Add CreateDetector and DeleteDetector

Also deleted unnecessary related info
elastic · Sep 27, 2024 · b5e160f · b5e160f
1 parent 83a5af6
commit b5e160f
Show file tree

Hide file tree

Showing 42 changed files with 271 additions and 89 deletions.
diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-add-user-to-group-json.log-expected.json
@@ -52,7 +52,6 @@
             },
             "related": {
                 "entity": [
-                    "EX_PRINCIPAL_ID",
                     "arn:aws:iam::123456789012:user/Alice",
                     "Bob",
                     "Alice"

diff --git a/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json b/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-assume-role-json.log-expected.json
@@ -95,7 +95,6 @@
             },
             "related": {
                 "entity": [
-                    "AROAIN5ATK5U7KEXAMPLE:JohnRole1",
                     "arn:aws:sts::111111111111:assumed-role/JohnDoe/JohnRole1",
                     "Role2WithTags",
                     "JohnDoe",
@@ -242,7 +241,6 @@
             },
             "related": {
                 "entity": [
-                    "AROAIN5ATK5U7KEXAMPLE:JohnRole1",
                     "arn:aws:sts::111111111111:assumed-role/JohnDoe/JohnRole1",
                     "Role2WithTags",
                     "JohnDoe",

diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-change-password-json.log-expected.json
@@ -45,7 +45,6 @@
             },
             "related": {
                 "entity": [
-                    "0123456789012",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],
@@ -116,7 +115,6 @@
             },
             "related": {
                 "entity": [
-                    "0123456789012",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-console-login-json.log-expected.json
@@ -56,7 +56,6 @@
             },
             "related": {
                 "entity": [
-                    "AIDACKCEVSQ6C2EXAMPLE",
                     "JohnDoe",
                     "arn:aws:iam::111122223333:user/JohnDoe"
                 ],
@@ -164,7 +163,6 @@
             },
             "related": {
                 "entity": [
-                    "AIDACKCEVSQ6C2EXAMPLE",
                     "JaneDoe",
                     "arn:aws:iam::111122223333:user/JaneDoe"
                 ],
@@ -284,7 +282,6 @@
                 "entity": [
                     "arn:aws:sts::123456789012:assumed-role/RoleToBeAssumed/MySessionName",
                     "arn:aws:iam::123456789012:role/RoleToBeAssumed",
-                    "AROAIDPPEZS35WEXAMPLE:AssumedRoleSessionName",
                     "RoleToBeAssumed"
                 ]
             },

diff --git a/...s/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json b/...s/data_stream/cloudtrail/_dev/test/pipeline/test-create-access-key-json.log-expected.json
@@ -62,7 +62,6 @@
             },
             "related": {
                 "entity": [
-                    "EXAMPLE_ID",
                     "Bob",
                     "EXAMPLE_KEY_ID",
                     "Alice",

diff --git a/.../data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json b/.../data_stream/cloudtrail/_dev/test/pipeline/test-create-db-instance-json.log-expected.json
@@ -162,16 +162,15 @@
                 "entity": [
                     "sg-4e483165",
                     "subnet-c4bf5e9b",
+                    "vpc-73d2e309",
+                    "test-cloudtrail-event-instance-14340",
                     "[email protected]",
                     "subnet-0a0bee6c",
                     "subnet-37391109",
-                    "subnet-bf6ab5b1",
-                    "subnet-8bdf6bc6",
-                    "AIDA2IBR2EZTJMPOR52WV",
-                    "vpc-73d2e309",
-                    "test-cloudtrail-event-instance-14340",
                     "subnet-fee506df",
-                    "arn:aws:iam::1010101010101:user/[email protected]"
+                    "arn:aws:iam::1010101010101:user/[email protected]",
+                    "subnet-bf6ab5b1",
+                    "subnet-8bdf6bc6"
                 ],
                 "user": [
                     "[email protected]"

diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log
@@ -0,0 +1 @@
+{"awsRegion":"us-east-1","eventCategory":"Management","eventID":"5066c6b7-e140-4fc9-96bf-0a2ce3c90687","eventName":"CreateDetector","eventSource":"guardduty.amazonaws.com","eventTime":"2024-09-27T13:39:32Z","eventType":"AwsApiCall","eventVersion":"1.09","readOnly":false,"recipientAccountId":"00000000000","requestID":"1fc0f718-6358-4cce-aa9b-1dfc09e7a59a","requestParameters":{"clientToken":"7d152911-fcab-4cb5-8bd8-0516d868d0fd","enable":false},"responseElements":{"detectorId":"82c919daa523bc69d203c24868c06849"},"sourceIPAddress":"216.160.83.56","userAgent":"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.create-detector","userIdentity":{"accessKeyId":"TESTACCESSKEY","accountId":"00000000000","arn":"arn:aws:iam::00000000000:user/[email protected]","principalId":"TESTPRINCIPALID","type":"IAMUser","userName":"[email protected]"}}
diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-detector-json.log-expected.json
@@ -0,0 +1,103 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2024-09-27T13:39:32.000Z",
+            "aws": {
+                "cloudtrail": {
+                    "event_category": "Management",
+                    "event_type": "AwsApiCall",
+                    "event_version": "1.09",
+                    "flattened": {
+                        "request_parameters": {
+                            "clientToken": "7d152911-fcab-4cb5-8bd8-0516d868d0fd",
+                            "enable": false
+                        },
+                        "response_elements": {
+                            "detectorId": "82c919daa523bc69d203c24868c06849"
+                        }
+                    },
+                    "read_only": false,
+                    "recipient_account_id": "00000000000",
+                    "request_id": "1fc0f718-6358-4cce-aa9b-1dfc09e7a59a",
+                    "request_parameters": "{clientToken=7d152911-fcab-4cb5-8bd8-0516d868d0fd, enable=false}",
+                    "response_elements": "{detectorId=82c919daa523bc69d203c24868c06849}",
+                    "user_identity": {
+                        "access_key_id": "TESTACCESSKEY",
+                        "arn": "arn:aws:iam::00000000000:user/[email protected]",
+                        "type": "IAMUser"
+                    }
+                }
+            },
+            "cloud": {
+                "account": {
+                    "id": "00000000000"
+                },
+                "region": "us-east-1"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "entity": {
+                "targets": [
+                    "82c919daa523bc69d203c24868c06849"
+                ]
+            },
+            "event": {
+                "action": "CreateDetector",
+                "created": "2021-11-11T01:02:03.123456789Z",
+                "id": "5066c6b7-e140-4fc9-96bf-0a2ce3c90687",
+                "kind": "event",
+                "original": "{\"awsRegion\":\"us-east-1\",\"eventCategory\":\"Management\",\"eventID\":\"5066c6b7-e140-4fc9-96bf-0a2ce3c90687\",\"eventName\":\"CreateDetector\",\"eventSource\":\"guardduty.amazonaws.com\",\"eventTime\":\"2024-09-27T13:39:32Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.09\",\"readOnly\":false,\"recipientAccountId\":\"00000000000\",\"requestID\":\"1fc0f718-6358-4cce-aa9b-1dfc09e7a59a\",\"requestParameters\":{\"clientToken\":\"7d152911-fcab-4cb5-8bd8-0516d868d0fd\",\"enable\":false},\"responseElements\":{\"detectorId\":\"82c919daa523bc69d203c24868c06849\"},\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.create-detector\",\"userIdentity\":{\"accessKeyId\":\"TESTACCESSKEY\",\"accountId\":\"00000000000\",\"arn\":\"arn:aws:iam::00000000000:user/[email protected]\",\"principalId\":\"TESTPRINCIPALID\",\"type\":\"IAMUser\",\"userName\":\"[email protected]\"}}",
+                "outcome": "success",
+                "provider": "guardduty.amazonaws.com",
+                "type": [
+                    "info"
+                ]
+            },
+            "related": {
+                "entity": [
+                    "arn:aws:iam::00000000000:user/[email protected]",
+                    "82c919daa523bc69d203c24868c06849",
+                    "[email protected]"
+                ],
+                "user": [
+                    "[email protected]"
+                ]
+            },
+            "source": {
+                "address": "216.160.83.56",
+                "as": {
+                    "number": 209
+                },
+                "geo": {
+                    "city_name": "Milton",
+                    "continent_name": "North America",
+                    "country_iso_code": "US",
+                    "country_name": "United States",
+                    "location": {
+                        "lat": 47.2513,
+                        "lon": -122.3149
+                    },
+                    "region_iso_code": "US-WA",
+                    "region_name": "Washington"
+                },
+                "ip": "216.160.83.56"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "id": "TESTPRINCIPALID",
+                "name": "[email protected]"
+            },
+            "user_agent": {
+                "device": {
+                    "name": "Other"
+                },
+                "name": "aws-cli",
+                "original": "aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.create-detector",
+                "version": "2.17.60"
+            }
+        }
+    ]
+}
diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-group-json.log-expected.json
@@ -67,7 +67,6 @@
             },
             "related": {
                 "entity": [
-                    "0123456789012",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],
@@ -147,7 +146,6 @@
             },
             "related": {
                 "entity": [
-                    "0123456789012",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],

diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-key-pair-json.log-expected.json
@@ -54,7 +54,6 @@
             },
             "related": {
                 "entity": [
-                    "EX_PRINCIPAL_ID",
                     "arn:aws:iam::123456789012:user/Alice",
                     "Alice"
                 ],

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-lambda-json.log-expected.json
@@ -89,11 +89,10 @@
             },
             "related": {
                 "entity": [
-                    "AIDA2IBR2EZTJMPOR52WV",
-                    "arn:aws:lambda:us-east-1:1010101010101:function:cloudtrail-events-test",
-                    "[email protected]",
                     "arn:aws:iam::1010101010101:role/cloudtrail-events-test-lambda-fn",
+                    "arn:aws:lambda:us-east-1:1010101010101:function:cloudtrail-events-test",
                     "arn:aws:iam::1010101010101:user/[email protected]",
+                    "[email protected]",
                     "cloudtrail-events-test"
                 ],
                 "user": [

diff --git a/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json b/...es/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-trail-json.log-expected.json
@@ -65,10 +65,9 @@
             },
             "related": {
                 "entity": [
-                    "EXAMPLE_ID",
                     "TEST-trail",
-                    "Alice",
                     "TEST-cloudtrail-bucket",
+                    "Alice",
                     "arn:aws:cloudtrail:us-west-2:0123456789012:trail/TEST-trail",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],

diff --git a/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json b/...ges/aws/data_stream/cloudtrail/_dev/test/pipeline/test-create-user-json.log-expected.json
@@ -54,7 +54,6 @@
             },
             "related": {
                 "entity": [
-                    "EX_PRINCIPAL_ID",
                     "arn:aws:iam::123456789012:user/Alice",
                     "Bob",
                     "arn:aws:iam::123456789012:user/Bob",

diff --git a/...tream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json b/...tream/cloudtrail/_dev/test/pipeline/test-create-virtual-mfa-device-json.log-expected.json
@@ -59,7 +59,6 @@
             },
             "related": {
                 "entity": [
-                    "EXAMPLE_ID",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],

diff --git a/...ta_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json b/...ta_stream/cloudtrail/_dev/test/pipeline/test-deactivate-mfa-device-json.log-expected.json
@@ -54,7 +54,6 @@
             },
             "related": {
                 "entity": [
-                    "EXAMPLE_ID",
                     "Alice",
                     "arn:aws:iam::0123456789012:user/Alice"
                 ],

diff --git a/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json b/...s/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-bucket-json.log-expected.json
@@ -60,7 +60,6 @@
                     "my-test-bucket-cross-account",
                     "arn:aws:iam::777788889999:role/AssumeNothing",
                     "AssumeNothing",
-                    "AIDAQRSTUVWXYZEXAMPLE:devdsk",
                     "arn:aws:sts::777788889999:assumed-role/AssumeNothing/devdsk"
                 ]
             },

diff --git a/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log b/packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log
@@ -0,0 +1 @@
+{"awsRegion":"us-east-1","eventCategory":"Management","eventID":"3468e5a5-fdab-4c86-a43e-bc8e1d9bd4f8","eventName":"DeleteDetector","eventSource":"guardduty.amazonaws.com","eventTime":"2024-09-27T13:39:33Z","eventType":"AwsApiCall","eventVersion":"1.09","readOnly":false,"recipientAccountId":"000000000","requestID":"ae4ec29d-4df9-4a15-a521-dc2ac12ee907","requestParameters":{"detectorId":"82c919daa523bc69d203c24868c06849"},"responseElements":null,"sourceIPAddress":"216.160.83.56","userAgent":"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.delete-detector","userIdentity":{"accessKeyId":"ACCESSKEYID","accountId":"000000000","arn":"arn:aws:iam::000000000:user/[email protected]","principalId":"PRINCIPALID","type":"IAMUser","userName":"[email protected]"}}
diff --git a/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json b/...aws/data_stream/cloudtrail/_dev/test/pipeline/test-delete-detector-json.log-expected.json
@@ -0,0 +1,98 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2024-09-27T13:39:33.000Z",
+            "aws": {
+                "cloudtrail": {
+                    "event_category": "Management",
+                    "event_type": "AwsApiCall",
+                    "event_version": "1.09",
+                    "flattened": {
+                        "request_parameters": {
+                            "detectorId": "82c919daa523bc69d203c24868c06849"
+                        }
+                    },
+                    "read_only": false,
+                    "recipient_account_id": "000000000",
+                    "request_id": "ae4ec29d-4df9-4a15-a521-dc2ac12ee907",
+                    "request_parameters": "{detectorId=82c919daa523bc69d203c24868c06849}",
+                    "user_identity": {
+                        "access_key_id": "ACCESSKEYID",
+                        "arn": "arn:aws:iam::000000000:user/[email protected]",
+                        "type": "IAMUser"
+                    }
+                }
+            },
+            "cloud": {
+                "account": {
+                    "id": "000000000"
+                },
+                "region": "us-east-1"
+            },
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "entity": {
+                "targets": [
+                    "82c919daa523bc69d203c24868c06849"
+                ]
+            },
+            "event": {
+                "action": "DeleteDetector",
+                "created": "2021-11-11T01:02:03.123456789Z",
+                "id": "3468e5a5-fdab-4c86-a43e-bc8e1d9bd4f8",
+                "kind": "event",
+                "original": "{\"awsRegion\":\"us-east-1\",\"eventCategory\":\"Management\",\"eventID\":\"3468e5a5-fdab-4c86-a43e-bc8e1d9bd4f8\",\"eventName\":\"DeleteDetector\",\"eventSource\":\"guardduty.amazonaws.com\",\"eventTime\":\"2024-09-27T13:39:33Z\",\"eventType\":\"AwsApiCall\",\"eventVersion\":\"1.09\",\"readOnly\":false,\"recipientAccountId\":\"000000000\",\"requestID\":\"ae4ec29d-4df9-4a15-a521-dc2ac12ee907\",\"requestParameters\":{\"detectorId\":\"82c919daa523bc69d203c24868c06849\"},\"responseElements\":null,\"sourceIPAddress\":\"216.160.83.56\",\"userAgent\":\"aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.delete-detector\",\"userIdentity\":{\"accessKeyId\":\"ACCESSKEYID\",\"accountId\":\"000000000\",\"arn\":\"arn:aws:iam::000000000:user/[email protected]\",\"principalId\":\"PRINCIPALID\",\"type\":\"IAMUser\",\"userName\":\"[email protected]\"}}",
+                "outcome": "success",
+                "provider": "guardduty.amazonaws.com",
+                "type": [
+                    "info"
+                ]
+            },
+            "related": {
+                "entity": [
+                    "82c919daa523bc69d203c24868c06849",
+                    "[email protected]",
+                    "arn:aws:iam::000000000:user/[email protected]"
+                ],
+                "user": [
+                    "[email protected]"
+                ]
+            },
+            "source": {
+                "address": "216.160.83.56",
+                "as": {
+                    "number": 209
+                },
+                "geo": {
+                    "city_name": "Milton",
+                    "continent_name": "North America",
+                    "country_iso_code": "US",
+                    "country_name": "United States",
+                    "location": {
+                        "lat": 47.2513,
+                        "lon": -122.3149
+                    },
+                    "region_iso_code": "US-WA",
+                    "region_name": "Washington"
+                },
+                "ip": "216.160.83.56"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "id": "PRINCIPALID",
+                "name": "[email protected]"
+            },
+            "user_agent": {
+                "device": {
+                    "name": "Other"
+                },
+                "name": "aws-cli",
+                "original": "aws-cli/2.17.60 md/awscrt#0.21.2 ua/2.0 os/macos#23.6.0 md/arch#x86_64 lang/python#3.12.6 md/pyimpl#CPython exec-env/grimoire_c11215cc-0dab-4506-b744-4f477e8062f6 cfg/retry-mode#standard md/installer#exe md/prompt#off md/command#guardduty.delete-detector",
+                "version": "2.17.60"
+            }
+        }
+    ]
+}