + "type": "Role" + } + }, + "type": "AssumedRole" + } + } + }, + "cloud": { + "account": { + "id": "111111111111" + }, + "region": "us-east-2" + }, + "ecs": { + "version": "8.11.0" + }, + "event": { + "action": "AssumeRole", + "category": [ + "authentication" + ], + "created": "2021-11-11T01:02:03.123456789Z", + "id": "2a17948f-3042-46ec-98e2-62865EXAMPLE", + "kind": "event", + "original": "{\"eventVersion\":\"1.05\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com\",\"arn\":\"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com\",\"accountId\":\"111111111111\",\"accessKeyId\":\"AKIAI44QH8DHBEXAMPLE\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2019-10-02T21:50:54Z\"},\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROAIN5ATK5U7KEXAMPLE\",\"arn\":\"arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b\",\"accountId\":\"111111111111\",\"userName\":\"AWSReservedSSO_SecurityAudit_8df5ccd37b\"}}},\"eventTime\":\"2019-10-02T22:12:29Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"us-east-2\",\"sourceIPAddress\":\"81.2.69.144\",\"userAgent\":\"aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::111111111111:role/JohnRole2\",\"roleSessionName\":\"firstname.lastname@example.com\",\"durationSeconds\":3600},\"responseElements\":{\"credentials\":{\"accessKeyId\":\"ASIAWHOJDLGPOEXAMPLE\",\"expiration\":\"Oct 2, 2019 11:12:29 PM\",\"sessionToken\":\"EXAMPLETOKEN\"},\"assumedRoleUser\":{\"assumedRoleId\":\"AROAIFR7WHDTSOYQYHFUE:firstname.lastname@example.com\",\"arn\":\"arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com\"}},\"requestID\":\"b96b0e4e-e561-11e9-8b3f-7b396EXAMPLE\",\"eventID\":\"2a17948f-3042-46ec-98e2-62865EXAMPLE\",\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"111111111111\"}", + "outcome": "success", + "provider": "sts.amazonaws.com", + "type": [ + "info" + ] + }, + "related": { + "entity": [ + "firstname.lastname@example.com", + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b", + "AKIAI44QH8DHBEXAMPLE", + "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SecurityAudit_8df5ccd37b/firstname.lastname@example.com", + "AWSReservedSSO_SecurityAudit_8df5ccd37b", + "arn:aws:iam::111111111111:role/JohnRole2" + ], + "user": [ + "firstname.lastname@example.com", + "firstname.lastname", + "AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com", + "AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + }, + "source": { + "address": "81.2.69.144", + "geo": { + "city_name": "London", + "continent_name": "Europe", + "country_iso_code": "GB", + "country_name": "United Kingdom", + "location": { + "lat": 51.5142, + "lon": -0.0931 + }, + "region_iso_code": "GB-ENG", + "region_name": "England" + }, + "ip": "81.2.69.144" + }, + "tags": [ + "preserve_original_event", + "actor_target_mapping" + ], + "target": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/JohnRole2" + ] + } + }, + "user": { + "email": "firstname.lastname@example.com", + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/AWSReservedSSO_SecurityAudit_8df5ccd37b" + ] + }, + "id": "AROAIN5ATK5U7KEXAMPLE:firstname.lastname@example.com", + "name": "AWSReservedSSO_SecurityAudit_8df5ccd37b", + "target": { + "entity": { + "id": [ + "arn:aws:iam::111111111111:role/JohnRole2" + ] + } + } + }, + "user_agent": { + "device": { + "name": "Spider" + }, + "name": "aws-cli", + "original": "aws-cli/1.16.248 Python/3.4.7 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 botocore/1.12.239", + "os": { + "full": "Linux 4.9.184", + "name": "Linux", + "version": "4.9.184" + }, + "version": "1.16.248" + } + } + ] +} diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json index 5cae84e7a61..d3be89dc2f3 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json @@ -112,9 +112,9 @@ "arn:aws:iam::111111111111:role/JohnRole2" ], "user": [ + "JohnRole1", "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe", - "JohnRole1" + "JohnDoe" ] }, "source": { @@ -145,9 +145,6 @@ } }, "user": { - "changes": { - "name": "JohnRole1" - }, "entity": { "id": [ "arn:aws:iam::111111111111:role/JohnRole1" @@ -293,9 +290,9 @@ "arn:aws:iam::111111111111:role/JohnRole2" ], "user": [ + "JohnRole1", "AROAIN5ATK5U7KEXAMPLE:JohnRole1", - "JohnDoe", - "JohnRole1" + "JohnDoe" ] }, "source": { @@ -326,9 +323,6 @@ } }, "user": { - "changes": { - "name": "JohnRole1" - }, "entity": { "id": [ "arn:aws:iam::111111111111:role/JohnRole1" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json index 51980a6ba56..bb647ec1f1f 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-attach-user-policy-json.log-expected.json @@ -83,10 +83,10 @@ "arn:aws:iam::000000000:role/ec2-instance-role" ], "user": [ + "i-06815aa7cf7d21f8f", "pwncloud-backdoor-user", "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role", - "i-06815aa7cf7d21f8f" + "ec2-instance-role" ] }, "service": { @@ -138,9 +138,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-06815aa7cf7d21f8f" - }, "entity": { "id": [ "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json index 7173242de46..f17cce85033 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-authorize-security-group-egress-json.log-expected.json @@ -107,9 +107,9 @@ "sg-038ccc3a1f7b05f42" ], "user": [ + "i-06815aa7cf7d21f8f", "PRINCIPALID:i-06815aa7cf7d21f8f", - "ec2-instance-role", - "i-06815aa7cf7d21f8f" + "ec2-instance-role" ] }, "service": { @@ -162,9 +162,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-06815aa7cf7d21f8f" - }, "entity": { "id": [ "arn:aws:sts::000000000:assumed-role/ec2-instance-role/i-06815aa7cf7d21f8f" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json index ddd00a5ef1b..0201de0589d 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json @@ -321,9 +321,9 @@ "RoleToBeAssumed" ], "user": [ + "MySessionName", "AROAIDPPEZS35WEXAMPLE:AssumedRoleSessionName", - "RoleToBeAssumed", - "MySessionName" + "RoleToBeAssumed" ] }, "source": { @@ -353,9 +353,6 @@ "actor_target_mapping" ], "user": { - "changes": { - "name": "MySessionName" - }, "entity": { "id": [ "arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json index da7b05fa8be..e081ca4a415 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-converse-json.log-expected.json @@ -77,9 +77,9 @@ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae" ], "user": [ + "i-03cd6b2a7eb4bf3ae", "PRINCIPALID:i-03cd6b2a7eb4bf3ae", - "private-ec2-instance-role", - "i-03cd6b2a7eb4bf3ae" + "private-ec2-instance-role" ] }, "source": { @@ -121,9 +121,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-03cd6b2a7eb4bf3ae" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-03cd6b2a7eb4bf3ae" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json index 0ec8f9430a2..38a488c530e 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-control-channel-json.log-expected.json @@ -83,9 +83,9 @@ "arn:aws:ssmmessages:us-east-2:00000000000:control-channel/i-05e14c76fdb335957" ], "user": [ + "i-05e14c76fdb335957", "PRINCIPALID:i-05e14c76fdb335957", - "bedrock_ec2_role", - "i-05e14c76fdb335957" + "bedrock_ec2_role" ] }, "source": { @@ -127,9 +127,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-05e14c76fdb335957" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/bedrock_ec2_role/i-05e14c76fdb335957" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json index 0bffc8f09d9..87abbe9b5c9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json @@ -71,9 +71,9 @@ "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk" ], "user": [ + "devdsk", "AIDAQRSTUVWXYZEXAMPLE:devdsk", - "AssumeNothing", - "devdsk" + "AssumeNothing" ] }, "source": { @@ -103,9 +103,6 @@ "actor_target_mapping" ], "user": { - "changes": { - "name": "devdsk" - }, "entity": { "id": [ "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json index b956097851d..1655f84be3b 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-bucket-policy-json.log-expected.json @@ -90,9 +90,9 @@ "ACCESSKEY" ], "user": [ + "AWSConfig-Describe", "PRINCIPALID:AWSConfig-Describe", - "AWSServiceRoleForConfig", - "AWSConfig-Describe" + "AWSServiceRoleForConfig" ] }, "service": { @@ -124,9 +124,6 @@ } }, "user": { - "changes": { - "name": "AWSConfig-Describe" - }, "id": "PRINCIPALID:AWSConfig-Describe", "name": "AWSServiceRoleForConfig" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json index 558d402eb4f..637c379505a 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-get-policy-json.log-expected.json @@ -73,9 +73,9 @@ "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" ], "user": [ + "i-00486a46a6d8692b9", "PRINCIPALID:i-00486a46a6d8692b9", - "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9", - "i-00486a46a6d8692b9" + "Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9" ] }, "service": { @@ -126,9 +126,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-00486a46a6d8692b9" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/Elastic-Cloud-Security-Posture-Man-ElasticAgentRole-EdUmKXybQxe9/i-00486a46a6d8692b9" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json index 29f7470624c..1aa38b11958 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-open-control-channel-json.log-expected.json @@ -93,9 +93,9 @@ "arn:aws:ssmmessages:us-east-1:000000000000:control-channel/i-021987ab2dbf04585" ], "user": [ + "i-021987ab2dbf04585", "PRINCIPALID:i-021987ab2dbf04585", - "ec2-instance-role", - "i-021987ab2dbf04585" + "ec2-instance-role" ] }, "source": { @@ -134,9 +134,6 @@ } }, "user": { - "changes": { - "name": "i-021987ab2dbf04585" - }, "entity": { "id": [ "arn:aws:sts::000000000000:assumed-role/ec2-instance-role/i-021987ab2dbf04585" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json index 0ad558f1ee3..3addc2d9ab0 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-publish-json.log-expected.json @@ -89,9 +89,9 @@ "arn:aws:sns:us-east-1:00000000000:pwncloud-data-exfiltration" ], "user": [ + "i-0ddf9acf8eeb33959", "PRINCIPALID:i-0ddf9acf8eeb33959", - "private-ec2-instance-role", - "i-0ddf9acf8eeb33959" + "private-ec2-instance-role" ] }, "source": { @@ -133,9 +133,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-0ddf9acf8eeb33959" - }, "entity": { "id": [ "arn:aws:sts::00000000000:assumed-role/private-ec2-instance-role/i-0ddf9acf8eeb33959" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json index 77ab74fb063..38f2f4a1d53 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-send-command-all-json.log-expected.json @@ -123,9 +123,9 @@ "arn:aws:iam::00000000000:role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM" ], "user": [ + "StateManagerService", "PRINCIPAL:StateManagerService", - "AWSServiceRoleForAmazonSSM", - "StateManagerService" + "AWSServiceRoleForAmazonSSM" ] }, "service": { @@ -150,9 +150,6 @@ } }, "user": { - "changes": { - "name": "StateManagerService" - }, "id": "PRINCIPAL:StateManagerService", "name": "AWSServiceRoleForAmazonSSM" }, diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json index 173adb2394c..2d5bb6d54f9 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-tls-details-json.log-expected.json @@ -293,9 +293,10 @@ "arn:aws:sts::001122334455:assumed-role/Some_AWS_Role/some.user@example.com" ], "user": [ + "some.user@example.com", + "some.user", "REDACTED:some.user@example.com", - "Some_AWS_Role", - "some.user@example.com" + "Some_AWS_Role" ] }, "source": { @@ -314,9 +315,7 @@ "version": "1.3" }, "user": { - "changes": { - "name": "some.user@example.com" - }, + "email": "some.user@example.com", "entity": { "id": [ "arn:aws:sts::001122334455:assumed-role/Some_AWS_Role/some.user@example.com" diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json index 3ae40ac25f3..b4b758b2ed5 100644 --- a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json +++ b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-us-gov-arn.log-expected.json @@ -81,9 +81,9 @@ "arn:aws-us-gov:iam::111111111111:role/ExampleRole" ], "user": [ + "i-example1234567890", "AROAEXAMPLE:i-example1234567890", - "ExampleRole", - "i-example1234567890" + "ExampleRole" ] }, "source": { @@ -115,9 +115,6 @@ "version_protocol": "tls" }, "user": { - "changes": { - "name": "i-example1234567890" - }, "entity": { "id": [ "arn:aws-us-gov:sts::111111111111:assumed-role/ExampleRole/i-example1234567890" diff --git a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml index 4b66511f2b8..2a20d26a24d 100644 --- a/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml +++ b/packages/aws/data_stream/cloudtrail/elasticsearch/ingest_pipeline/default.yml @@ -1083,13 +1083,45 @@ processors: target_field: aws.cloudtrail.user_identity.session_context.session_issuer.principal_id ignore_missing: true ignore_failure: true + # Extract the session name from the ARN into a scratch field. The session name + # is an actor label, not a user-account modification, so it must not go into + # user.changes.* (ECS defines that fieldset for modifications made to a user + # account during the event). It is added to related.user for cross-source + # correlation. When it is an email (SSO/Identity Center), both the full email + # and the local-part prefix are added so it correlates with sources that store + # only the short username. user.name is left as the IAM role name. (issue #18346) - grok: field: aws.cloudtrail.user_identity.arn patterns: - - "arn:(aws|aws-us-gov):sts:.*/%{GREEDYDATA:user.changes.name}$" + - "arn:(aws|aws-us-gov):sts:.*/%{GREEDYDATA:_tmp.session_name}$" ignore_missing: true if: (ctx.aws?.cloudtrail?.user_identity?.type == 'AssumedRole' || ctx.aws?.cloudtrail?.user_identity?.type == 'FederatedUser') && ctx.aws?.cloudtrail?.user_identity?.arn != null - tag: extract_user_name_from_arn + tag: extract_session_name_from_arn + - append: + tag: append_related_user_session_name + field: related.user + value: '{{{_tmp.session_name}}}' + if: ctx._tmp?.session_name != null + allow_duplicates: false + ignore_failure: true + - dissect: + tag: extract_session_name_email_prefix + field: _tmp.session_name + pattern: '%{_tmp.session_name_prefix}@%{}' + if: ctx._tmp?.session_name != null && ctx._tmp.session_name.contains('@') + - append: + tag: append_related_user_session_name_prefix + field: related.user + value: '{{{_tmp.session_name_prefix}}}' + if: ctx._tmp?.session_name_prefix != null + allow_duplicates: false + ignore_failure: true + - set: + tag: set_user_email_from_session_name + field: user.email + copy_from: _tmp.session_name + if: ctx.user?.email == null && ctx._tmp?.session_name_prefix != null + ignore_empty_value: true - rename: field: json.userIdentity.onBehalfOf.userId target_field: user.id @@ -2145,6 +2177,7 @@ processors: field: - json - _conf + - _tmp ignore_missing: true - script: tag: remove_nulls @@ -2187,4 +2220,5 @@ on_failure: field: - json - _conf + - _tmp ignore_missing: true diff --git a/packages/aws/manifest.yml b/packages/aws/manifest.yml index 5bbad6ee374..2fb55e7b8c7 100644 --- a/packages/aws/manifest.yml +++ b/packages/aws/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.6.1 name: aws title: AWS -version: 7.0.0 +version: 7.1.0 description: Collect logs and metrics from Amazon Web Services (AWS) with Elastic Agent. type: integration categories: