From 50bd65f5736eb50e87dce39202ad2fcb4aac1ef2 Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 22 Sep 2026 18:07:35 +0200 Subject: [PATCH 1/6] Add repeated CloudWatch Logs read operations detection --- ...peated_cloudwatch_logs_read_operations.yml | 117 ++++++++++++++++++ 1 file changed, 117 insertions(+) create mode 100644 detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml new file mode 100644 index 00000000000..9bc6ac89993 --- /dev/null +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -0,0 +1,117 @@ +name: AWS Repeated CloudWatch Logs Read Operations +id: 3f0ba9e1-c6cf-4317-a6bc-c4bcab2b5a06 +version: 1 +creation_date: '2026-09-21' +modification_date: '2026-09-21' +author: Maria Jose Erquiaga, Splunk +status: production +type: TTP +description: >- + The following analytic detects a high volume of Amazon CloudWatch Logs read + operations performed by the same AWS principal and account within a + five-minute period. It identifies more than 500 unique DescribeLogGroups, + DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or + GetQueryResults API calls. This activity may indicate automated discovery or + collection of operational, application, or security telemetry from + CloudWatch Logs. The analytic counts unique CloudTrail event identifiers to + prevent duplicate delivery or ingestion from inflating the API-operation + count. +data_source: + - AWS CloudTrail +search: |- + `cloudtrail` eventSource="logs.amazonaws.com" + eventName IN ( + "DescribeLogGroups", + "DescribeLogStreams", + "DownloadLogEvents", + "FilterLogEvents", + "GetLogEvents", + "GetQueryResults" + ) + | eval user='userIdentity.principalId' + | eval vendor_account=coalesce( + vendor_account, + recipientAccountId, + 'userIdentity.accountId' + ) + | eval role_name='userIdentity.sessionContext.sessionIssuer.userName' + | eval signature=coalesce(signature, eventName) + | eval src=coalesce(src, sourceIPAddress) + | eval user_agent=coalesce(user_agent, userAgent) + | eval vendor_region=coalesce(vendor_region, awsRegion) + | where isnotnull(user) AND len(trim(user)) > 0 + | dedup eventID keepempty=true + | sort 0 _time + | streamstats time_window=5m count AS event_count + by user vendor_account + | where event_count > 500 + | stats + max(event_count) AS event_count + min(_time) AS firstTime + max(_time) AS lastTime + values(signature) AS api_operations + values(role_name) AS role_name + values(src) AS src + values(user_agent) AS user_agent + values(vendor_region) AS vendor_region + by user vendor_account + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_repeated_cloudwatch_logs_read_operations_filter` +how_to_implement: >- + The Splunk Add-on for AWS is required to collect AWS CloudTrail events. + Configure CloudTrail to capture management Read events and ingest them with + the aws:cloudtrail sourcetype. The tested CloudWatch Logs operations are + recorded as management events, so a CloudWatch Logs data-event selector is + not required. The analytic uses a rolling five-minute window and counts + unique CloudTrail event identifiers to reduce duplicate-ingestion effects. +known_false_positives: >- + Automated log analytics, SIEM pipelines, incident-response tooling, backup + processes, and administrative troubleshooting may continuously read + CloudWatch Logs and generate a high volume of matching operations. The + prevalence of this activity has not yet been evaluated against broader + customer telemetry. Review the principal, account, source addresses, user + agents, Regions, and accessed CloudWatch Logs resources before escalating. +references: + - https://attack.mitre.org/techniques/T1530/ + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html +drilldown_searches: + - name: View CloudWatch Logs read operations for - "$user$" + search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" +finding: + title: AWS principal $user$ performed $event_count$ CloudWatch Logs read operations + entity: + field: user + type: user + score: 50 +threat_objects: + - field: src + type: ip_address +analytic_story: + - Data Exfiltration +asset_type: AWS Account +mitre_attack_id: + - T1530 +product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud +category: cloud +security_domain: threat +tests: + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From b96f672e57815a77e16cb518f39a52324694625b Mon Sep 17 00:00:00 2001 From: merquiag Date: Tue, 22 Sep 2026 18:08:10 +0200 Subject: [PATCH 2/6] Add repeated CloudWatch Logs read operations detection --- .../cloud/aws_repeated_cloudwatch_logs_read_operations.yml | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml index 9bc6ac89993..375be9974c9 100644 --- a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -9,13 +9,11 @@ type: TTP description: >- The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a - five-minute period. It identifies more than 500 unique DescribeLogGroups, + five-minute period. It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. This activity may indicate automated discovery or collection of operational, application, or security telemetry from - CloudWatch Logs. The analytic counts unique CloudTrail event identifiers to - prevent duplicate delivery or ingestion from inflating the API-operation - count. + CloudWatch Logs. data_source: - AWS CloudTrail search: |- @@ -40,7 +38,6 @@ search: |- | eval user_agent=coalesce(user_agent, userAgent) | eval vendor_region=coalesce(vendor_region, awsRegion) | where isnotnull(user) AND len(trim(user)) > 0 - | dedup eventID keepempty=true | sort 0 _time | streamstats time_window=5m count AS event_count by user vendor_account From fc16f98eadaf44cc22f15cb25997df1ad19897ac Mon Sep 17 00:00:00 2001 From: themaryjo Date: Tue, 13 Oct 2026 18:46:08 +0200 Subject: [PATCH 3/6] Update aws_repeated_cloudwatch_logs_read_operations.yml adding "| dedup eventID keepempty=true" --- .../cloud/aws_repeated_cloudwatch_logs_read_operations.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml index 375be9974c9..d19a468512f 100644 --- a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -38,6 +38,7 @@ search: |- | eval user_agent=coalesce(user_agent, userAgent) | eval vendor_region=coalesce(vendor_region, awsRegion) | where isnotnull(user) AND len(trim(user)) > 0 + | dedup eventID keepempty=true | sort 0 _time | streamstats time_window=5m count AS event_count by user vendor_account From a0986c710de61cb58b955e63b6d542786f4adfa2 Mon Sep 17 00:00:00 2001 From: themaryjo Date: Tue, 13 Oct 2026 18:47:53 +0200 Subject: [PATCH 4/6] Update aws_repeated_cloudwatch_logs_read_operations.yml updated "how to implement" --- .../aws_repeated_cloudwatch_logs_read_operations.yml | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml index d19a468512f..bbcc82a8601 100644 --- a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -56,13 +56,7 @@ search: |- | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_repeated_cloudwatch_logs_read_operations_filter` -how_to_implement: >- - The Splunk Add-on for AWS is required to collect AWS CloudTrail events. - Configure CloudTrail to capture management Read events and ingest them with - the aws:cloudtrail sourcetype. The tested CloudWatch Logs operations are - recorded as management events, so a CloudWatch Logs data-event selector is - not required. The analytic uses a rolling five-minute window and counts - unique CloudTrail event identifiers to reduce duplicate-ingestion effects. +how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: >- Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read From 1a5ac32cdddf4ecbccec2a44ce583b276c520fb1 Mon Sep 17 00:00:00 2001 From: merquiag Date: Wed, 14 Oct 2026 13:58:15 +0200 Subject: [PATCH 5/6] Format CloudWatch Logs detection YAML --- ...peated_cloudwatch_logs_read_operations.yml | 170 +++++++++--------- 1 file changed, 85 insertions(+), 85 deletions(-) diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml index bbcc82a8601..10b81a6ce03 100644 --- a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -7,103 +7,103 @@ author: Maria Jose Erquiaga, Splunk status: production type: TTP description: >- - The following analytic detects a high volume of Amazon CloudWatch Logs read - operations performed by the same AWS principal and account within a - five-minute period. It identifies more than 500 DescribeLogGroups, - DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or - GetQueryResults API calls. This activity may indicate automated discovery or - collection of operational, application, or security telemetry from - CloudWatch Logs. + The following analytic detects a high volume of Amazon CloudWatch Logs read + operations performed by the same AWS principal and account within a + five-minute period. It identifies more than 500 DescribeLogGroups, + DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or + GetQueryResults API calls. This activity may indicate automated discovery or + collection of operational, application, or security telemetry from + CloudWatch Logs. data_source: - - AWS CloudTrail + - AWS CloudTrail search: |- - `cloudtrail` eventSource="logs.amazonaws.com" - eventName IN ( - "DescribeLogGroups", - "DescribeLogStreams", - "DownloadLogEvents", - "FilterLogEvents", - "GetLogEvents", - "GetQueryResults" - ) - | eval user='userIdentity.principalId' - | eval vendor_account=coalesce( - vendor_account, - recipientAccountId, - 'userIdentity.accountId' - ) - | eval role_name='userIdentity.sessionContext.sessionIssuer.userName' - | eval signature=coalesce(signature, eventName) - | eval src=coalesce(src, sourceIPAddress) - | eval user_agent=coalesce(user_agent, userAgent) - | eval vendor_region=coalesce(vendor_region, awsRegion) - | where isnotnull(user) AND len(trim(user)) > 0 - | dedup eventID keepempty=true - | sort 0 _time - | streamstats time_window=5m count AS event_count - by user vendor_account - | where event_count > 500 - | stats - max(event_count) AS event_count - min(_time) AS firstTime - max(_time) AS lastTime - values(signature) AS api_operations - values(role_name) AS role_name - values(src) AS src - values(user_agent) AS user_agent - values(vendor_region) AS vendor_region - by user vendor_account - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `aws_repeated_cloudwatch_logs_read_operations_filter` + `cloudtrail` eventSource="logs.amazonaws.com" + eventName IN ( + "DescribeLogGroups", + "DescribeLogStreams", + "DownloadLogEvents", + "FilterLogEvents", + "GetLogEvents", + "GetQueryResults" + ) + | eval user='userIdentity.principalId' + | eval vendor_account=coalesce( + vendor_account, + recipientAccountId, + 'userIdentity.accountId' + ) + | eval role_name='userIdentity.sessionContext.sessionIssuer.userName' + | eval signature=coalesce(signature, eventName) + | eval src=coalesce(src, sourceIPAddress) + | eval user_agent=coalesce(user_agent, userAgent) + | eval vendor_region=coalesce(vendor_region, awsRegion) + | where isnotnull(user) AND len(trim(user)) > 0 + | dedup eventID keepempty=true + | sort 0 _time + | streamstats time_window=5m count AS event_count + by user vendor_account + | where event_count > 500 + | stats + max(event_count) AS event_count + min(_time) AS firstTime + max(_time) AS lastTime + values(signature) AS api_operations + values(role_name) AS role_name + values(src) AS src + values(user_agent) AS user_agent + values(vendor_region) AS vendor_region + by user vendor_account + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `aws_repeated_cloudwatch_logs_read_operations_filter` how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. known_false_positives: >- - Automated log analytics, SIEM pipelines, incident-response tooling, backup - processes, and administrative troubleshooting may continuously read - CloudWatch Logs and generate a high volume of matching operations. The - prevalence of this activity has not yet been evaluated against broader - customer telemetry. Review the principal, account, source addresses, user - agents, Regions, and accessed CloudWatch Logs resources before escalating. + Automated log analytics, SIEM pipelines, incident-response tooling, backup + processes, and administrative troubleshooting may continuously read + CloudWatch Logs and generate a high volume of matching operations. The + prevalence of this activity has not yet been evaluated against broader + customer telemetry. Review the principal, account, source addresses, user + agents, Regions, and accessed CloudWatch Logs resources before escalating. references: - - https://attack.mitre.org/techniques/T1530/ - - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html - - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html - - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html - - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html - - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html + - https://attack.mitre.org/techniques/T1530/ + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html + - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetQueryResults.html drilldown_searches: - - name: View CloudWatch Logs read operations for - "$user$" - search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ - - name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: 7d - latest_offset: "0" + - name: View CloudWatch Logs read operations for - "$user$" + search: '%original_detection_search% | search user="$user$" vendor_account="$vendor_account$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ + - name: View risk events for the last 7 days for - "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: 7d + latest_offset: "0" finding: - title: AWS principal $user$ performed $event_count$ CloudWatch Logs read operations - entity: - field: user - type: user - score: 50 + title: AWS principal $user$ performed $event_count$ CloudWatch Logs read operations + entity: + field: user + type: user + score: 50 threat_objects: - - field: src - type: ip_address + - field: src + type: ip_address analytic_story: - - Data Exfiltration + - Data Exfiltration asset_type: AWS Account mitre_attack_id: - - T1530 + - T1530 product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud category: cloud security_domain: threat tests: - - name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json - sourcetype: aws:cloudtrail - source: aws_cloudtrail - test_type: unit + - name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_cloudwatch_logs_high_volume_retrieval/aws_cloudwatch_logs_high_volume_retrieval.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + test_type: unit From 057568977790457f2c60e1b99058c64b3378dc09 Mon Sep 17 00:00:00 2001 From: nasbench <8741929+nasbench@users.noreply.github.com> Date: Mon, 19 Oct 2026 00:58:27 +0200 Subject: [PATCH 6/6] Update aws_repeated_cloudwatch_logs_read_operations.yml --- ...peated_cloudwatch_logs_read_operations.yml | 57 ++++++++++--------- 1 file changed, 30 insertions(+), 27 deletions(-) diff --git a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml index 10b81a6ce03..8ae7fe7b907 100644 --- a/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml +++ b/detections/cloud/aws_repeated_cloudwatch_logs_read_operations.yml @@ -6,18 +6,16 @@ modification_date: '2026-09-21' author: Maria Jose Erquiaga, Splunk status: production type: TTP -description: >- - The following analytic detects a high volume of Amazon CloudWatch Logs read - operations performed by the same AWS principal and account within a - five-minute period. It identifies more than 500 DescribeLogGroups, - DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or - GetQueryResults API calls. This activity may indicate automated discovery or - collection of operational, application, or security telemetry from - CloudWatch Logs. +description: |- + The following analytic detects a high volume of Amazon CloudWatch Logs read operations performed by the same AWS principal and account within a + five-minute period. + It identifies more than 500 DescribeLogGroups, DescribeLogStreams, DownloadLogEvents, FilterLogEvents, GetLogEvents, or GetQueryResults API calls. + This activity may indicate automated discovery or collection of operational, application, or security telemetry from CloudWatch Logs. data_source: - AWS CloudTrail search: |- - `cloudtrail` eventSource="logs.amazonaws.com" + `cloudtrail` + eventSource="logs.amazonaws.com" eventName IN ( "DescribeLogGroups", "DescribeLogStreams", @@ -26,6 +24,7 @@ search: |- "GetLogEvents", "GetQueryResults" ) + | eval user='userIdentity.principalId' | eval vendor_account=coalesce( vendor_account, @@ -37,33 +36,37 @@ search: |- | eval src=coalesce(src, sourceIPAddress) | eval user_agent=coalesce(user_agent, userAgent) | eval vendor_region=coalesce(vendor_region, awsRegion) + | where isnotnull(user) AND len(trim(user)) > 0 + | dedup eventID keepempty=true + | sort 0 _time + | streamstats time_window=5m count AS event_count by user vendor_account + | where event_count > 500 - | stats - max(event_count) AS event_count - min(_time) AS firstTime - max(_time) AS lastTime - values(signature) AS api_operations - values(role_name) AS role_name - values(src) AS src - values(user_agent) AS user_agent - values(vendor_region) AS vendor_region - by user vendor_account + + | stats max(_time) AS lastTime + max(event_count) AS event_count + min(_time) AS firstTime + values(role_name) AS role_name + values(signature) AS api_operations + values(src) AS src + values(user_agent) AS user_agent + values(vendor_region) AS vendor_region + by user vendor_account + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_repeated_cloudwatch_logs_read_operations_filter` how_to_implement: You must install Splunk AWS Add on and enable CloudTrail logs in your AWS Environment. -known_false_positives: >- - Automated log analytics, SIEM pipelines, incident-response tooling, backup - processes, and administrative troubleshooting may continuously read - CloudWatch Logs and generate a high volume of matching operations. The - prevalence of this activity has not yet been evaluated against broader - customer telemetry. Review the principal, account, source addresses, user - agents, Regions, and accessed CloudWatch Logs resources before escalating. +known_false_positives: |- + Automated log analytics, SIEM pipelines, incident-response tooling, backup processes, and administrative troubleshooting may continuously read + CloudWatch Logs and generate a high volume of matching operations. + The prevalence of this activity has not yet been evaluated against broader customer telemetry. + Review the principal, account, source addresses, user agents, Regions, and accessed CloudWatch Logs resources before escalating. references: - https://attack.mitre.org/techniques/T1530/ - https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html @@ -81,7 +84,7 @@ drilldown_searches: earliest_offset: 7d latest_offset: "0" finding: - title: AWS principal $user$ performed $event_count$ CloudWatch Logs read operations + title: The AWS principal [$user$] performed [$event_count$] CloudWatch Logs read operations entity: field: user type: user