mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-07 09:48:58 +00:00
47 lines
1.7 KiB
YAML
47 lines
1.7 KiB
YAML
|
title: AWS CloudTrail Logs mapping for Azure Log Analytics
|
||
|
|
order: 20
|
||
|
|
backends:
|
||
|
|
- ala
|
||
|
|
- ala-rule
|
||
|
|
fieldmappings:
|
||
|
|
additionalEventdata: AdditionalEventData
|
||
|
|
apiVersion: APIVersion
|
||
|
|
awsRegion: AWSRegion
|
||
|
|
errorCode: ErrorCode
|
||
|
|
errorMessage: ErrorMessage
|
||
|
|
eventID: AwsEventId
|
||
|
|
eventName: EventName
|
||
|
|
eventSource: EventSource
|
||
|
|
eventTime: TimeGenerated
|
||
|
|
eventType: EventTypeName
|
||
|
|
eventVersion: EventVersion
|
||
|
|
managementEvent: ManagementEvent
|
||
|
|
readOnly: ReadOnly
|
||
|
|
recipientAccountId: RecipientAccountId
|
||
|
|
requestID: AwsRequestId_
|
||
|
|
requestParameters: RequestParameters
|
||
|
|
responseElements: ResponseElements
|
||
|
|
serviceEventDetails: ServiceEventDetails
|
||
|
|
sourceIPAddress: SourceIpAddress
|
||
|
|
userAgent: UserAgent
|
||
|
|
userIdentity.accessKeyId: UserIdentityAccessKeyId
|
||
|
|
userIdentity.accountId: UserIdentityAccountId
|
||
|
|
userIdentity.arn: UserIdentityArn
|
||
|
|
userIdentity.invokedBy: UserIdentityInvokedBy
|
||
|
|
userIdentity.principalId: UserIdentityPrincipalid
|
||
|
|
userIdentity.sessionContext.attributes.creationDate: SessionCreationDate
|
||
|
|
userIdentity.sessionContext.attributes.mfaAuthenticated: SessionMfaAuthenticated
|
||
|
|
userIdentity.sessionContext.sessionIssuer.userName: SessionIssuerUserName
|
||
|
|
userIdentity.sessionContext.sessionIssuer.type: SessionIssuerType
|
||
|
|
userIdentity.sessionContext.sessionIssuer.principalId: SessionIssuerPrincipalId
|
||
|
|
userIdentity.sessionContext.sessionIssuer.arn: SessionIssuerArn
|
||
|
|
userIdentity.sessionContext.sessionIssuer.accountId: SessionIssuerAccountId
|
||
|
|
userIdentity.type: UserIdentityType
|
||
|
|
userIdentity.userName: UserIdentityUserName
|
||
|
|
vpcEndpointId: VpcEndpointId
|
||
|
|
overrides:
|
||
|
|
- field: ErrorCode
|
||
|
|
value: 999999
|
||
|
|
regexes:
|
||
|
|
- (ErrorCode contains \'\')
|