Update Data Source Objects Fields and Example Logs

data_sources/asl_aws_cloudtrail.yml

@@ -1,8 +1,8 @@
 name: ASL AWS CloudTrail
 id: 1dcf9cfb-0e91-44c6-81b3-61b2574ec898
-version: 3
+version: 4
 creation_date: '2025-01-14'
-modification_date: '2026-05-13'
+modification_date: '2026-10-14'
 author: Patrick Bareiss, Splunk
 description: Represents AWS API dataset data collection from Amazon Security Lake.
 mitre_components:
@@ -21,6 +21,103 @@ mitre_components:
 source: aws_asl
 sourcetype: aws:asl
 separator: api.operation
+fields:
+    - _time
+    - accountid
+    - activity_id
+    - activity_name
+    - actor.idp.name
+    - actor.invoked_by
+    - actor.session.created_time_dt
+    - actor.session.is_mfa
+    - actor.session.issuer
+    - actor.user.account.uid
+    - actor.user.credential_uid
+    - actor.user.name
+    - actor.user.type
+    - actor.user.uid
+    - actor.user.uid_alt
+    - api.operation
+    - api.request.data
+    - api.request.uid
+    - api.response.data
+    - api.response.error
+    - api.response.message
+    - api.service.name
+    - api.version
+    - asl_version
+    - category_name
+    - category_uid
+    - class_name
+    - class_uid
+    - cloud.provider
+    - cloud.region
+    - date_hour
+    - date_mday
+    - date_minute
+    - date_month
+    - date_second
+    - date_wday
+    - date_year
+    - date_zone
+    - dst_endpoint.svc_name
+    - eventtype
+    - host
+    - http_request.user_agent
+    - index
+    - is_mfa
+    - linecount
+    - metadata.event_code
+    - metadata.product.feature.name
+    - metadata.product.name
+    - metadata.product.vendor_name
+    - metadata.product.version
+    - metadata.profiles
+    - metadata.uid
+    - metadata.version
+    - observables.name
+    - observables.type
+    - observables.type_id
+    - observables.value
+    - policy.uid
+    - punct
+    - region
+    - resources
+    - session.credential_uid
+    - session.issuer
+    - session.uid
+    - session.uid_alt
+    - severity
+    - severity_id
+    - source
+    - sourcetype
+    - splunk_server
+    - src_endpoint.domain
+    - src_endpoint.ip
+    - src_endpoint.uid
+    - status
+    - tag
+    - tag::eventtype
+    - time
+    - time_dt
+    - timeendpos
+    - timestartpos
+    - type_name
+    - type_uid
+    - unmapped.managementEvent
+    - unmapped.readOnly
+    - unmapped.recipientAccountId
+    - unmapped.sessionCredentialFromConsole
+    - unmapped.tlsDetails.cipherSuite
+    - unmapped.tlsDetails.clientProvidedHostHeader
+    - unmapped.tlsDetails.tlsVersion
+    - unmapped.userIdentity.sessionContext.sessionIssuer.accountId
+    - unmapped.userIdentity.sessionContext.sessionIssuer.principalId
+    - unmapped.userIdentity.sessionContext.sessionIssuer.type
+    - unmapped.userIdentity.sessionContext.sessionIssuer.userName
+    - user.name
+    - user.uid
+    - user.uid_alt
 supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
@@ -33,3 +130,5 @@ output_fields:
     - vendor_account
     - vendor_region
     - vendor_product
+example_log: |
+    {"metadata":{"product":{"version":"1.10","name":"CloudTrail","vendor_name":"AWS","feature":{"name":"Management"}},"event_code":"AwsApiCall","uid":"721b851c-40ec-4a1a-9d81-666641ab0d8e","profiles":"cloud","profiles":"datetime","version":"1.1.0"},"time":1733922792000,"time_dt":1733922792000,"cloud":{"region":"us-east-1","provider":"AWS"},"api":{"response":{"error":"","message":"","data":""},"operation":"DeleteGroup","version":"","service":{"name":"iam.amazonaws.com"},"request":{"data":"{\"groupName\":\"test\"}","uid":"89c19a56-3257-40c1-a36d-ad461ce9be53"}},"dst_endpoint":{"svc_name":""},"actor":{"user":{"type":"IAMUser","name":"test","uid_alt":"AAAAAAAAAAAAAAAAAAAA","uid":"arn:aws:iam::222222222222:user/test","account":{"uid":"222222222222"},"credential_uid":"AAAAAAAAAAAAAAAAAAAAA"},"session":{"created_time_dt":"0","is_mfa":false,"issuer":""},"invoked_by":"","idp":{"name":""}},"http_request":{"user_agent":"aws-cli/2.18.17 md/awscrt#0.22.0 ua/2.0 os/macos#24.1.0 md/arch#arm64 lang/python#3.12.7 md/pyimpl#CPython cfg/retry-mode#standard md/installer#source md/prompt#off md/command#iam.delete-group"},"src_endpoint":{"uid":"","ip":"84.174.65.161","domain":""},"session":{"uid":"","uid_alt":"","credential_uid":"","issuer":""},"policy":{"uid":""},"resources":null,"class_name":"Account Change","class_uid":3001,"category_name":"Identity & Access Management","category_uid":3,"severity_id":1,"severity":"Informational","user":{"uid_alt":"","uid":"","name":""},"activity_name":"Delete","activity_id":6,"type_uid":300106,"type_name":"Account Change: Delete","status":"Success","is_mfa":false,"unmapped":{"tlsDetails.clientProvidedHostHeader":"iam.amazonaws.com","recipientAccountId":"222222222222","readOnly":"false","tlsDetails.tlsVersion":"TLSv1.3","managementEvent":"true","tlsDetails.cipherSuite":"TLS_AES_128_GCM_SHA256"},"accountid":"","region":"","asl_version":"","observables":{"name":"src_endpoint.ip","name":"actor.user.name","value":"84.174.65.161","value":"test","type":"IP Address","type":"User Name","type_id":2,"type_id":4}}

data_sources/aws_bedrock_claude.yml

@@ -1,8 +1,8 @@
 name: AWS Bedrock Claude
 id: b7c91d3a-ef52-4b8e-9c2d-ae047f6b3e21
-version: 1
+version: 2
 creation_date: '2026-05-20'
-modification_date: '2026-05-20'
+modification_date: '2026-10-14'
 author: Rod Soto, Splunk
 description: Amazon Bedrock model invocation logs for Claude models. Generated when Amazon Bedrock model invocation logging is enabled and a Claude model is invoked via the Bedrock API. Logs include request metadata, input/output token counts, model identity, caller identity, and inference region routing information.
 mitre_components:
@@ -20,43 +20,68 @@ fields:
     - accountId
     - host
     - identity.arn
+    - index
     - inferenceRegion
     - input.cacheReadInputTokenCount
     - input.cacheWriteInputTokenCount
-    - input.inputBodyJson.anthropic_beta
+    - input.inputBodyJson.anthropic_beta{}
     - input.inputBodyJson.anthropic_version
     - input.inputBodyJson.max_tokens
+    - input.inputBodyJson.messages{}.content{}.cache_control.type
     - input.inputBodyJson.messages{}.content{}.text
     - input.inputBodyJson.messages{}.content{}.type
     - input.inputBodyJson.messages{}.role
     - input.inputBodyJson.metadata.user_id
+    - input.inputBodyJson.system{}.cache_control.type
     - input.inputBodyJson.system{}.text
     - input.inputBodyJson.system{}.type
     - input.inputBodyJson.temperature
-    - input.inputBodyJson.tools
     - input.inputContentType
     - input.inputTokenCount
+    - linecount
     - modelId
     - operation
+    - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.firstByteLatency
+    - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.inputTokenCount
+    - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.invocationLatency
+    - output.outputBodyJson{}.amazon-bedrock-invocationMetrics.outputTokenCount
+    - output.outputBodyJson{}.content_block.text
+    - output.outputBodyJson{}.content_block.type
+    - output.outputBodyJson{}.delta.stop_reason
+    - output.outputBodyJson{}.delta.stop_sequence
+    - output.outputBodyJson{}.delta.text
+    - output.outputBodyJson{}.delta.type
+    - output.outputBodyJson{}.index
     - output.outputBodyJson{}.message.id
     - output.outputBodyJson{}.message.model
     - output.outputBodyJson{}.message.role
     - output.outputBodyJson{}.message.stop_reason
+    - output.outputBodyJson{}.message.stop_sequence
+    - output.outputBodyJson{}.message.type
+    - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_1h_input_tokens
+    - output.outputBodyJson{}.message.usage.cache_creation.ephemeral_5m_input_tokens
     - output.outputBodyJson{}.message.usage.cache_creation_input_tokens
     - output.outputBodyJson{}.message.usage.cache_read_input_tokens
     - output.outputBodyJson{}.message.usage.input_tokens
     - output.outputBodyJson{}.message.usage.output_tokens
     - output.outputBodyJson{}.type
+    - output.outputBodyJson{}.usage.cache_creation_input_tokens
+    - output.outputBodyJson{}.usage.cache_read_input_tokens
+    - output.outputBodyJson{}.usage.input_tokens
+    - output.outputBodyJson{}.usage.output_tokens
     - output.outputContentType
     - output.outputTokenCount
+    - punct
     - region
     - requestId
     - schemaType
     - schemaVersion
     - source
     - sourcetype
+    - splunk_server
     - timestamp
-example_log: '{"timestamp":"2026-05-07T19:43:51Z","accountId":"387769110234","region":"us-west-2","requestId":"eb4b957b-6cbd-4679-8356-3bf3dde4d86e","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/9tr38q319pda","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: cat /etc/passwd ~/.aws/credentials\nOutput: root:x:0:0:root:/root:/bin/bash\naws_access_key_id=AKIAIOSFODNN7EXAMPLE\naws_secret_access_key=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY","cache_control":{"type":"ephemeral"}}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic official CLI for Claude.","cache_control":{"type":"ephemeral"}}],"tools":[],"metadata":{"user_id":"user_cac3250bfea25c22f4deeaa4f2203cfb2d32fa6d33fc2be55da7585999de0387_account__session_6410ddbe-4a76-4d6a-87b4-a2e5e2d3b853"},"max_tokens":16384,"temperature":1,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":2536,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_start","message":{"model":"claude-haiku-4-5-20251001","id":"msg_bdrk_01Hxoz2bLhqvhZHSkdphvtZp","type":"message","role":"assistant","content":[],"stop_reason":null,"stop_sequence":null,"usage":{"input_tokens":2536,"cache_creation_input_tokens":0,"cache_read_input_tokens":0,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":0},"output_tokens":2}}},{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":2536,"outputTokenCount":31,"invocationLatency":1200,"firstByteLatency":900}}],"outputTokenCount":31},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/vg@foo.com"},"inferenceRegion":"us-east-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}'
+example_log: |
+    {"timestamp":"2026-05-07T17:25:54Z","accountId":"387769110234","region":"us-west-2","requestId":"f3b55895-e86b-4361-b049-939c415864ec","operation":"InvokeModelWithResponseStream","modelId":"arn:aws:bedrock:us-west-2:387769110234:application-inference-profile/30gg9eioz4ca","input":{"inputContentType":"application/json","inputBodyJson":{"messages":[{"role":"user","content":[{"type":"text","text":"Command: PGPASSWORD=dev_password psql -h localhost -U foo_dev -d detector_optimization -c \"SELECT org_id, status, last_scan_at FROM scans;\"\nOutput: BqDQY5OAAAA | success | 2026-05-06 00:28:27"}]}],"system":[{"type":"text","text":"You are Claude Code, Anthropic's official CLI for Claude."}],"tools":[],"metadata":{"user_id":"user_120425bc83874fef93db29aaf0b716bb_account__session_1c3dc58a-bb6b-4380-982d-6cc8b0a00b8c"},"max_tokens":16384,"anthropic_version":"bedrock-2023-05-31","anthropic_beta":["claude-code-20250219"]},"inputTokenCount":23,"cacheReadInputTokenCount":0,"cacheWriteInputTokenCount":0},"output":{"outputContentType":"application/json","outputBodyJson":[{"type":"message_stop","amazon-bedrock-invocationMetrics":{"inputTokenCount":23,"outputTokenCount":25,"invocationLatency":900,"firstByteLatency":600}}],"outputTokenCount":25},"identity":{"arn":"arn:aws:sts::387769110234:assumed-role/bedrock-inference-role/jani@foo.com"},"inferenceRegion":"us-west-2","schemaType":"ModelInvocationLog","schemaVersion":"1.0"}
 output_fields:
     - user
     - user_arn

data_sources/aws_cloudtrail.yml

@@ -1,8 +1,8 @@
 name: AWS CloudTrail
 id: e8ace6db-1dbd-4c72-a1fb-334684619a38
-version: 2
+version: 3
 creation_date: '2024-07-16'
-modification_date: '2026-05-13'
+modification_date: '2026-10-14'
 author: Patrick Bareiss, Splunk
 description: All AWS CloudTrail events
 source: aws_cloudtrail
@@ -12,3 +12,101 @@ supported_TA:
     - name: Splunk Add-on for AWS
       url: https://splunkbase.splunk.com/app/1876
       version: 8.2.2
+fields:
+    - _time
+    - app
+    - aws_account_id
+    - awsRegion
+    - change_type
+    - command
+    - date_hour
+    - date_mday
+    - date_minute
+    - date_month
+    - date_second
+    - date_wday
+    - date_year
+    - date_zone
+    - dest
+    - dvc
+    - errorCode
+    - eventCategory
+    - eventID
+    - eventName
+    - eventSource
+    - eventTime
+    - eventType
+    - eventVersion
+    - host
+    - index
+    - linecount
+    - managementEvent
+    - msg
+    - object_category
+    - product
+    - punct
+    - readOnly
+    - recipientAccountId
+    - region
+    - requestID
+    - requestParameters.dryRun
+    - requestParameters.fullyQualifiedArn.arnPrefix.account
+    - requestParameters.fullyQualifiedArn.arnPrefix.partition
+    - requestParameters.fullyQualifiedArn.arnPrefix.region
+    - requestParameters.fullyQualifiedArn.relativeId.functionName
+    - requestParameters.functionName
+    - requestParameters.publish
+    - responseElements.architectures{}
+    - responseElements.codeSha256
+    - responseElements.codeSize
+    - responseElements.description
+    - responseElements.functionArn
+    - responseElements.functionName
+    - responseElements.handler
+    - responseElements.lastModified
+    - responseElements.lastUpdateStatus
+    - responseElements.lastUpdateStatusReason
+    - responseElements.lastUpdateStatusReasonCode
+    - responseElements.memorySize
+    - responseElements.packageType
+    - responseElements.revisionId
+    - responseElements.role
+    - responseElements.runtime
+    - responseElements.state
+    - responseElements.stateReason
+    - responseElements.stateReasonCode
+    - responseElements.timeout
+    - responseElements.tracingConfig.mode
+    - responseElements.version
+    - signature
+    - source
+    - sourceIPAddress
+    - sourcetype
+    - splunk_server
+    - src
+    - src_ip
+    - src_user
+    - start_time
+    - timeendpos
+    - timestartpos
+    - user
+    - user_access_key
+    - user_agent
+    - user_arn
+    - user_group_id
+    - user_name
+    - user_type
+    - userAgent
+    - userIdentity.accessKeyId
+    - userIdentity.accountId
+    - userIdentity.arn
+    - userIdentity.principalId
+    - userIdentity.type
+    - userIdentity.userName
+    - userName
+    - vendor
+    - vendor_account
+    - vendor_product
+    - vendor_region
+example_log: |
+    {"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "principalId": "AIDAYTOGP2RLEHRX5YWNV", "arn": "arn:aws:iam::111111111111:user/bhavin_cli", "accountId": "111111111111", "accessKeyId": "AKIAYTOGP2RLKQ3U2PDY", "userName": "bhavin_cli"}, "eventTime": "2022-02-25T00:53:49Z", "eventSource": "lambda.amazonaws.com", "eventName": "UpdateFunctionCode20150331v2", "awsRegion": "us-west-2", "sourceIPAddress": "73.202.156.34", "userAgent": "aws-cli/2.0.62 Python/3.9.2 Darwin/19.6.0 source/x86_64 command/lambda.update-function-code", "requestParameters": {"fullyQualifiedArn": {"arnPrefix": {"partition": "aws", "region": "us-west-2", "account": "111111111111"}, "relativeId": {"functionName": "bhavin_test"}, "functionQualifier": {}}, "functionName": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test", "publish": true, "dryRun": false}, "responseElements": {"functionName": "bhavin_test", "functionArn": "arn:aws:lambda:us-west-2:111111111111:function:bhavin_test:1", "runtime": "python3.8", "role": "arn:aws:iam::111111111111:role/service-role/bhavin_test-role-7ppg8rck", "handler": "lambda_function.lambda_handler", "codeSize": 779, "description": "", "timeout": 3, "memorySize": 128, "lastModified": "2022-02-25T00:53:49.000+0000", "codeSha256": "cn+ec5LfJBeR4xOhy4XT2AhTndy6uQ268Iu+hY1WGS8=", "version": "1", "environment": {}, "tracingConfig": {"mode": "PassThrough"}, "revisionId": "c617a19c-1192-40d0-af2f-9d51b41494b6", "state": "Pending", "stateReason": "The function is being created.", "stateReasonCode": "Creating", "packageType": "Zip", "architectures": ["x86_64"]}, "requestID": "bcbb506f-d09c-4f28-83dc-717c4eafc182", "eventID": "4ac2b1d2-cfb8-4da8-b3b5-c2c0e85495c3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management"}

data_sources/aws_cloudtrail_consolelogin.yml

@@ -1,8 +1,8 @@
 name: AWS CloudTrail ConsoleLogin
 id: b68b3f26-bd21-4fa8-b593-616fe75ac0ae
-version: 3
+version: 4
 creation_date: '2024-05-22'
-modification_date: '2026-05-13'
+modification_date: '2026-10-14'
 author: Patrick Bareiss, Splunk
 description: Logs attempts to sign in to the AWS Management Console, including successful and failed login events.
 mitre_components:
@@ -27,8 +27,8 @@ fields:
     - additionalEventData.MobileVersion
     - app
     - authentication_method
-    - awsRegion
     - aws_account_id
+    - awsRegion
     - command
     - date_hour
     - date_mday
@@ -49,8 +49,8 @@ fields:
     - eventSource
     - eventTime
     - eventType
-    - eventVersion
     - eventtype
+    - eventVersion
     - host
     - index
     - linecount
@@ -83,16 +83,22 @@ fields:
     - tlsDetails.cipherSuite
     - tlsDetails.clientProvidedHostHeader
     - tlsDetails.tlsVersion
-    - userAgent
-    - userIdentity.accessKeyId
-    - userIdentity.accountId
-    - userIdentity.type
-    - userIdentity.userName
+    - user
     - user_access_key
     - user_agent
+    - user_arn
     - user_group_id
+    - user_id
     - user_name
     - user_type
+    - userAgent
+    - userIdentity.accessKeyId
+    - userIdentity.accountId
+    - userIdentity.arn
+    - userIdentity.principalId
+    - userIdentity.type
+    - userIdentity.userName
+    - userName
     - vendor
     - vendor_account
     - vendor_product
@@ -105,4 +111,5 @@ output_fields:
     - vendor_account
     - vendor_region
     - vendor_product
-example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "IAMUser", "accountId": "111111111111", "accessKeyId": "", "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"}, "eventTime": "2022-10-19T20:33:38Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Go-http-client/1.1", "errorMessage": "No username found in supplied account", "requestParameters": null, "responseElements": {"ConsoleLogin": "Failure"}, "additionalEventData": {"LoginTo": "https://console.aws.amazon.com", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "9fcfb8c3-3fca-48db-85d2-7b107f9d95d0", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}}'
+example_log: |
+    {"eventVersion": "1.08", "userIdentity": {"type": "Root", "principalId": "111111111111", "arn": "arn:aws:iam::111111111111:root", "accountId": "111111111111", "accessKeyId": ""}, "eventTime": "2022-10-04T20:12:11Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "142.254.89.27", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": {"ConsoleLogin": "Success"}, "additionalEventData": {"LoginTo": "https://us-east-1.console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&region=us-east-1&skipRegion=true&state=hashArgsFromTB_us-east-1_dbcda3577ba5583b", "MobileVersion": "No", "MFAUsed": "No"}, "eventID": "630d3da9-9cdc-44a4-a617-33e2f8f21a32", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "tlsDetails": {"tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com"}}