Parsers and Generated Fields
Tag Fields Created by Parser aws-cloudtrail
#Cps.version
#Vendor
#ecs.version
#event.dataset
#event.kind
#event.module
#event.outcome
#observer.type
Fields Identified by Parser aws-cloudtrail
| Source Field | CPS Field | Description | Mapping |
|---|---|---|---|
| Fallback user name | Vendor.additionalEventData.UserName | Â | user.name |
| Alternative account ID source | Vendor.awsAccountId | Â | cloud.account.id |
| AWS region | Vendor.awsRegion | Â | cloud.region |
| Alternative S3 bucket name source | Vendor.digestS3Bucket | Â | cloud.Storage.bucket_name |
| S3 object path | Vendor.digestS3Object | Â | file.path |
| Fallback timestamp if eventTime not present | Vendor.digestStartTime | Â | @timestamp |
| Error code | Vendor.errorCode | Â | error.code |
| Error details | Vendor.errorMessage | Â | error.message |
| Event ID | Vendor.eventID | Â | event.id |
| Event action name | Vendor.eventName | Â | event.action |
| Event source service | Vendor.eventSource | Â | event.provider |
| Event timestamp in UTC | Vendor.eventTime | Â | @timestamp |
| When hash algorithm is SHA-256 | Vendor.previousDigestHashValue | Â | file.hash.sha256 |
| Fallback account ID source | Vendor.recipientAccountId | Â | cloud.account.id |
| Host name (lowercase) | Vendor.requestParameters.Host | Â | host.name |
| S3 bucket name | Vendor.requestParameters.bucketName | Â | cloud.Storage.bucket_name |
| EC2 instance ID | Vendor.requestParameters.instanceId | Â | cloud.instance.id |
| Role ARN for SAMLUser, Role types | Vendor.requestParameters.roleArn | Â | user.roles[] |
| User name for AWSAccount type | Vendor.requestParameters.roleSessionName | Â | user.name |
| Console login outcome (success/failure) | Vendor.responseElements.ConsoleLogin | Â | event.outcome |
| Source address (lowercase) | Vendor.sourceIPAddress | Â | source.address |
| Alternative timestamp field | Vendor.time | Â | @timestamp |
| TLS cipher suite | Vendor.tlsDetails.cipherSuite | Â | tls.cipher |
| Split into protocol and version | Vendor.tlsDetails.tlsVersion | Â | tls.version_protocol, tls.version |
| User agent string | Vendor.userAgent | Â | user_agent.original |
| AWS account ID | Vendor.userIdentity.accountId | Â | cloud.account.id |
| User name for AWSService type | Vendor.userIdentity.invokedBy | Â | user.name |
| Role ARN for IdentityCenterUser type | Vendor.userIdentity.onBehalfOf.identityStoreArn | Â | user.roles[] |
| User ID for IdentityCenterUser type | Vendor.userIdentity.onBehalfOf.userId | Â | user.id |
| User ID | Vendor.userIdentity.principalId | Â | user.id |
| Role ARN for AssumedRole type | Vendor.userIdentity.sessionContext.sessionIssuer.arn | Â | user.roles[] |
| User name for AssumedRole type | Vendor.userIdentity.sessionContext.sessionIssuer.userName | Â | user.name |
| User name for IAMUser type | Vendor.userIdentity.userName | Â | user.name |