Task: attack_reconstruction (flaws_cloudtrail)
Prompt: One principal appears to gain a foothold and then conduct a broad AWS inventory sweep spanning IAM, EC2/VPC, S3, Lambda, and RDS. Identify the responsible principal, the MITRE ATT&CK technique that best describes the behavior, the supporting CloudTrail record_ids grouped by each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e688966-ea12-48d2-af82-8f301655cd83", "record_id": "flaws_cloudtrail:0000000:9e688966-ea12-48d2-af82-8f301655cd83", "row_index": 0, "timestamp": "2018-02-24T11:20:12Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e688966-ea12-48d2-af82-8f301655cd83", "eventTime": "2018-02-24T11:20:12Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c4ea0a7-b958-4663-9ae7-dbbf490449ed", "record_id": "flaws_cloudtrail:0000001:4c4ea0a7-b958-4663-9ae7-dbbf490449ed", "row_index": 1, "timestamp": "2018-02-24T11:20:22Z", "event_type": "DescribeSubnets", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c4ea0a7-b958-4663-9ae7-dbbf490449ed", "eventTime": "2018-02-24T11:20:22Z", "eventName": "DescribeSubnets", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"subnetSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a76e9a98-4b31-426e-8532-2c1186dd9f80", "record_id": "flaws_cloudtrail:0000002:a76e9a98-4b31-426e-8532-2c1186dd9f80", "row_index": 2, "timestamp": "2018-02-24T11:20:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a76e9a98-4b31-426e-8532-2c1186dd9f80", "eventTime": "2018-02-24T11:20:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWbmJxNjJnQ1c5TDUrOUFKWnVZTXBBVXRkRTUzTlBVOVJuNjJaOHRSd2xwRXBXQ1NDT2ZtSWhJMXlqRnJQZmZGUFQ0bWowVUFrUGJpQzZSOEpFY0hwWE9sU3hRWmN3Z2s1cU5GNG5ZLzM0WDA3eVJFRXg5aHZhZFh5QjZtYzMremJsdWZrbHJMSEo5Vzg2VGJOTlB5MjV1U010eDJySENvaWlFekVGVnoxbHhNbXpoWGduN2piNkZxTmdjOSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb220844e-af95-4129-8d16-e181277b95eff", "record_id": "flaws_cloudtrail:0000003:fb220844e-af95-4129-8d16-e181277b95eff", "row_index": 3, "timestamp": "2018-02-24T11:20:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb220844e-af95-4129-8d16-e181277b95eff", "eventTime": "2018-02-24T11:20:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvK2RNcis0NEJoNVRSVEhySTkrZjNnRmEzYnV0R1FKdTJHLzd3cGppaTlyTkU5R3IrNW1JU1BJV081dGFSblExNGk5dXhvSytrekRLR0NPMnJHV0l2Wm5FWmh0RDhwL0Y3bW1kTmFqUURUSXBPT2s5VUVCdkpRQnRCcVBUL21xUysxTVF2OE5HT28rczZsUHJmRU1JK3EzdVJkQ1JnK3BiWE1aSWxuUHZDdVhwaSsvelQ0cmptSGpqQ0JRbHBYaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f9471be4-a5e9-4a3b-bc19-4e5a3d58452", "record_id": "flaws_cloudtrail:0000004:f9471be4-a5e9-4a3b-bc19-4e5a3d58452", "row_index": 4, "timestamp": "2018-02-24T11:20:25Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f9471be4-a5e9-4a3b-bc19-4e5a3d58452", "eventTime": "2018-02-24T11:20:25Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aba67d0d-39a7-457e-8886-2162f220f60d", "record_id": "flaws_cloudtrail:0000005:aba67d0d-39a7-457e-8886-2162f220f60d", "row_index": 5, "timestamp": "2018-02-24T11:20:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aba67d0d-39a7-457e-8886-2162f220f60d", "eventTime": "2018-02-24T11:20:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce5abb04-244c-4c88-83a6-4c8df2c0516f", "record_id": "flaws_cloudtrail:0000006:ce5abb04-244c-4c88-83a6-4c8df2c0516f", "row_index": 6, "timestamp": "2018-02-24T11:20:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce5abb04-244c-4c88-83a6-4c8df2c0516f", "eventTime": "2018-02-24T11:20:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvNGgxa0dlaFg0MkZxQ0pUOVRKU2xEM25WRXdXclVKZEhNL0lmdmRxNVpCcmMwVUFySWowbEFqNm9nSjNiQ1hZMks3eGNhWUFOMEVVOGJKWkEvOW5IbWh2eXllNFdhaU1NTzV4c2dWQVltd0JVc0liQk95Y0lBeGVRbjFpMFFyREJqWlVIZ3Y4U1BzZ3I0R255TW9lSkwyU1dMamZxbUkzYWxHL3RFZ1A5aktVTk5pMzcxRVlTd3BlRkVZWGU2MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "64d216487-ecb7-4f62-a7bf-c3d3586d987b", "record_id": "flaws_cloudtrail:0000007:64d216487-ecb7-4f62-a7bf-c3d3586d987b", "row_index": 7, "timestamp": "2018-02-24T11:20:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "64d216487-ecb7-4f62-a7bf-c3d3586d987b", "eventTime": "2018-02-24T11:20:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxWkVYaUFoOGl5dHhOc1M3Y0ZBVHZObmpCcE5VQlY3U1Nvd0RPWXJsMEtOOWZRVXNrNS8rU3lqQm11b2liL0lNUXdKbFNCMGo2aW5LWGhZaGdDT3pSOHE0bTcwc0d0WFB6RStmV1dtb053dHpSa3VNU1lmWjMyUGh3UHpRQTUvcHhiamVHNDRJUjkvUTNOR3JvMHFiWnpMVDBOSGs1bnRKR29yWFQvMkRBaEpVeGEvcENOdjJmejRsU2pIYzhxMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9752afd5-744f-4694-9bd3-859e60ba3338", "record_id": "flaws_cloudtrail:0000008:9752afd5-744f-4694-9bd3-859e60ba3338", "row_index": 8, "timestamp": "2018-02-24T11:20:42Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9752afd5-744f-4694-9bd3-859e60ba3338", "eventTime": "2018-02-24T11:20:42Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28d18539-bfe3-4f8d-991c-430a39f58736", "record_id": "flaws_cloudtrail:0000009:28d18539-bfe3-4f8d-991c-430a39f58736", "row_index": 9, "timestamp": "2018-02-24T11:20:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28d18539-bfe3-4f8d-991c-430a39f58736", "eventTime": "2018-02-24T11:20:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVdWJUODJsMlBlaEtUWU5XOU9uVEFaV2k3Q04zMXMxc21KdlhMczF1SjRieFJoVzYzT1FKQlhCVmxBNDkrbEpURXBxTzVHbWc2UDdtd3NUTTYzZGg0b2FPa2M5OWd1ZDFhU09ZdE8wRnZRRDJONCtvUmI5OFh4eFk0WjRtVG1MWEZDaEhudFE0KzRjTFZOeHJiZktjeVhOKzdsS25FT2hZOEJubEFoWmdoWkdVR0loeUpvMkZnRDRiRmNUUiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc34a811-c215-4d62-9c45-3d2dfe5b4131", "record_id": "flaws_cloudtrail:0000010:bc34a811-c215-4d62-9c45-3d2dfe5b4131", "row_index": 10, "timestamp": "2018-02-24T11:20:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc34a811-c215-4d62-9c45-3d2dfe5b4131", "eventTime": "2018-02-24T11:20:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYRUhPUGtUSnRkbURScmJUaXJiMVh4WTNJRDlIWElrK2VadTFsSTdvamhzTFRreTVEVFhiSnRuQjgrM2ViOExxeEZUdU9WNUFNZzZ6UEFPNWwvaEM4Nnk1UGhCQmUwTUljR1Vzd3N1Z0t6dUJyR2w2YzRwb0pFTVF6MWQ5QnQyS0VKaXhRWFAxY2lkY3FFaWxTZWlFVmJBOElveThSY3hQK3U5TVZBSGVVaGZxc3d4d1ZFeTA2b2tERTBXSSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49ba5fbb-d759-4850-a085-29a8a939798d", "record_id": "flaws_cloudtrail:0000011:49ba5fbb-d759-4850-a085-29a8a939798d", "row_index": 11, "timestamp": "2018-02-24T11:20:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49ba5fbb-d759-4850-a085-29a8a939798d", "eventTime": "2018-02-24T11:20:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBRC9WQXFGQ0FBbmhpS0FBM1hFeDJ4R29ZRWg0aUNnRWh2TS9FYUVwcnpNRFpPMTZ3eGlPY1FENXJ2VTA4blY5MGN1Z2tWVmQ5a3puaWZXMUNQVDliWGpXdzZuODZ0dTdHallpZTBrZEZzQmdsNnhMckszRWZQY2hJM1FNdFZRZ1ArWjRqaG00UUlhQVZVOEpWWXEzcHpvU3RNNjVpZU5jSi9nN0dlK1JUQlgwYnpBTE01SW14TUY0aFUrbHFaST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b9c16a9-f7e7-43f1-a0dd-fb4042242dba", "record_id": "flaws_cloudtrail:0000012:9b9c16a9-f7e7-43f1-a0dd-fb4042242dba", "row_index": 12, "timestamp": "2018-02-24T11:20:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b9c16a9-f7e7-43f1-a0dd-fb4042242dba", "eventTime": "2018-02-24T11:20:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDRHN6YnE1bU54NjViRHY0NjV2cGFxY1czeldjR01RZlRUTlF1WWFqaXhJc1VlMmUyUnYwYVg1WFlkaWYrcGlKM3d0YlB2RExzSHNzVFRDclh3TmNzcVRnRzRBYmxQVUpQa1ZRUFRiQjlKZlpMai81Q2ZuQ2pGRWQ1V202M0hTaStyeVJOY01RMU81Zi9TbnFUNk5IMkZtc3BuU0lzeXBCWG5IcWJWc2F0ckFYc2NCTGZNRlQ5TkxQWSsrVVZOYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fb805c6-2541-410a-85d0-7e191de6fc16", "record_id": "flaws_cloudtrail:0000013:0fb805c6-2541-410a-85d0-7e191de6fc16", "row_index": 13, "timestamp": "2018-02-24T11:20:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fb805c6-2541-410a-85d0-7e191de6fc16", "eventTime": "2018-02-24T11:20:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5V0hvL0hUeGdDMEdUa3lNNFViNEZpUEduRDBuUUdNVXZORlEvZ050dEh1TWdBem9tbGQvNzdlc0FaVjVFb0F2RFhRNEtwNGZEVVJmdTk0eko1Q2ZOekpOSlBvM3JPOEZaVVR6YnI3a3NndmhsWkxIMkJLL0R0UDMwSWRaS0RrMkZBZ1diaGhvNkRtNkNjcytSYkI3NVBKVFcwNGhmS3kzRlVtTzljK2Z6d0VPdnZuU1dJOUN5YVQxTER1ZExCbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "031b8db1-1769-40c5-b2ab-20467d8c0d2c", "record_id": "flaws_cloudtrail:0000014:031b8db1-1769-40c5-b2ab-20467d8c0d2c", "row_index": 14, "timestamp": "2018-02-24T11:20:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "031b8db1-1769-40c5-b2ab-20467d8c0d2c", "eventTime": "2018-02-24T11:20:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQL1dYOEFWN1JEQVVGaHNiWFNreGY2SlFQNGNPdHJNbFIyZkpKcEczeFZQRHovaGhoUUx6M29DaE9Ic0o2aVlBSFRJQ2x5UE1Bc2xIQlpvZnhFaysrSy82eDZKVzkwcFFDWGYzbThCcnFleEN4Nk56Z0ZUa0xUTCtTbjVNSWg5R25xV25TcHlMS2FwU0RiSFJad3NZWkdEaGtOaVo4ZUdKdGQ0cTNhUFVCOWZMc1o1L2xyTU5FdEdGRldWMiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61e00945-b809-493a-856b-c95d1216e281", "record_id": "flaws_cloudtrail:0000015:61e00945-b809-493a-856b-c95d1216e281", "row_index": 15, "timestamp": "2018-02-24T11:20:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61e00945-b809-493a-856b-c95d1216e281", "eventTime": "2018-02-24T11:20:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFY3VieTBWTjlaM1lPYVNSWlcvMFVtRzZFSDJPUWZNOEF0N2M0TWtCN1lWaDBPNzZTY3g3QzJHYXlVMWxsNm13RFZnbDZEaGZheWhKZ3pyQmgzS25YaERSWTJEY1k0am51Rmhha2VjaHc3L21UZHlLNFpoWlhaSXVOdjdmRXQvOFYxY0NtT3dsRElXK0drL3NaZ3RSWGc4NGpVQUtPWmRrc1p5OU5Eb3h1dWxHQi8vaFFFcTIwSUxmSHhpMyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab603221-d436-4c10-9c3d-dcec594a7d49", "record_id": "flaws_cloudtrail:0000016:ab603221-d436-4c10-9c3d-dcec594a7d49", "row_index": 16, "timestamp": "2018-02-24T11:20:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab603221-d436-4c10-9c3d-dcec594a7d49", "eventTime": "2018-02-24T11:20:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6WWs1WS9ob2w3dlFFV01TRnFNM2ZkMU10TVViMG43UUpnd0xuQXJZL2JZWTRQMUlkazIzTzczMUFWVXRsRE9lTFhjWUV2d0d3YnRHb0gzOEE1ZFBBSzRwY1hKMWJxQmRKZUEvZzFpZEZETG42RzVuZlhEQUJ4R3Z0U3EzVk03cStFL2pKa2Z3K0lmNGlLTmhFMmQrNzdiMmYrQWdVTGphTWxBSUp5WVltb1NRNFlHeGpjazhNa284c3FZQUFuaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0293d68-68fc-4358-ad55-5c944619b0d37", "record_id": "flaws_cloudtrail:0000017:a0293d68-68fc-4358-ad55-5c944619b0d37", "row_index": 17, "timestamp": "2018-02-24T11:20:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0293d68-68fc-4358-ad55-5c944619b0d37", "eventTime": "2018-02-24T11:20:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlMFNrTmtreE4xQmNKbU5GeGdDeUVrNnl6SDhWVE5HcVlpdkEvQm9zNlZnQktxK2Fhczc0TThGNlRjWVdPbkd5WWd3TC9PQjdSK3l2NzNNazNaZWhxbGdjSVZUdDlRUkdTYzhSRFBESG14VlVhZEg3anpZUTdYWmt0K2tneEJGVWpoc2MxTG9FUXM3VUZCby9BMFZvb29XaDV3NTlkY2xYd1U1Lzl1SkZ2Sm83ODJsdFd4Njk2OUJpQWJTWjdiMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f882195b7-9772-43c0-a9c3-46010e383c21", "record_id": "flaws_cloudtrail:0000018:f882195b7-9772-43c0-a9c3-46010e383c21", "row_index": 18, "timestamp": "2018-02-24T11:20:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f882195b7-9772-43c0-a9c3-46010e383c21", "eventTime": "2018-02-24T11:20:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGcjI0NlZueURTRGoxMXd3RllkWHFuVVRYckgyUUYxU2VRUEpUb0thQjFXT1dmaDdmR3YvblNzNklnYXZXbC8vWjB1SDZHVEd0ZElPVWc2YzczaS96a0ZLOHcxSjJob0I2a014N1E2amRpcWt3N3VVZFFtYnB0RmNyZEtpUkg3VnV2blo4ZURiSnRkOHh4dDNlYUowYk05YThWTURKSGkrbit5SWhsSUV1em50M0l1Y2tzU1E1NG5Ld3lUWCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4b56a33-04f4-4d25-8349-ad6e0b0a00a8", "record_id": "flaws_cloudtrail:0000019:b4b56a33-04f4-4d25-8349-ad6e0b0a00a8", "row_index": 19, "timestamp": "2018-02-24T11:20:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4b56a33-04f4-4d25-8349-ad6e0b0a00a8", "eventTime": "2018-02-24T11:20:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1YWpSTWxwbm45eGxWR0JMd3V5UVlweWtTanM5SWZlVEhCeWdSL3NoaFFuR09FWHB2SlpQa1FQL05xOVZkODJVQmVwTUozS05RcWN4cUV6dHFUSkRZeXFjcFBUNVh3RlJqZE9CM3JObUc0eUJ0WVJvYi9TYnFpa0VCTmIxTjV2bkY2R1B3WGdhNlQ2ckRnNjd2NHVYVUQwMTlLL0g2SXFwTlRlYWw2Vk1FZEpsL0U0VlFkeVRzSlZaWmVKM2lNcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d233fe8-15dd-4450-9284-cff35eda4b07", "record_id": "flaws_cloudtrail:0000020:2d233fe8-15dd-4450-9284-cff35eda4b07", "row_index": 20, "timestamp": "2018-02-24T11:20:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d233fe8-15dd-4450-9284-cff35eda4b07", "eventTime": "2018-02-24T11:20:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2a05PaVBycFhHSERqcXZLdkc0K29sUnVDLzJEMC9UdGZyL25aMVhnVE5sMENrTDVjeUlWaEVsa2pNWVY2b1ErZ1VZMno2Z3VTY1gwdG9RV1BNYVJ3V1dhQm9BVUZ2NWlwK1ZESTFmMVhVZ0c3R0lYU1NjekVrYUp1d0xjMnh4ZGhaVEhlNnRoSU42TzdyOFdmT3d5dG1NL2I3eUFWU3ZST1dNSTlRNVUxUi9RMjVBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75c3dd26-4798-4d19-90b1-f481961fa3f", "record_id": "flaws_cloudtrail:0000021:75c3dd26-4798-4d19-90b1-f481961fa3f", "row_index": 21, "timestamp": "2018-02-24T11:20:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75c3dd26-4798-4d19-90b1-f481961fa3f", "eventTime": "2018-02-24T11:20:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzbmVLU2h0RTNoaVRDbjFGa3EvOHBZTXgrcHcrK2M1REtZREVMTTllZXUwSWpHdFoyVGdUb2tsUnhUanc5bThOZTJpOWtkc1FoQk9aUEJWZXd5VmZIVVY3R3ZOSGFGTzEreUVBYUR2ajQ2UTFqTzBTOEZHRTNHV2RXclZvVlRrMWx0YURldXhudnUrdnRJamt6ekJXZFAzMkJJbUVRT1ZLRGRyY25YNHJHb0Fxc041SDlhalArbXRTL0txSCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a3cbcd0-10a4-456e-9765-d1c6691b4b45", "record_id": "flaws_cloudtrail:0000022:7a3cbcd0-10a4-456e-9765-d1c6691b4b45", "row_index": 22, "timestamp": "2018-02-24T11:20:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a3cbcd0-10a4-456e-9765-d1c6691b4b45", "eventTime": "2018-02-24T11:20:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d1c9a04-a28b-4700-a1ed-30428837561a", "record_id": "flaws_cloudtrail:0000023:6d1c9a04-a28b-4700-a1ed-30428837561a", "row_index": 23, "timestamp": "2018-02-24T11:20:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d1c9a04-a28b-4700-a1ed-30428837561a", "eventTime": "2018-02-24T11:20:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhenVVSkFuMzBkRkptMkd0SlpPYlJzSlJBZWlZVGVlb2FaZXFIczNVSUpLT1hsaDZZUi9oTnZ1MEo2NDlNcHAzZDlTTlA2MlZNemJGVzNvemlTTEptRTN0NzllYTcvdTMvWE9zN2U1aEhFbVVwLyt3a0oveURHUEZZc3BtN1RDUGx4bDYxUGJ5WkNvaWplN2RwZ1RmYmdyVFI4ekVzYWd4THJQRGJnVGFIOTJMVmROSW1pOTZSaEZPN0VnaXZyWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e6954f2-74e2-4535-aefe-255a81e21a18", "record_id": "flaws_cloudtrail:0000024:3e6954f2-74e2-4535-aefe-255a81e21a18", "row_index": 24, "timestamp": "2018-02-24T11:21:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e6954f2-74e2-4535-aefe-255a81e21a18", "eventTime": "2018-02-24T11:21:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZb0lNSkR5T0FIbUZmbkN2NXBTREZDYnQyTnV1akxzWHMrNW1JOHhqZ3B2aFVVdlJYdFFuNjlzT2lhYWxmVURlcjkybEgyZTBMdkdPVGJJWG05UlpXdGJ0ZEUzN0xPQks0K1AweHdFcG9uZ0V2eHBva1FQQzlaaURsdXVBYllONFRPOFV5OG94UlA3aG9FV01IVDQzYmt2dHN3U3hNOVpFaUFSTXNzNVIwNjN2OFBBZjdTSHEraXl4MGdEZSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb9d6bb7-f94e-4c6a-8a69-c0501c4416d3", "record_id": "flaws_cloudtrail:0000025:eb9d6bb7-f94e-4c6a-8a69-c0501c4416d3", "row_index": 25, "timestamp": "2018-02-24T11:21:10Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 676, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb9d6bb7-f94e-4c6a-8a69-c0501c4416d3", "eventTime": "2018-02-24T11:21:10Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7741c65e-da7d-433b-b2ea-7666c46fdb0c", "record_id": "flaws_cloudtrail:0000026:7741c65e-da7d-433b-b2ea-7666c46fdb0c", "row_index": 26, "timestamp": "2018-02-24T11:21:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7741c65e-da7d-433b-b2ea-7666c46fdb0c", "eventTime": "2018-02-24T11:21:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiNCtMRGNieWo4NDI2bVVsNHFGRVNiOW1BRWxXTUE2Z2l4Y0RaSnZMRUVnQXNDMFRiU1NvYlU1VDFFM2tjT0RBREprOFBFTTYvR3p1QkFBTGJHenlYS09lZ0VOR2lvK2pxQzhxWERyRnp6WGVmQzhkNTltdzVKSm5Bc3F5NW1VbXdFNzFKVUVralVjRExFMkNCOEtSYURrQmQ2RFhxZjNoUXJYOTBVYXhsemVxR2hlZnErZUxPUVVhQWlMUnZOcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f078fc76-f433-4cd5-b541-f4c94882a14c", "record_id": "flaws_cloudtrail:0000027:f078fc76-f433-4cd5-b541-f4c94882a14c", "row_index": 27, "timestamp": "2018-02-24T11:21:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f078fc76-f433-4cd5-b541-f4c94882a14c", "eventTime": "2018-02-24T11:21:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJORlBtNEpJUWxhTHkzbkE2Y1RvNFBKOTFldnhRUGtIbm1LMTY5UGhUWnRuVDhZcEgwczEvQjNaYmxOR3JsY1JQeEZ0SDNmTnNtS0hLTmVUTnp4ZitESlh3dytWbTkxckNPenBkWGJDZXdkeS9NbXNPQ3BJV0lWRzB6K2thMzhpa25UN2t0SmV6NnNjRzUrYitqU2p4VVhOdlZPUE1SalZzazkwdFlJbVdjUUZKSWNlRUFNWkdzbEpqeFBLTWE0bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5af5b59d-c806-4be6-bf62-9cebd4c3420f", "record_id": "flaws_cloudtrail:0000028:5af5b59d-c806-4be6-bf62-9cebd4c3420f", "row_index": 28, "timestamp": "2018-02-24T11:21:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5af5b59d-c806-4be6-bf62-9cebd4c3420f", "eventTime": "2018-02-24T11:21:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad9e72b0-5df6-4de7-a955-4cef4ee4fb6e", "record_id": "flaws_cloudtrail:0000029:ad9e72b0-5df6-4de7-a955-4cef4ee4fb6e", "row_index": 29, "timestamp": "2018-02-24T11:21:24Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad9e72b0-5df6-4de7-a955-4cef4ee4fb6e", "eventTime": "2018-02-24T11:21:24Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "458405a7f-5cbb-489d-a06f-0d6bc75d519d", "record_id": "flaws_cloudtrail:0000030:458405a7f-5cbb-489d-a06f-0d6bc75d519d", "row_index": 30, "timestamp": "2018-02-24T11:21:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "458405a7f-5cbb-489d-a06f-0d6bc75d519d", "eventTime": "2018-02-24T11:21:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3cXFRUXFZU3U1SldxSnhUZ1NRZlNzSnExd2JyZUtqSS9RclltVzhteXM0Q3kxelM0bEI5Rkx6R1ZzN0NGdVVMcGwxOTFtSi9NQlNPa2tsYXdhMHJZUm1JMVg0VDZMeWhEc0svMVpOcXhrYnNsMVZtQ0dSNHZzWHBNUVNPUjYzaVNYYW9WOHZydnBWQTZwQ1VOeDVGam9aSVVEWGZrMnQ1eklSc1ZZd3BOdXFIazZtajl3UXIwQmNCVFU1RFZVdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a878703fe-091f-4af9-bfe0-76857c33d883", "record_id": "flaws_cloudtrail:0000031:a878703fe-091f-4af9-bfe0-76857c33d883", "row_index": 31, "timestamp": "2018-02-24T11:21:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a878703fe-091f-4af9-bfe0-76857c33d883", "eventTime": "2018-02-24T11:21:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkTW1BQTZyRVhvZDZyRlVEbUh3SzFTYVppdnBJdjRCaFNaUDZoSG9hQ29LU1AwUExYbWMzeGpPVG90OVF4bEJVN3RmZDNFU1pwZlp2SzIrYXZIWG1lSi9UNnJ6STlic1NXOUdFSHFYbjZSOGFxTFR5NGthdEVuc3pjQ1ZQMVlBUnYzbDJlZjdmYUVOREdjRy9BQi9DNFhraml5SzdnZHNFRG85anU5Y3JoNk1pR2x6c0VTNFYzMGJkdDNObyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b88ead6-1206-4c31-962c-757bfe4582d2", "record_id": "flaws_cloudtrail:0000032:1b88ead6-1206-4c31-962c-757bfe4582d2", "row_index": 32, "timestamp": "2018-02-24T11:21:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b88ead6-1206-4c31-962c-757bfe4582d2", "eventTime": "2018-02-24T11:21:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtWDFIbXZaeCs4MUNuNEVveFp3ckFoZmFqTStRZE9jcmRtSW1MRjAvOTBGSXlQakM2aDdnMjU3cytra0xxQVo5NGVxeGRNSU15cnBTTm83dUUvU3pJWXd4U0ZiQ3VTN3BGbk50ajd5VVp1OTlHSU5tNFZEZUlBMUtTalRwNVNQZm41WEw1R0JRZm1BVUVDVmxEczNoL0lJNGdKa3NLaGdXTEZ4OEZVUzh1SGpHSXA1Rm9nQXMvSDJnd016OCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40a970137-1e47-4f56-a5bf-e1fe53c97ef4", "record_id": "flaws_cloudtrail:0000033:40a970137-1e47-4f56-a5bf-e1fe53c97ef4", "row_index": 33, "timestamp": "2018-02-24T11:21:29Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40a970137-1e47-4f56-a5bf-e1fe53c97ef4", "eventTime": "2018-02-24T11:21:29Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33dd422e-99fb-4104-87a9-9c34a18f2736", "record_id": "flaws_cloudtrail:0000034:33dd422e-99fb-4104-87a9-9c34a18f2736", "row_index": 34, "timestamp": "2018-02-24T11:21:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33dd422e-99fb-4104-87a9-9c34a18f2736", "eventTime": "2018-02-24T11:21:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4549d313-c71a-4e39-adfb-43788db25878", "record_id": "flaws_cloudtrail:0000035:4549d313-c71a-4e39-adfb-43788db25878", "row_index": 35, "timestamp": "2018-02-24T11:21:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4549d313-c71a-4e39-adfb-43788db25878", "eventTime": "2018-02-24T11:21:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIweFBNWEQ2MDltczFQZWY2N3hMTmZTV0ZwYTJwMHpIMDRmK2lQc2VVQVUzSlhUM2g3NEowRXFkVjE0bHppMFBldDVhb1lCZnZNUk9tc0Z0K1hPM0V1aEVLVmhxSUw2ek9Pak5zSVJPZEJMYm5HMU5NTHg5cDV0dmc0UDJtOG84MEd5bllUTGdPNVhpSGVkdDFYYUozL1dRYWRobzg3Yk5XdGh5MlFRRUc4S2ZqbkRBTjNhWldZdXZ1NFJCandCQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d4dda4fb-7a8f-4e38-a4f9-b195d6de7be9", "record_id": "flaws_cloudtrail:0000036:d4dda4fb-7a8f-4e38-a4f9-b195d6de7be9", "row_index": 36, "timestamp": "2018-02-24T11:21:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d4dda4fb-7a8f-4e38-a4f9-b195d6de7be9", "eventTime": "2018-02-24T11:21:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2bEtQZUo0b0VJVzdqanR6QzBzYUo5SXhTOGxlaWMrcXBjYW50TS9XTnNhUFNnN0RzYWxQdHZtQVNFZEE2RVdibkVidXVTVXQrUm9qNmFSMHRSMTRLdUNnYVUySXpEaXhSNjBaTHlJUVNQMXhVT3NjN21yZG4xbHM3TDB1am5pQTV1cFR0N3dHQUNvVDNjYjhZV2JtQ0dzTUZmRG1FWG1COW5vdmlHMmlxL3BrSjdRPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7d67bf9-6770-4c7a-aade-cf4e700315bb", "record_id": "flaws_cloudtrail:0000037:b7d67bf9-6770-4c7a-aade-cf4e700315bb", "row_index": 37, "timestamp": "2018-02-24T11:21:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7d67bf9-6770-4c7a-aade-cf4e700315bb", "eventTime": "2018-02-24T11:21:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzM29DY2hhclgyNjg0dDIrODZzR2VNc2w4TG5vYXIvS1hSRHJDVE1zY29OcHM1RTZWajYvSDhIbU5wZUpBVlJ5akVuVWVXcEgybUtXTm5KejZiUFhtR1dEbDVrbGhaME5IZDZFdzJZM2M4OWx2d3hVc1ByYTZlZUpGNi9sZ0d0NDRmS1ZzN1lJb2s4QTR6VmtIaXRBdVdiMmF4cmNWKyt1YjFUVVBpWElLYnhJQmw4V2tZb2ZxeUpmNTEvbyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6593d7d2-89db-4f3b-b21a-d69ffa85704b", "record_id": "flaws_cloudtrail:0000038:6593d7d2-89db-4f3b-b21a-d69ffa85704b", "row_index": 38, "timestamp": "2018-02-24T11:21:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6593d7d2-89db-4f3b-b21a-d69ffa85704b", "eventTime": "2018-02-24T11:21:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrK0JkS1d1VXA2T1FlcVpscW94L05JU0xaNi9jZSs0OThoRUNCQkxxUkMwUWljVnRkM0ZOVDZCK0FQa1RheEY2OVF5d0tSNUQ4bi9lcVQ0UjEwYUFsNzk5VDdNM2RZajVidEJzTnFSaHFNNFc2RjZiWisxb0FwTmFOSWR2SkIwcEFNVFZ5YnRXK3hsY2tGZGplKzlvb2sxS2o3NXNPZWFEN1NielRBM3RVYjMyVHlFaFNyWTR1RDFuSXZ2YzRLdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c91a7fcb-f9b2-4f1b-a041-fc158c86e37b", "record_id": "flaws_cloudtrail:0000039:c91a7fcb-f9b2-4f1b-a041-fc158c86e37b", "row_index": 39, "timestamp": "2018-02-24T11:21:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c91a7fcb-f9b2-4f1b-a041-fc158c86e37b", "eventTime": "2018-02-24T11:21:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsMWZzYVVHTXBGVXlEVk5GYUpJY3hLa3F2akcwemxQL1YwM0lsVjlrNjFyM0Q3K1pvRkluSUVENzNXTUZJZHhWYXRjL2xjUjMvMEk5RlRTSE1vUzBnM1M4eVhMSU5NdkRsWHhIOGtrdDdsLzFpTFRIeWY2NlQ0ZGNVNmlNMDFjNk5FZ2N6K0VUM2F4WllqRGtDbHJyNUpoTUNWUzlxVGlLLzNkcDQ1ODhOeUYxYWhqTUVOUUlBYzNaWFE9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71fd0704-ec3a-471d-833e-5aa32e619f00", "record_id": "flaws_cloudtrail:0000040:71fd0704-ec3a-471d-833e-5aa32e619f00", "row_index": 40, "timestamp": "2018-02-24T11:21:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 760, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71fd0704-ec3a-471d-833e-5aa32e619f00", "eventTime": "2018-02-24T11:21:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f99db8b-67c3-47b9-a77f-02b83333a108", "record_id": "flaws_cloudtrail:0000041:4f99db8b-67c3-47b9-a77f-02b83333a108", "row_index": 41, "timestamp": "2018-02-24T11:21:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f99db8b-67c3-47b9-a77f-02b83333a108", "eventTime": "2018-02-24T11:21:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiWEhZcnl1cTdKMFVTWjRaaDR4Rk8xOGFRaDNNWEt1WjBpL1dhRTZQa0hLczdkdlk3YzNSNW1jTldmTlhoUEhBQUxqeWJyVDlLSTNtNFRvYmVkejVVcml3bHMvSVE2RitsK1Q4Uk95WERCQmZraU1oWFhlME9sWEZheFcxRWtJcVZpWlZuR0pTdUVPS01QdmVTVGV4RFVFanMvUUZHU2Z1RE5yTVZnVzdyaSt1YitlNFFoOS9jSXNPVU1abiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d12206-5ddf-4e0a-a6d1-c502e35c68d2", "record_id": "flaws_cloudtrail:0000042:d12206-5ddf-4e0a-a6d1-c502e35c68d2", "row_index": 42, "timestamp": "2018-02-24T11:21:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d12206-5ddf-4e0a-a6d1-c502e35c68d2", "eventTime": "2018-02-24T11:21:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzV1M5RXowazBmVllnZTR6MVdQNFRCcGY0a2RmaURHZ1NucUo0YytWdFE2eGg4cXY0aHVydU9Yd0ZHc1RXVGtXQ0dVN1d0eHhURnh6VFdRT0h1TG5lTUM1NmlsZVF6OTBnY1A1VE5VZk9KUitkWFpqNGd2U0gwK3dTR1llNnhlMFozVkI0c3FqdDhGMEFQYWh3NXQxK1IxODlmR2JJSWt2dHFUcGtSRUNFS3h6cGJMdk9HNXhodXhCaHhPTkgvZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26237-054c-41c3-af03-ffaf0da837384", "record_id": "flaws_cloudtrail:0000043:26237-054c-41c3-af03-ffaf0da837384", "row_index": 43, "timestamp": "2018-02-24T11:21:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26237-054c-41c3-af03-ffaf0da837384", "eventTime": "2018-02-24T11:21:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVTHA2ZnBKRVVOMHhqU0tiRlZ0RnpmYi9SeDMxSlVFNzN0YWpRVHN3RGdDdWVHU20rU0VtU0ZPbllRUmFQUVpXVHFGM1NvTElhOFVlZW9QTVNrSGc2WFNJZmFEMDMyVUcxL09yUS8vTk5HaGhYdzUzQ2ZUbHFpMkZuSUl5aGw1aEcwM1VpTWh5UGVrVlJpL2FGNUMvUlkreGs5QzRuTFpndXNZNGM0YncvQmN3Rk1Lc2s5cGJ2cHFzNkhtY29mTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2f249fe-c8b9-4348-8cd3-25d3bf38caf5", "record_id": "flaws_cloudtrail:0000044:d2f249fe-c8b9-4348-8cd3-25d3bf38caf5", "row_index": 44, "timestamp": "2018-02-24T11:21:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2f249fe-c8b9-4348-8cd3-25d3bf38caf5", "eventTime": "2018-02-24T11:21:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxcTVlY09YbDdhV2VQN2ZKTUZ0U2gwekpQcjNSTnpNc0o4enJ1N2plaVA0WmxqVk80MUdncXhYQzhGSEp0YTU1MFhHZkRPV2lPNmlMLzd3SVRUbmtqS1RTTkV1QVBhWEg0NEVQZ1FkYWJjTlFKeVVqT2dCVll4VXBDRXpCbzdDeEtzL3lEOTU3VDN6K2N1UGtjc0lpSHRCWmcrQVp6ZWk2bk5nWXVyUURDRkcrOHlsdWRxS2syemZoUXc9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85466-99be-40cf-b47e-07f22353cf09", "record_id": "flaws_cloudtrail:0000045:85466-99be-40cf-b47e-07f22353cf09", "row_index": 45, "timestamp": "2018-02-24T11:21:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85466-99be-40cf-b47e-07f22353cf09", "eventTime": "2018-02-24T11:21:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQRzBHQVhYVVliSTRNVWUrWlFINlBPRlRtOGhHWWxJUFBVVFgyK0plcm9KcGlUS0daL3ZjVElFK1VaejYzbjRTQmpyVkxrWmFtTU1yOGI2K0Jwb1ZWbHYwZ25uQnhtM3NzZEtGUWxBRTVpZU04ZUhYSFNWelRiUzRDd1NpY2JxMEFQY3JkNUxMYnRKOWpwOFVLRCtNcmk3amp4bGVSKzBZRnFzUFhjQTNVbVc2QXpwZXYwZXRqTWdtWnJjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62b98391-2d91-4e5c-8ec0-d045ffeee5f8", "record_id": "flaws_cloudtrail:0000046:62b98391-2d91-4e5c-8ec0-d045ffeee5f8", "row_index": 46, "timestamp": "2018-02-24T11:21:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62b98391-2d91-4e5c-8ec0-d045ffeee5f8", "eventTime": "2018-02-24T11:21:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjanJIZUFhaG9wdGl1cUY2SmhTNnQ1TjliT056cllnQXZVT3E3QWpSUjQwWStlcnM1WUp6SGJDUmZPdlR0L2g3WXh0YkNEYnVNQlFCR0k2TXRXeHBJeEUxWlNFTFRJYXBaVExmTzczQ1JxYUtSQmljYmxSaXZsdEF5bFp5T1lnVzU4SGk2QkpKRC94eTF5SXlsaDkwYlFiV3kxZTJad1NEUlAxUk9WTDVFUHo4ZHFRRVJFQTFJVFZ4YUpHbHA4WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0a48c1f-dfd8-470b-b683-13d13741fcf", "record_id": "flaws_cloudtrail:0000047:a0a48c1f-dfd8-470b-b683-13d13741fcf", "row_index": 47, "timestamp": "2018-02-24T11:21:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0a48c1f-dfd8-470b-b683-13d13741fcf", "eventTime": "2018-02-24T11:21:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSazZ4Z2Q5VXo4SFlyTUZGMHdLaDhnNVpnSUxpOG1FTk9rV2F4R2tJUmJHRGF6dnJCUWpRYjR1THdxQU9lcFc2T2FaMTdwcmVRQlRNcEpRSGwzMHkveGw0eHNxQ1JPMnVOdlNzZ3h2VUdOL2ZIeHduZ0JHWWE2RjdsakVqSllhVDJHRGVUeTFPM0hVU2NIejhSUWpkUlpyN2duL3hHTnd1Vk95UnF4MzVSUDJ5a0VNRFNTWVV5c0hRaHc9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bd6b559-7ea6-4174-8741-59da70240c82", "record_id": "flaws_cloudtrail:0000048:3bd6b559-7ea6-4174-8741-59da70240c82", "row_index": 48, "timestamp": "2018-02-24T11:21:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bd6b559-7ea6-4174-8741-59da70240c82", "eventTime": "2018-02-24T11:21:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoMWt2eUNlYWg0SlJRQU9zSTFONjlvVHk3WnVqRlNtMnlVSUJ3OU1jZC92TW8zVFNGKzEweFlqUHd1ZVVyRkRyWVRucjZVVDVtYXhhbUtDZXQySjY0VTRnNlowS2xneENPanRNU1BNSHlqb0JFVlhHcXA4QmJSd1NoanBtRWxZODkvODVVeWtuUXdoUXZJQlJFc25RUHFVMGpzSlJpV3gxWXA5T1ZxM2Z2WXVWZ3FKSUZ4bFZDTGVaMUE9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "455c50a9-0929-4975-99b9-2ebd3f4b4bab", "record_id": "flaws_cloudtrail:0000049:455c50a9-0929-4975-99b9-2ebd3f4b4bab", "row_index": 49, "timestamp": "2018-02-24T11:21:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "455c50a9-0929-4975-99b9-2ebd3f4b4bab", "eventTime": "2018-02-24T11:21:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzellwZFhycitRd3pwZ1ZZK2d0K210MDV5MDN3bEk1REZqS01Zd3JMQlA3ZlNHV2Qza1J6Y3VlR25aWlNScEVHcGZtZUhqQy9GUks3emJ0bExNRDBtbmVoOUlqT1RUUUFRajNKZ3oxa0Z0V1NNOWhWMVlmWE83bDZrUzkraHNkQlFzRVZ0MWY5UjZ4MGJJRjZDU0h3VTIreDR4WWdjeXdJcGR1Q3MrRnZwYkZTbVI2OTZhSVJGNjdDUnRwK0FrUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b088d44-98bf-40df-9a45-7bb029842d605", "record_id": "flaws_cloudtrail:0000050:2b088d44-98bf-40df-9a45-7bb029842d605", "row_index": 50, "timestamp": "2018-02-24T11:21:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b088d44-98bf-40df-9a45-7bb029842d605", "eventTime": "2018-02-24T11:21:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCYTFhVTVJRkdzY2M5MUlnTkszbW9SakUyaEhRUG5iQW9zYmxWUWlCMlVvOHF5MEpsdTllVmdGekxwQ3N2Rm5RMzBDRnBiY2pRZk52M2NRVGEzNlFwNG4zTTRiNnRCV0xrOTIyc1ZQRVd5dkRHb08xeVRxaHVjdE5Md0RnWWlzdkQ3QUFvME0xZVpRT1RES3IyZ0srcXpnaEdwTE9CVzQ5enIrSGpzRkhVMXBHd3BMZWVNR2FlaDExYjR6ZCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a576a405-9f2f-4c21-83f7-6b7cffb218b7", "record_id": "flaws_cloudtrail:0000051:a576a405-9f2f-4c21-83f7-6b7cffb218b7", "row_index": 51, "timestamp": "2018-02-24T11:21:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a576a405-9f2f-4c21-83f7-6b7cffb218b7", "eventTime": "2018-02-24T11:21:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3K2NLbjR1VytYYXVET00xNzVqT3FvOUJ5U25nUGxiSUkzN1RlK1hOeHhRZ1hGMjVGMFM4VUJzRmEvR1hRM0lIdUJqUngrcS9zdXNlbE5iUzR6c2g4WWd3SW9XVnpGcXpoNTBJL1lRclphenhaWWNSRWh5NGZJWFpXS3Q4d2JBVnQ0dHBTQjhtK3VnYkRialNjc1FFUUxzVnl1MSsxeGRxSkdJYlh2UnV4SjlxaWtNeURYTTRIUWp0SnBtdzdQYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff209127-11b8-425a-a734-810a0e6ce1aa", "record_id": "flaws_cloudtrail:0000052:ff209127-11b8-425a-a734-810a0e6ce1aa", "row_index": 52, "timestamp": "2018-02-24T11:21:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff209127-11b8-425a-a734-810a0e6ce1aa", "eventTime": "2018-02-24T11:21:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1a8f4ec-4125-44b3-a78b-abf4f798baab", "record_id": "flaws_cloudtrail:0000053:b1a8f4ec-4125-44b3-a78b-abf4f798baab", "row_index": 53, "timestamp": "2018-02-24T11:21:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1a8f4ec-4125-44b3-a78b-abf4f798baab", "eventTime": "2018-02-24T11:21:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIMDNmamJGTEUyczB6dkJTcW9HZDJsRUlNdUFoVUdZa2ZUWGMrV0tJSWlHVFIwYm10T0w2Z3laclh3OUIvUnpvWk1aczhrc3M5eE55b1JLMmVWK1JXS0FVRnBqMUU2WUVNR1VmRWtRNkFScFp6YzFoeTk0aFAxVUxuS0pkd0doWmlDVmIzdTh5NnNoRDY4SjhDVFNkdWx5Rm9heXI2Qkp2NEsxa2pKdEdDbzZTMTU0RGVvYlRmTUFlK0pobiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "521f7895-b06a-40cf-b265-b36db73f9c72", "record_id": "flaws_cloudtrail:0000054:521f7895-b06a-40cf-b265-b36db73f9c72", "row_index": 54, "timestamp": "2018-02-24T11:21:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "521f7895-b06a-40cf-b265-b36db73f9c72", "eventTime": "2018-02-24T11:21:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJybldycjZTL0Y3cGpNaHNQN1VaZXBFTzZLVVpkZFZHcDBvVGY4SWdsRk1SK0Y1c3ZzdktET1V3TDR2a0gxMisvMFhNNDdYUS9CZmlReXg5VXBkVFFnYi9OWDdhM1ZoVHAvTmNCVEpXVXRqaDdMNytJNGRGUHZmVDI0UDc0cjFiTmhValFEcVk4cWV6aFlhaktKQmdvcWkyMStBRDd6bHlWSWsvY1daRjJpT09Zb0NjPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "716519d7-3634-48b1-8dda-e7f9006b3191", "record_id": "flaws_cloudtrail:0000055:716519d7-3634-48b1-8dda-e7f9006b3191", "row_index": 55, "timestamp": "2018-02-24T11:22:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "87.178.2.60", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "716519d7-3634-48b1-8dda-e7f9006b3191", "eventTime": "2018-02-24T11:22:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "449b1b85-7263-43aa-84f8-b0ace99a9158", "record_id": "flaws_cloudtrail:0000056:449b1b85-7263-43aa-84f8-b0ace99a9158", "row_index": 56, "timestamp": "2018-02-24T11:22:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "449b1b85-7263-43aa-84f8-b0ace99a9158", "eventTime": "2018-02-24T11:22:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d0e2b74-c42a-4db3-a274-69f4910acf9c", "record_id": "flaws_cloudtrail:0000057:8d0e2b74-c42a-4db3-a274-69f4910acf9c", "row_index": 57, "timestamp": "2018-02-24T11:22:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d0e2b74-c42a-4db3-a274-69f4910acf9c", "eventTime": "2018-02-24T11:22:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxSkdhMU42R2xSZUFqL3NPRWx2UzlPVVZmaGNVbzhKdkhoNHZWaGhocVhPYTAwM0gxVVhPV2wrMjdQRmhsWmtBbjgwOFpUSTIrVEVNUUZjbDNTZmEvOU9VblBGOXg0TUhLR3RLOERvTkFxNFNqRGI5TTJKRzBmZ20zbWs5aldyWjZKc2tqeHROS3NWYkFhTmZKK0xRNkR2OFZsc01NbWRFcFJyQzgvM0k2RDVFL1U4Um52Q1dEZkhNUk5rWld1Zz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfa5c7fc-0d5e-4b5e-8b07-9d70b2701e8b", "record_id": "flaws_cloudtrail:0000058:bfa5c7fc-0d5e-4b5e-8b07-9d70b2701e8b", "row_index": 58, "timestamp": "2018-02-24T11:22:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfa5c7fc-0d5e-4b5e-8b07-9d70b2701e8b", "eventTime": "2018-02-24T11:22:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhbjExd0I5MVdBSVIzbHBRWnVVQWlZRkdmVVROZ2FHZlJoVSt5WHBzQmk0bjBRdll5cEgxMFhJcWhLM3lVZnJ1enBSd2NxS2NkMDFxWG82cVZreUROVi9hcWd6NkJlVnl2ekJEb2JzalRGMVBOcnN6TVdrVm5GTjlRSjZ4YWhLVFpRaFUrY25PU0I1cEtHVUxkWGlpWDltU1BNWm5DM05OODBzckNaenJpL3FhNDV2NjZJZ21vNDlwQXBvbjU1QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6195dd12-f73b-4acb-9fef-49bd1ea18953", "record_id": "flaws_cloudtrail:0000059:6195dd12-f73b-4acb-9fef-49bd1ea18953", "row_index": 59, "timestamp": "2018-02-24T11:22:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6195dd12-f73b-4acb-9fef-49bd1ea18953", "eventTime": "2018-02-24T11:22:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzWWVUWTk5Z1UxbTRZUms4L0NRUURIYy81Z1hWZkJvZzVjNFBLcmJXemlNZ0FWZGxkWHpqcHBhSk5QdFRYcUZOTzI3SHpjbCtrRmFrZU91N21NWDd1VVRDUUZhaXNTZEJXcG9Cbms0alFtQVN5cTk2bmZmbmRmeFFobzBwbGp6blg1ekl5NnVFY0s0TEYwQ3k0Z21WdlJwNjVOTm9UenVpS1h3Zzg5bmxhUzBWdmdCZzJKSjZESFFTOExISjF0az0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5608a8ea-525d-47c3-ac4e-d4704f97a2ba", "record_id": "flaws_cloudtrail:0000060:5608a8ea-525d-47c3-ac4e-d4704f97a2ba", "row_index": 60, "timestamp": "2018-02-24T11:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5608a8ea-525d-47c3-ac4e-d4704f97a2ba", "eventTime": "2018-02-24T11:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwMkVEbkI2cWRhRnlScUZ3cE9rdnVZU3I5R1dXREx6cFVKeGFVazVlN0NGOVFCeTROTWw1ZkdkTzkvNnlMZDN4d0JaZGZ1Zkl2bDBEQkJDUHVENjB1cWc5Mk1zYTRmSVFUL0ltcGIwSmdSQTUxMzY3akxsdWR6SE9ycmMwSUI0ZjBsTmN2K3NtbHByVVVlNXJPUmVUZUsvdnY0T0hWT2pXTXZMVUdVbWRJVVcweFJxUStrR0lKbkdIQVkzeFdHMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46492d16-cce3-4bb8-9391-2d0e6806f09c", "record_id": "flaws_cloudtrail:0000061:46492d16-cce3-4bb8-9391-2d0e6806f09c", "row_index": 61, "timestamp": "2018-02-24T11:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46492d16-cce3-4bb8-9391-2d0e6806f09c", "eventTime": "2018-02-24T11:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5N2NGdmRRNnczanViZnhpWlJ0dlU5ZUF2S1VDc0lLOVcvV0dRUkJCVVMvaHNFRU5Zem1ZSm5ObUtIZXRvdXN5bVo3V091Wkk4bHh0a1dBeFY4QXNXblM5YzZMNnA0SnkzRlV2RS96YUNPR2pTbm1uRElVdFJqWkZWRXBjR3ZkQnpDUzRpU2kvQWNjL0R0OVc5bnRidjhGSUJZVmRQdTNSanV5N2ZTUGhwN09uaFpkamhZOWtYVUdVbUJOQ3c1QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "519a9d07-4b81-4e63-9460-ca28d59e2fe0", "record_id": "flaws_cloudtrail:0000062:519a9d07-4b81-4e63-9460-ca28d59e2fe0", "row_index": 62, "timestamp": "2018-02-24T11:22:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "519a9d07-4b81-4e63-9460-ca28d59e2fe0", "eventTime": "2018-02-24T11:22:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3Yk5wQlBmRGdJbjFhaFRTK0xNelBNRXZMMHhKQ2hOSVl4dm0vUEpUUWxKSCswREdtaFZsSG9JbldLMi9UMUcxY0lTWmpYbkJNdWgwMm95NHkyNHRXUjE2MFVwMEtwcEo4TUNRU2ZHQSt6Mi95T2ZZY0FMTDM2NXkvSmlKdEpSU3dxUUVTN0lORlJpK2Noayt1ZnJNK05FcTVXOFJ5TnNtMlFRa1dqQ1pZZFQxUkFXWUtKY1BodktRcndTR1F6MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dae0e178-562b-474d-8b1a-655771842473", "record_id": "flaws_cloudtrail:0000063:dae0e178-562b-474d-8b1a-655771842473", "row_index": 63, "timestamp": "2018-02-24T11:22:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dae0e178-562b-474d-8b1a-655771842473", "eventTime": "2018-02-24T11:22:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMMkVGY25JQmhsU3RMY2pDVWx4bmFva1kzd2tnZDdtSDU4TmRZV1JZNTc2bldlQkNLeWs3bllCc3p5ZHNpclppQjdvL01SZGxYMnRMQVB3MnhuMWtadEZJVnhSMnZlMjlHQ2pOaDdabFFCZHI2c0JqTjhMQ09TOURZbHFUL3FQZS9UTGptRzdkYXdNZzErUGNKa1ZSU3Vya3B0cHlvcjFCV21JY09DMi9ta04wVGFEYm1JRW9VVzVPYVNVciIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f62f5b0-18b8-46d6-a987-338e376b74c2", "record_id": "flaws_cloudtrail:0000064:3f62f5b0-18b8-46d6-a987-338e376b74c2", "row_index": 64, "timestamp": "2018-02-24T11:22:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f62f5b0-18b8-46d6-a987-338e376b74c2", "eventTime": "2018-02-24T11:22:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkM3VBdUp3aWlUdSt6bkxwaVd2YkdsemN5WUJLcGFhaVU3eGJzV1FweXRSZFdZMFdZL0c4aTVPSE9iTXliR1RCTVFyY1Zqd0duTG1FeUlDWjU3UWNpY3NxbWpJSncyWENuVjVGdnBRZUc4M0VYUHArOS9YWEt5ZGVlYUsxaXUzbkgzbkRwbmJKZ0JETjVsc0pRTTFhRXFnNEltdGd1VHpFQW00NTRUc1pxTk9VZEl4VEhQYUZ0Ti9EUVFVQVVNST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "466fad61-ce2f-44c6-9fbe-c6c53106e3f3", "record_id": "flaws_cloudtrail:0000065:466fad61-ce2f-44c6-9fbe-c6c53106e3f3", "row_index": 65, "timestamp": "2018-02-24T11:22:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "466fad61-ce2f-44c6-9fbe-c6c53106e3f3", "eventTime": "2018-02-24T11:22:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzZXdDUUcxWVVBMS9UYld4WGh5QnoxNEdDZ3FUei9BbEp6K2FyZ21Pa3dIWmxkMTVqRUQ5d2c3cjJaM05PeVJ3ZHpySEUwQlFDVlYyMXpPL1JuSndOUm1Qb1lwL3hOS2NaWTdVait3WWlLSXE1aUtNdmlpYUxOU0tqbGNjMmNjaHlzVGJwaDdPVW8zU25Xcm5WTUdXakhJK0tOQWhqbnNBS2tLdWNWRXNKcndObGU3aSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62115bf-4273-4c8e-bc2e-663ae5859388", "record_id": "flaws_cloudtrail:0000066:62115bf-4273-4c8e-bc2e-663ae5859388", "row_index": 66, "timestamp": "2018-02-24T11:22:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62115bf-4273-4c8e-bc2e-663ae5859388", "eventTime": "2018-02-24T11:22:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6e8f586-c7a0-48f1-9969-97ba38338fb4", "record_id": "flaws_cloudtrail:0000067:a6e8f586-c7a0-48f1-9969-97ba38338fb4", "row_index": 67, "timestamp": "2018-02-24T11:23:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6e8f586-c7a0-48f1-9969-97ba38338fb4", "eventTime": "2018-02-24T11:23:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81cca7b7-6c96-4b0f-847a-f84d348d6beb", "record_id": "flaws_cloudtrail:0000068:81cca7b7-6c96-4b0f-847a-f84d348d6beb", "row_index": 68, "timestamp": "2018-02-24T11:23:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81cca7b7-6c96-4b0f-847a-f84d348d6beb", "eventTime": "2018-02-24T11:23:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrRW1WQkF6MmFPK3dTdFpMTmM5dVM4WDFha1U0S3ZXVE9xVnV1Q0hvWkM2L3FMQ2pzVVA0WWpQclhzUXlYVk41dWhXRjFaY214d3VvNGRyZmt5OTJqSE5IMDVRdUs4Q05VWFVyeUkxNm1SckxHU21sNEh1T0VhODZWRUVZNSt1NC9saGlPYnJ3UTREWXNMZndnYWpXQ2RyWGtVV3JRZEpmUkpHN0gzUkticGhPRVFQVjdFNm93WFFIeWJteVpGQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2b9eda0-63db-4155-9210-43def58cd87f", "record_id": "flaws_cloudtrail:0000069:e2b9eda0-63db-4155-9210-43def58cd87f", "row_index": 69, "timestamp": "2018-02-24T11:23:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2b9eda0-63db-4155-9210-43def58cd87f", "eventTime": "2018-02-24T11:23:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOd1U4Qjg4OHpzNzRZZXdpbEZTTk5qR1ViaklsbTVSeHdMeEx4RlNTcTV2Yy85bmp6VmpROFBka3VuVms0NFpyWGRLdjdhaUx6bGN4QWpYcm9rRmRhNHFKcGdIbEsrMTlYaTIydmhRRGNGOFRFZmp6c1N5UXlFYnh2OUtmSndBN2Jpd1luUkVJenVnYXJ5SkdpNnBOTHNWMjBIaXBySys4V1hLVklDWWJ2VnhFdVp2cHB1a1FWbW5OODFDckdPQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdfa06ee-a960-4815-ab7c-42bd8b15015b", "record_id": "flaws_cloudtrail:0000070:fdfa06ee-a960-4815-ab7c-42bd8b15015b", "row_index": 70, "timestamp": "2018-02-24T11:23:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdfa06ee-a960-4815-ab7c-42bd8b15015b", "eventTime": "2018-02-24T11:23:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtYkxHSUlkdHNYN1VTU1F0ZDRFeWJwa2RBRkVmTjBkVHhxbGNoRUNqSGJLL3N5UVZNTmp6TUJzVFA2Z0RTRzVqM1ltMExJWVA0U0RLWHR6a1hGT2VOMUtqMkpsN3QyZktOdzNOWWJhd1dIdGlid2N4Wkg0RmFxWkFxRzk1OHc0em9IRXdydmM4N010Qzh2UkdDZGppd3dyVkFNTUw2cHFsWkFSZWtXTU9xQUlDMDNVVmFvS3dTTnRqZ09EZGhScz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "046789a-feb0-483b-b624-6930c976ec73", "record_id": "flaws_cloudtrail:0000071:046789a-feb0-483b-b624-6930c976ec73", "row_index": 71, "timestamp": "2018-02-24T11:23:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "046789a-feb0-483b-b624-6930c976ec73", "eventTime": "2018-02-24T11:23:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKd1pWdGhJK0hJUENtTVk2OEhEeHdpLzgvRlhDeEZZVWNKV1JHdmFKZXhSVjZTVk83RCtXUFFYb3NuNHhiOFVZaTV1dnU3STYya1czS0RLbG1udGhKblFhVHU4SDAyaWl6bUhUNjloZThmVTJSK2VsUk9QTWlocU85QWZUWW9WelNOeFR2T0xYaTcyNENremlaMmVqaUsxZkNSNEgvOThtcFdWOFdST3l3WXZlcmhUZ2VSNloyYkxlSTU4Vllxcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81f643509-cdb7-4eb9-9933-d2871f661e35", "record_id": "flaws_cloudtrail:0000072:81f643509-cdb7-4eb9-9933-d2871f661e35", "row_index": 72, "timestamp": "2018-02-24T11:23:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81f643509-cdb7-4eb9-9933-d2871f661e35", "eventTime": "2018-02-24T11:23:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGMUQva2d1OUZxeG5vWkdVQWpjTmhYeCtRcDhHQkRMWm9HKy9yd2tMYnhJL0ZZSmFaUlEwaW1kcitQM2UxSVpKdnM1ODRXOUI2VDl2enY2bC85dFA3cms4ZHhwNUQ3ZXVsNjhWT3Q4cXBTYnFqRWs1S1ZJU3A0d0dDdkVuOUZ4aEhKaXNwS2Uxa2s4blFYaVhScmhhMU5CNit0aHErRmxjZGVkbENoenlYZ3Uwd2QwN1ViTmNpZ2lXWGVKMTFNZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97ed1c68-686f-4edb-9cc0-639e6991c6bc", "record_id": "flaws_cloudtrail:0000073:97ed1c68-686f-4edb-9cc0-639e6991c6bc", "row_index": 73, "timestamp": "2018-02-24T11:23:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97ed1c68-686f-4edb-9cc0-639e6991c6bc", "eventTime": "2018-02-24T11:23:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoQVlsa25wZnJuRHVxNGN1THY5VWp3Q002UHN6c2I2em5IN3V3andKYjNrem9Rem9HVm90b00vSGFYY20vR1pBMW1lR3JMa0llWHFFWlFTWE14YVJIRmU2amV6U25mZlJ1a1k0cHNDK095enFKRDh6aVgvK2lZMkZaNVlTNlZrSC9wQnovZDZBNFpJb3ZBTnlIUFk2TzBLMU1nM1EvdG1LQm83UDRxNlVxYmZ4RWIzbWJqWlplWlZyNE1HTHd5az0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2efe6240-869a-4b5e-af75-f180ca28c7de", "record_id": "flaws_cloudtrail:0000074:2efe6240-869a-4b5e-af75-f180ca28c7de", "row_index": 74, "timestamp": "2018-02-24T11:23:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2efe6240-869a-4b5e-af75-f180ca28c7de", "eventTime": "2018-02-24T11:23:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYOUtPcjV1RE9hMHQveS8yM3J4dXNtaHd4Zm1Ra2pFd1czYzR0eDA2eHNVb0FCR3JML0toMndOZVY3dXo3c0M0YXhRRVVwY0lUL3QzT25mR3RnampJUjRqUittbkVkTjhvRUJSMG9iWjNtOWpoR0JLTHNiM3hSMk9NbERZTzBHdTRUVmwxc0ZaMHE3RnBiZXUvc1htUWtIOWFqbnlxRE5ST0hSNDJ6YUVPUm15ZE1EZFJ5WVhNNWV5Z0N4OGJoZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51695bd-50db-4089-81f7-152bd17ab0b6", "record_id": "flaws_cloudtrail:0000075:51695bd-50db-4089-81f7-152bd17ab0b6", "row_index": 75, "timestamp": "2018-02-24T11:23:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51695bd-50db-4089-81f7-152bd17ab0b6", "eventTime": "2018-02-24T11:23:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDSSt1UGZkQ3U4S1JXejFjRGQzQmdNM0IzTk9PUVBwelhDNm56NExiVm1PYkUvWDZ0SWJiaFlCamtJZnlIdG5SVFhwR2RtNGxrWEVCNnNNNWRmb2hMb2FvM1BYcWppM3hrdTF6SXZMODNMZUdpUVdmeXhWZzJneTNodDF3ZmF5SytWYlBYRWxQUFRoNEZKajVBS0g5M0VGeFM4TkxEd0cwRkY2Y3BER2VZZHhWeE84aSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9aa0bbd4-86b7-4ede-ae9a-dc9b0fabe8c6", "record_id": "flaws_cloudtrail:0000076:9aa0bbd4-86b7-4ede-ae9a-dc9b0fabe8c6", "row_index": 76, "timestamp": "2018-02-24T11:23:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9aa0bbd4-86b7-4ede-ae9a-dc9b0fabe8c6", "eventTime": "2018-02-24T11:23:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwTCtYQ3BxY245R3JPZ0RHY0xjeUpBMUNrenFNTWxETVZ6T2dzSGFLaFBMZGFrUk5vRWs0V1Zsd3FVSmY2QmpYZzQ5WVFaTHhVMHBibjBrb0t1b3BpekhMc1ZiL0VGa3NXK0xlTG5VZjZSUlMzMG15TnVkUzFjeGZkeWQvdmtVSUkvVExCZlFQenltTVltMUh2djNSN1ZpN2tuOFR4cXVkYmJNR3V6Q1NUUjhIWjVuTFpEQjdaMWhuN2FsWCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69c2f395-1465-4db4-976f-0f5c7d6d7217", "record_id": "flaws_cloudtrail:0000077:69c2f395-1465-4db4-976f-0f5c7d6d7217", "row_index": 77, "timestamp": "2018-02-24T11:23:23Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1314, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69c2f395-1465-4db4-976f-0f5c7d6d7217", "eventTime": "2018-02-24T11:23:23Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-83d15d668fb2941db", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Action=CopySnapshot&SourceSnapshotId=snap-83d15d668fb2941db&Version=2016-11-15&SourceRegion=us-west-2&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=3600&X-Amz-Credential=AKIA01U43UX3RBRDXF4Q%2F559470%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-SignedHeaders=host&X-Amz-Date=559470T621515Z&X-Amz-Signature=965a761c59f83222e8a9f874320a7e7b3f83195e252c70be3ed6728b5273b2d1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11d7b592-85e3-4711-a5fb-14601bb05be2", "record_id": "flaws_cloudtrail:0000078:11d7b592-85e3-4711-a5fb-14601bb05be2", "row_index": 78, "timestamp": "2018-02-24T11:23:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11d7b592-85e3-4711-a5fb-14601bb05be2", "eventTime": "2018-02-24T11:23:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0754d0fc-b68d-4e8b-8a59-f80ff7633cb1", "record_id": "flaws_cloudtrail:0000079:0754d0fc-b68d-4e8b-8a59-f80ff7633cb1", "row_index": 79, "timestamp": "2018-02-24T11:23:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0754d0fc-b68d-4e8b-8a59-f80ff7633cb1", "eventTime": "2018-02-24T11:23:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVWjFVUXRQelZTT1dIWlJISkJsWFM4TkVaNnJlOXFZWDBPN3R3blM5Z1VieW1PRmtrY0pLTHJ1cXlFZ2J3U3k2MWVpclJ2UFZ3cUdqUjFFZ2Z3ZU44UTM5RmlHc1NGSW9qMENZclhadUtueVBSK1ZjKzluZzdyZXdvdVdXNXU4VjJ4V1d2emU4Y2lDN1dzMHA0M043UzNZOVJzOW11MHhqWkVEWUxPWGI3MGE0VjN0TDcxNUREQjZvYzNpdDhqdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d93ec51a-ae08-4814-8bc4-ba62b00c298c", "record_id": "flaws_cloudtrail:0000080:d93ec51a-ae08-4814-8bc4-ba62b00c298c", "row_index": 80, "timestamp": "2018-02-24T11:23:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d93ec51a-ae08-4814-8bc4-ba62b00c298c", "eventTime": "2018-02-24T11:23:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiM0dTekNJWDhmR1RydVdzWFNGcHpnYlZIeDBFM3c4S3Izc01WUGx0L0owcUsxY3dkd2VncGYvUkpjTTI0U25kWSt5TG5YWitTNDFWaUI4MXlCd1hEaURjSnZaZjEwV3NvUTdPRWI1c1NiOGN2MklvMTZvZTNxOXpaTDlWYzVuWkIvMDBWaHBpYS82WVRnWm1Qa2R2Q0pwaC8rMkJQc1VUMnprSEN2bzZ6YUJCTXR4WG9OQmwvNXlwcCt2ZytWUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "538e8bc4-40a0-4b1a-ba20-348778dd9d", "record_id": "flaws_cloudtrail:0000081:538e8bc4-40a0-4b1a-ba20-348778dd9d", "row_index": 81, "timestamp": "2018-02-24T11:23:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "538e8bc4-40a0-4b1a-ba20-348778dd9d", "eventTime": "2018-02-24T11:23:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "debb2f2d-0626-4650-b2dc-b1949b63a780", "record_id": "flaws_cloudtrail:0000082:debb2f2d-0626-4650-b2dc-b1949b63a780", "row_index": 82, "timestamp": "2018-02-24T11:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "debb2f2d-0626-4650-b2dc-b1949b63a780", "eventTime": "2018-02-24T11:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLckxPRW54cFcrK2hoQ1lTTHJaazgvc2txOUpOcmxBTnNxU1hjZGVFWHB0bVBuWGVsdEFqeWNNS3A4UE5NbjB2emhzRXRqRTU5eVdZRGlZTW9WbHRNcCtYWVpkT3VpaXFVRlFPN3JqVFZoMUJLWm9IVWcyZkwvQlJPdnFIOXNBc3JqUmMzbjg2NTNNOGkrc2hIOHJtQ0VLQ2ZSV2lDaW9ITFFZTVRiTDV2ZFhVbU9NZWNyZVkra0x3dSs4cXpaST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055657db2-37ec-4058-a021-133ed6f254c4", "record_id": "flaws_cloudtrail:0000083:055657db2-37ec-4058-a021-133ed6f254c4", "row_index": 83, "timestamp": "2018-02-24T11:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055657db2-37ec-4058-a021-133ed6f254c4", "eventTime": "2018-02-24T11:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKMVY2L29pakZCTGlTMm1lM2RObWVTNnprUFF2WnZkbW5kdTkvajZCZllSU3BhZDdjRGNEc2tRbFk4YUJnd1o0UFhsU1pGQ05adUEra2dOUCtlMTVteEtCV0IwWlVzVEFqckhvVWQ1RnhDVm9jQkpEMkZNWTdaanJGVVBXeTRya3hQSzlYSGtsWTI3TW1TMUhvN1pmajF1QzlRTEQvNmZSUG5ya0NNcTY2eVMxaXZCQ3RVNWcvdDdESmIyKzllVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "052f7f47-caa9-4df1-bbcc-71db5fa42f66", "record_id": "flaws_cloudtrail:0000084:052f7f47-caa9-4df1-bbcc-71db5fa42f66", "row_index": 84, "timestamp": "2018-02-24T11:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "052f7f47-caa9-4df1-bbcc-71db5fa42f66", "eventTime": "2018-02-24T11:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQTTNNRGxzMnNBYW5NVGc2MWk4djZlOEN4Y2FKMEFNZmJEN0lMa2JyckRoakJqQ3V5WGRMUFZ3N2pGdVdUYjF2Nm9PUXF2d0syUHVITFFBRkNpWnlVV2Z6OXRjY3g1TWJhYklqb3NSb0NYRHNWUTBDdG52KzVDOXNpQXI2MUE0eE00RXFydG1DUVNtNndIaUM0TmVDc3lrRkhLZFhIbVNqVTNUQkdrTFdEc2pKOFVlZXVLM1hUYU9iMG42ei9ZRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "850315ad-ede3-40d4-a3ef-ec68b4ea107f", "record_id": "flaws_cloudtrail:0000085:850315ad-ede3-40d4-a3ef-ec68b4ea107f", "row_index": 85, "timestamp": "2018-02-24T11:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "850315ad-ede3-40d4-a3ef-ec68b4ea107f", "eventTime": "2018-02-24T11:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6MzJ0Z0hnSnpMUitScWlrTDIwSjBkMlRnUlpDek80RU9UMmJZSWQ4eWtpZTIwenFnV3VvbTV3VkpjZ21EcTNmY3d6aEVBR29UNDd5UnpNOFRLd1FMY2xTVG5Ud0RBUzBhVTJJUGZZV2RvckFBN2doK0NoWFYvdXZBYTB3TXZyTHYwR0hBSDFscW92bHVncnBGS21iOVV0K2NNR0c4RTZIMW1pcHFpZndZRlVYWjVGKzI5TUN2UGVQVnZLaEVhZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a5aac89-c16a-4003-a97a-95aa130dc544", "record_id": "flaws_cloudtrail:0000086:1a5aac89-c16a-4003-a97a-95aa130dc544", "row_index": 86, "timestamp": "2018-02-24T11:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a5aac89-c16a-4003-a97a-95aa130dc544", "eventTime": "2018-02-24T11:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaUlhMMmZWSGNoMnBhUjZxSHNSV1dXQXlnSXNDMkcrb3hvc2pSUElRRVlDU2NhcFVVL2ZZYjZpR2lDSjNwaDFUOVhOUU8vM2JQQWVPYW94VDBjdHdNQVp4YUIreVhuY3dUTmhqb052K1AxTnk5VTZ6QUViVHYwUVdobHFwSTR0QzNZcXRmdEJxQ2ZTY1h1UzBidXZSb2lxdFJuZnBzN3ZvYmhYald0YVBPZlhqVjh0ZVcvQ0VMejBOSVp3NzNHTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83be6cad-adb4-422e-ae66-083a35c9348a", "record_id": "flaws_cloudtrail:0000087:83be6cad-adb4-422e-ae66-083a35c9348a", "row_index": 87, "timestamp": "2018-02-24T11:23:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83be6cad-adb4-422e-ae66-083a35c9348a", "eventTime": "2018-02-24T11:23:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIveDBYL3FSdGJRMW1nNVJsdTdWMEE2WThtWDI2bXdEc3NUbWF6V05tUFdJc2l1OXRNaEgwZlc0b1B2SWdxbWdMVWhLTjEzNFBNNDYydDhCb0M1WGFEUUF4L2FpanlzNTBONGdlL2NUMGtWZHh6VWNZWmdnaTRvTnJZU1phWGtpVmdqU1A4ekdudWptMjJQSFZLTng3MlNQazhwTHhIVFovaTlOaUJCWEJGZHpMWVY3VDNEUitvZDU1QjFmZCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5dd411d-770c-4994-874c-f851ff4431d3", "record_id": "flaws_cloudtrail:0000088:c5dd411d-770c-4994-874c-f851ff4431d3", "row_index": 88, "timestamp": "2018-02-24T11:23:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5dd411d-770c-4994-874c-f851ff4431d3", "eventTime": "2018-02-24T11:23:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwK0VTbXdrRmNyVFNkZmUwZk5yejliYjdwM0xRTjlYcGNvMTdZZnN0eXA2K05LNElRaUN3RHFJUzNEalJqWndFNTdQZlczbmU5T1pwMzZ6MkQ3NFMvUngwelZtRDRXWXl6N0tqRWZIbGJyNFNoTTFzdHVDVnFmVFB2ODFmN1JkL1hibEdnWGNDd05TN0VGcVd6KzFXRFplaE83WC9CVDg4aGl4UGFlOFZpYUYwV2gyLyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c58f53b-470b-4c9f-bfeb-b8eba7d183e7", "record_id": "flaws_cloudtrail:0000089:3c58f53b-470b-4c9f-bfeb-b8eba7d183e7", "row_index": 89, "timestamp": "2018-02-24T11:23:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c58f53b-470b-4c9f-bfeb-b8eba7d183e7", "eventTime": "2018-02-24T11:23:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6832fd17-7ff0-451b-98ee-83ad8922ef03", "record_id": "flaws_cloudtrail:0000090:6832fd17-7ff0-451b-98ee-83ad8922ef03", "row_index": 90, "timestamp": "2018-02-24T11:23:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6832fd17-7ff0-451b-98ee-83ad8922ef03", "eventTime": "2018-02-24T11:23:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPblg4MWFxQXFKUW1jdGtWWURITnJEdXpFVVBUdk9IWSt2VU9iNzVBNm9McU5NZlhQanRNcVhhTmtjR2JiRGtYMSs2dHhwQUlMdysya0dKSzh2VVhHaUU4Y1psZmhGa1BtS3M3OUZZYUJWK1RqQW1qUmdFV3I4UmRUTno1eDNjcVUxUWtITlVaMGpEN2Y3WlFNQWNGc2dnSnJWL1FCMmpoSFdLVmhKdkNqM29CdGFocStPdFZwMXVpQXVpZ0hNcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7de4227b-8735-4785-b0a4-d6dc185787", "record_id": "flaws_cloudtrail:0000091:7de4227b-8735-4785-b0a4-d6dc185787", "row_index": 91, "timestamp": "2018-02-24T11:23:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7de4227b-8735-4785-b0a4-d6dc185787", "eventTime": "2018-02-24T11:23:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJERnduYnMyRnlUL3BtMjQ0RW1TRlVLallTMmVKc0FtNytIM0dqMEZPVVhWNmRJbE9mMzg4NU9ydTZJa3RYUW5NSVEvMENDU2EzNUZCOHVySk50YmVLckYzUmpjUU5yRC82bjZzdTFDaFNncExkVGk2bVB0VWpuNXZKM0MrY2VxYTdOWDFrUmNodTdaZkUxVW9PTXUwNTBCQ3hoWkwybUFMbjRXTFJmMkMxVVkxTWRTM2ZDTWpUNUhtUllxdTVEMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "526c8e10-552c-43d2-9896-715f374eae03", "record_id": "flaws_cloudtrail:0000092:526c8e10-552c-43d2-9896-715f374eae03", "row_index": 92, "timestamp": "2018-02-24T11:23:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "526c8e10-552c-43d2-9896-715f374eae03", "eventTime": "2018-02-24T11:23:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1RHhvM29SY2VIZU8wcnBaaXo0c0c0QWdqVnphL2lqalMwL1RuTW50aXdlYjlEbmJvS21WbkN1cFJDUk91ZFZxQXFuMVU5VlMwZDRlWjdReXlyOXJaMDViOGlHekdRSlVRY0d2SlljelZuQ2FzMTViV2NNcmMveE9QUlV1cGJybnh2M1RQMHkyYlAzRXoyeHZZUnJYVW80VEFFaEJVVHlFWFRsNjZJSkNwN1dlZ0NRL01Dak5UY0luYnFVQ3hSQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c06b2c37-da35-4ec9-837e-a4b69e196fe1", "record_id": "flaws_cloudtrail:0000093:c06b2c37-da35-4ec9-837e-a4b69e196fe1", "row_index": 93, "timestamp": "2018-02-24T11:23:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c06b2c37-da35-4ec9-837e-a4b69e196fe1", "eventTime": "2018-02-24T11:23:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrSVREQ0xXRDFBNnB2enBaVjRGYjdQdHV0alZDZjJkOFFjdnRDc05jVDhWdFlTTFJBT3JQWFVvRUdqd3FQaXhuUDB0aEZUejVWem43aG5Tekx5S0QrSkVhMVJzTUszMlJpM1FJczZqc3RWQ25MZVV4TlRrdWQ5dk4veENmbjBjYjY2RXNKUE9GSU1GOVp6MXBzUk94RDZKVkpFblNQRjkrVXRMNGlISFdkb3F0cjErWjBwZGlpS094WDBrYi9kcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ee9c841-76b2-479a-9fbe-05662a85dd6a", "record_id": "flaws_cloudtrail:0000094:8ee9c841-76b2-479a-9fbe-05662a85dd6a", "row_index": 94, "timestamp": "2018-02-24T11:23:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ee9c841-76b2-479a-9fbe-05662a85dd6a", "eventTime": "2018-02-24T11:23:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyanRYUCtaTjh5ZGs5V3J4amNLemNMeE15ekZwaUwxQldIK1c4ekFYUjZncC90aytWbmhFWmp4YmhnemxDTDJuRlJvWkhmZWtkR0hJdzZQZjRsZmowUmhxdWU2N3cvanhqSnh3YmRBMmlOQ2IvWXpQNWtmWlgzaGZ1R1RKNGxvUlVNOXVLWk9jTFh3OWNKdDFQZ0Z2NncwVGZtaW9WWmd6VEJLYU1qTzZBV0dNUUszeTVmbU9VSUd4YjloQW1mcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaaf8581-0760-4f35-aeaf-96d2244b1710", "record_id": "flaws_cloudtrail:0000095:eaaf8581-0760-4f35-aeaf-96d2244b1710", "row_index": 95, "timestamp": "2018-02-24T11:23:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaaf8581-0760-4f35-aeaf-96d2244b1710", "eventTime": "2018-02-24T11:23:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrMzFyUi9BdTVnUjIwQk9waW9Ha0ZielpQVHFWUFhRU3VOelE3eUxLQ29OQ3dLWWZBbW5HcTRjQUZkWkpNeDhaaHVVd0FIc3lMWXAzWllxYzhJajc3ZXpVR1A1NlZHdkFxd2VDd0lURTd2b2I2aVBNbitBeU5pM1A2NzhabXFveWZQRVRZcnlsZ2RPMk9wa3BkekFwSitydnNVM1BEWlo3eVgwZENyVSttSENjcGV6dGFTYUkydlp3cXJpbXZGND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f996b447-2d8d-413d-84f5-f40eabfa1fd2", "record_id": "flaws_cloudtrail:0000096:f996b447-2d8d-413d-84f5-f40eabfa1fd2", "row_index": 96, "timestamp": "2018-02-24T11:23:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f996b447-2d8d-413d-84f5-f40eabfa1fd2", "eventTime": "2018-02-24T11:23:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvbjY1azROaWhkZFUyL09PeXhOWW9adUdPRndmaFpyVXhrNHIxMUl6MGV5eW82VDJ5dVlGQjQ1RWlOcHYxR3l0em5VZWFEVHh4OTFmQXY5V1BmZWUyL0JUbW13R0xzU3lXZnI1VElTMURZZjRGcHQwZVFYQnJSaThMamVScU8zSFlXSURQVU1MS210SmNvWmFXN0JWWVozQ2NwY0NIanhPUzNXY2JubVpXVGNHYXpZSjFRZ0E3YVcvZGRGQkNMTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a00a026-05e6-4084-92be-1d63ccfa50e1", "record_id": "flaws_cloudtrail:0000097:6a00a026-05e6-4084-92be-1d63ccfa50e1", "row_index": 97, "timestamp": "2018-02-24T11:23:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a00a026-05e6-4084-92be-1d63ccfa50e1", "eventTime": "2018-02-24T11:23:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpTE1qUVR3c1RROGE2UjUwMGtpdnBpWUtRcFNVUksweHV3MS9HVUVscEpSTHhJQ3QvU2FMejQyekZ5UjNWMmxCMVg5ak5JcjZBMDJQWkxwemRrZmVtZjdrY3B4R3BnVmp2emlWNDkvNDY3RXVzdzdXSTVNMFEydE9XenlrY1JIQ3FVYVFxeHJRRXovMkpqVmM4TGhxTXk1SVhiTGxzQTNEM1RDOGs3bGFIYVg5VitPZkYwQmRueHc4OTZZRCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fab2a99c-18f1-48e3-a5d2-34a9ba9580d5", "record_id": "flaws_cloudtrail:0000098:fab2a99c-18f1-48e3-a5d2-34a9ba9580d5", "row_index": 98, "timestamp": "2018-02-24T11:23:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fab2a99c-18f1-48e3-a5d2-34a9ba9580d5", "eventTime": "2018-02-24T11:23:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjbW9mRUgxRkhjZTdEQTNRVkNiNDZHbUt1QkQvRGp0NzFuWFprNlI1ekhyYzR5RVhOemFXNUxoa1NNbExFbXNnV095UzIxMnU2Sit6ZFpEVFdpU1lkQ3VXaWlTNkhadkEwcUxlV3JIMU1sZkJWWkJuZnhGQ21NOWZrSktCWGJNSmJMS2lMOXhpbDBuK2ZJOUtkbG9Xdmw2Ly91TTNCSXJvcUlPbEJxbGhJZHJ6dHJURyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f1dc700-145f-4fb2-a50b-1c413948f26c", "record_id": "flaws_cloudtrail:0000099:8f1dc700-145f-4fb2-a50b-1c413948f26c", "row_index": 99, "timestamp": "2018-02-24T11:23:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f1dc700-145f-4fb2-a50b-1c413948f26c", "eventTime": "2018-02-24T11:23:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a58b057-fec1-4620-b814-db4f087831d3", "record_id": "flaws_cloudtrail:0000100:6a58b057-fec1-4620-b814-db4f087831d3", "row_index": 100, "timestamp": "2018-02-24T11:23:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a58b057-fec1-4620-b814-db4f087831d3", "eventTime": "2018-02-24T11:23:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLeHdoM1dad0tjM2cveGtsREZHUGNNa1Z4Ky9pL0VndlU1QjhpdnVKRzBNdmdPZExmYzJTdzg5TVN6YUlTUExSb2V0RGxEb0VnL3Fnbm1jN1lwYnFiblU2SjlWNk10TENiTWN1dlBOU1RGTWkrNTQwQ1N5SmtiSnFkRzVncUNhQU9qaHBvVjlManJ5TzJQWTFXV2Iya3ZrOVBNTUdTaUk2TmUzaWN5L1dSdGcxWlFCNEljdVBmQ2YrcXBOZDFBVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4fe709fb-4ff9-4bef-8313-1c65cbd0e592", "record_id": "flaws_cloudtrail:0000101:4fe709fb-4ff9-4bef-8313-1c65cbd0e592", "row_index": 101, "timestamp": "2018-02-24T11:23:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4fe709fb-4ff9-4bef-8313-1c65cbd0e592", "eventTime": "2018-02-24T11:23:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFMTd3MmJjVG1tMGpEWVlueDhkMGhOWnNjc2U3VktWSTlSYkdYVThJbDltSWcwT3ZaZi9uZXRuOEhzRmI0ZytkeldmbVhvdjFLYVc0OFhDN1YvUEY1UkRkd3o1ajVKN29EUnlpWWsxRjdlR1R6SmJUZlI2d2cyeU90OEVFT3A0dFpIbzhEZjNhVllwMitpYzFrL0NHamF3ZkRmTmg1bGtnUWxkeDUwUDdwbEpOSUdRKzNoUU9WNkJ6TnpWNnRhND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe7108d1-5c19-4dad-860e-fb0da07b9268", "record_id": "flaws_cloudtrail:0000102:fe7108d1-5c19-4dad-860e-fb0da07b9268", "row_index": 102, "timestamp": "2018-02-24T11:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe7108d1-5c19-4dad-860e-fb0da07b9268", "eventTime": "2018-02-24T11:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDYThIbkgwTmxQamtjNXI3K2JsUi9kL0Z5NmdGNG16dGF1aHdtWTkzODF3eWNkQ054TFlQS1lncW1JMm11S3F2UHlTRy9aOVBVNWhFTE9wSlhqN3FFSnlCNlFla0NGMEJySDY4emdUU2k5WUpoY3RhU1hiTjluRmpRcnhYWTBxUGcrejRmZ0RZVzU1Q2R0dEZaSVZqZU1Lb2NlZnJpZEFQRTZCTW5Zd1Q5dTF1UzRlNkp4RCtkV29BZ0VYejRFbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b2af140-5e0b-42b9-97ab-17c2e59b5174", "record_id": "flaws_cloudtrail:0000103:0b2af140-5e0b-42b9-97ab-17c2e59b5174", "row_index": 103, "timestamp": "2018-02-24T11:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b2af140-5e0b-42b9-97ab-17c2e59b5174", "eventTime": "2018-02-24T11:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2eVA3Q3RpeUpUb1ptMkVoUkh3ZDN4dmZCcG0rUTEyemV1YVllK3RZbHBIVlZUbjYwVWRYUFBqeEM5T0hNUVV2R0Jjb0Z6L3dLVlp4Sjk4Wmo4dGhVeERvaWEzdW5CSVRGUTQrSi9NdlRuclhXZFJySEowRHNLcEMyL285UGhXWmVwK01kaUp1ODVldHN3YmFwU0pOQjNBc2g4NFYrOTUxNXo0OUt0VG4yVWVQVno3REpWQ2lOVHd2WEJRd1lMcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad85357-e1d0-453a-94c0-7f65780e3aa", "record_id": "flaws_cloudtrail:0000104:ad85357-e1d0-453a-94c0-7f65780e3aa", "row_index": 104, "timestamp": "2018-02-24T11:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad85357-e1d0-453a-94c0-7f65780e3aa", "eventTime": "2018-02-24T11:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4VHk2VUdxVndJVmIwQ1NELzVyVTc2Y3lDaEowSTdtQVpHa2w1aUMyTFVtSkh5KzE5VTZiaEVSUm5mQWllNVlxSEtnN0lsYkpvODNEWUVsdXBKeU4xSUFHejZDMWdyTlNVN3lFditnMjl4a29wL2trZEpkVkgzMUxrVFF3a09vVnllNHhNbFdLbXBOWi9Mbk5MQldQVktiRGNSakUvdlJZbXlQOVJObzV0WnBrT0pNRHhlOWxsLzRlMXFzM3RCZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ae49f1e-c743-4c96-948d-1cd09280100a", "record_id": "flaws_cloudtrail:0000105:0ae49f1e-c743-4c96-948d-1cd09280100a", "row_index": 105, "timestamp": "2018-02-24T11:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ae49f1e-c743-4c96-948d-1cd09280100a", "eventTime": "2018-02-24T11:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLR2dTVzlWZVlNYk50ZmNQV1VZK2RRV29DbzZWSmRlWU5NNzdmTW11M3lEenVVMjQyME8zSURmZWtyeldYWnBzWE90aktIb1pxWlBzRjNmd3VLSC9KbktZdVUyRlppM0dRQ3EwbE5nWUZsb2ExS1JqZm5JZ04rS2FPaWFVeHZQa3c3bkdnZXVDOUx0K08zODY0RHFhVXhkbFpqQWlmQzMxZmpUUUthTkxTSnBrdFJKZ3JlcjFiQkpac0pHOXhQWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "efccd235-1a7a-4bdb-ae44-475e5330fcd9", "record_id": "flaws_cloudtrail:0000106:efccd235-1a7a-4bdb-ae44-475e5330fcd9", "row_index": 106, "timestamp": "2018-02-24T11:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "efccd235-1a7a-4bdb-ae44-475e5330fcd9", "eventTime": "2018-02-24T11:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCVG1DVXJpMDQ2TE52YjRzYjV2WDBLTjd1R1oxZ1NqMjNhNFZxekRkaVhsdUNjaWQwSE5TSDk3aTN2TUtPSlhja0p3dUtFaW91SkRRR21abDRmcnZyYlM1aURGUkVvcUtXQ2FrcTJxL3RteDExdVdJYndwU2lxNjZOQmlDSHFjQnFEQW9QT1ZEZE04WXh2Z0JjRkJ4Q2pqZmRMM1pzc3RMc2VJQ1RlZ29UNEw2bk5weEJPK2lPYURlYjMvOTdFOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57900ec-f257-4d4a-a617-0b3b49f9727c", "record_id": "flaws_cloudtrail:0000107:57900ec-f257-4d4a-a617-0b3b49f9727c", "row_index": 107, "timestamp": "2018-02-24T11:23:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57900ec-f257-4d4a-a617-0b3b49f9727c", "eventTime": "2018-02-24T11:23:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoeGZ1VENDZTZuR1JNUFJHcUM0bGc5emtoNlV0dXN6TmREbEQ1ckNrTEpvckVnY0podmdhSGtJNW0xVE5OajJ0YVFnNXRYS3hYN296aWFrM1djS0RZUTYzczkva2tEaTFFNDNwVjB2dUl6SVdpS3JMbjV2Y1UyODlVZEJwdFlBa3JFQ3AvclFJRmJXVkV3TTBHR0FBS05LaUZrWWR4UTFrbUdmZllJNmtjRzFYOWR4ZiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "128a141d-cca4-4c2b-9a06-2ab5f619071b", "record_id": "flaws_cloudtrail:0000108:128a141d-cca4-4c2b-9a06-2ab5f619071b", "row_index": 108, "timestamp": "2018-02-24T11:23:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "128a141d-cca4-4c2b-9a06-2ab5f619071b", "eventTime": "2018-02-24T11:23:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIydnJMKytyZ0RqeThINXM0QnJ6SEZqejJmZkE5VTQwN0RBQkNLV3RkYUNCTFBmSWpyLzJvUnZveUdMTWVuaGNoTHl0OVRLOHRGT1pwVGhMb05hV1VZNFVObW1TS1N1aXJkODFDdTRuS0djNDBJM3U2Y3F4QjdFYU10L3RXbDJEaFdqemE3dGtEaFZnS1ZFYXcwQVNUaXZvOGNTcjdZNEczbmU2SFVUN1FBd1AwZ1NkNVJCb2xGbW02d1pJbSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af86f1ac-edc5-4d28-bbb2-1dd4e23ab71b", "record_id": "flaws_cloudtrail:0000109:af86f1ac-edc5-4d28-bbb2-1dd4e23ab71b", "row_index": 109, "timestamp": "2018-02-24T11:23:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af86f1ac-edc5-4d28-bbb2-1dd4e23ab71b", "eventTime": "2018-02-24T11:23:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUaE1STVJFVFdhcC8xVVU4ejZMTmNkYUQ1UHNGTG4wdVNYOERwcUlyRDdtSEVXQjE1TFYwbC90ZkdsQWFWVlNzSFFid0VuQU44cWpLeGhNQTIvSzE0ZFR2eXFKdStiQk9hclVKRWJoQmlia1Q2VzVhdWw5dU44NVNQbHF4aWh0Qmx2OFZHZldMWGNQTC8xZ0IxT0Vaa1VYWUNyUnZSVXBLejZ3eWdRRHEyOFZpTHo4UzVuUEFydUd0Q29NZnF5dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8ee0440-a3db-4aa1-9b87-b3299f78c67f", "record_id": "flaws_cloudtrail:0000110:a8ee0440-a3db-4aa1-9b87-b3299f78c67f", "row_index": 110, "timestamp": "2018-02-24T11:23:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8ee0440-a3db-4aa1-9b87-b3299f78c67f", "eventTime": "2018-02-24T11:23:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRMWpWeTFHY0lsQ0xBdEhORlQ3TDBRb2RlVWR5WWE5TjBlVVBON2w0UktkbUNlWlpybWMxd1Q5cVRNUjdEMnJFeERmMzBRbHVPdm1MT09JLy8rQmltZVFTQTg0QmM0cWZiQXp0ckZwRFNmMHRoRWk4NHlqTGdDVGxmcUpjU0VCS0I3N0ZGRmRMR3JMUkFKcDhZYWZQMlNubklUOERJNHh2Y2tIR2NQbjUwNlJkcWZSd1RSV216RnE3VWF5ZC9acz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a6cf0a9-8848-4c0a-96f7-cb76359b2", "record_id": "flaws_cloudtrail:0000111:3a6cf0a9-8848-4c0a-96f7-cb76359b2", "row_index": 111, "timestamp": "2018-02-24T11:23:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 760, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a6cf0a9-8848-4c0a-96f7-cb76359b2", "eventTime": "2018-02-24T11:23:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89d026910-f7fb-45b4-881b-c401036a7647", "record_id": "flaws_cloudtrail:0000112:89d026910-f7fb-45b4-881b-c401036a7647", "row_index": 112, "timestamp": "2018-02-24T11:23:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89d026910-f7fb-45b4-881b-c401036a7647", "eventTime": "2018-02-24T11:23:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEdGZObm5wTnY4ZXZmU1dSTlVDSWR0Qm0rZEZTVktRU1lIb3grdDhMK05BS28va2xkMkhMdElsM1I2T3Vmd0NwbUNwMmZDUENEZkNzV0xVK3ZjanRveWFpVmo0NzkzcDUzMTdJZFNMVzhHT2V0QkJBR0dGY1M4MnhuTGxTbURoNXZ4ZW9NTDdMTEZCL3BJM0RsTDFYbW9SaTFLb0JqK001UE16OE00YkF2NFVyb3ZUa2hGbWNhY3F4YTZkc2VJaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed71f1a4-152c-41c2-bb62-c04637a2c2e4", "record_id": "flaws_cloudtrail:0000113:ed71f1a4-152c-41c2-bb62-c04637a2c2e4", "row_index": 113, "timestamp": "2018-02-24T11:23:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 870, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed71f1a4-152c-41c2-bb62-c04637a2c2e4", "eventTime": "2018-02-24T11:23:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'availability-zone' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c795787-18a9-47d9-aee7-e2c916fb678c", "record_id": "flaws_cloudtrail:0000114:4c795787-18a9-47d9-aee7-e2c916fb678c", "row_index": 114, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c795787-18a9-47d9-aee7-e2c916fb678c", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGMVNNczZuKzV3M01KT050aWVRVFRGdVhaVGhQTXZZRkROdC83YzlGeDVoVlA4ZkgzV3lsbVJNeUUydDRGQUxrZy9PQ3dJZnlCbFQ5YWFPOGEvQ1F5YmFVck5RQTJhZlhHNjY0VUw1ejVJVkRkNkNVTnZTVXFqUmlET1JvaTRuTWJDWVdXRmdLeXJ3UnYycHcxSUVYSjJWbTZRVER2UzJNTS9MWmY5QnVDUmsyeHBvaVhsNnplU0RBWWZZeCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "547e0f9b-7784-4340-9e71-c024916a2322", "record_id": "flaws_cloudtrail:0000115:547e0f9b-7784-4340-9e71-c024916a2322", "row_index": 115, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "547e0f9b-7784-4340-9e71-c024916a2322", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4bHdxWHEwdzh3TTJIODdTT0FBUGxMU1RqVyswang3eHdFWVBHNGk3cGtoL0pOS3B2S0VmZkZFcllzTFVBenpkdXVDYWVaSmFpZVJhQVk3cVhNWEwyeEdwMElMTnJucWFyaW04N1V5V1VVTGgvVmlxbXp1ckt0Y0pOQmZkQmUvUWdqOFJaOVN1a2NPMk1nU2FnekxSd1RQbXh2L1ZCZ0ZnSXRoODJiRDVNUlh4bmZyc3ZuYUV2WUR1YVlEd0JrYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d911596a0-c723-4b21-bb38-839bdd0a0b98", "record_id": "flaws_cloudtrail:0000116:d911596a0-c723-4b21-bb38-839bdd0a0b98", "row_index": 116, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d911596a0-c723-4b21-bb38-839bdd0a0b98", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJydWx0UkMydEZBamhQREJ1SENLTjJiVkhuOGZmSnJuSTlOK2Y0bElJUFZRdU1Oa2ZmNVZyZ2NpN3J3UWZQWno0SVNhTXZwYlVDYUtNQkRXZnk3Vk9FalNiazFBVFdidEY0RGlpQjNJbW41Q3h6K1JRMjZlTmJYVHpKeGJiSkdhQkhCR3VTWXZWdGVpRUVlbm5MaGZBSnAvdGZVYnAyU0tvMW4zWUE2UWhmRTVzcG9lY1pXWnVSTTVGQ3BMWWFpUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49ef28f8-b24e-4d9b-9cee-2eeab140c3c1", "record_id": "flaws_cloudtrail:0000117:49ef28f8-b24e-4d9b-9cee-2eeab140c3c1", "row_index": 117, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49ef28f8-b24e-4d9b-9cee-2eeab140c3c1", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5R0hzMllOQzRoSDJGUmVMcDc1T0lzTnppeXVocEhxSktKWnRTNkFOMWp5eEs1SUIxTUJraEhiNU1lSU9XOW56YW43Vy9FOWQzU05GbjRSQnhGMVI3VWxDVlZkbDEzV09ycGVRZy90Y1RJelBGeE91TEVOMmhteDFIaTI2dDhwdEVVN2o3RDJncHg1WHEvemx2cXVlY2JRSkwrVW4xNFVwY29kWnd4RUNxcE10WlZOdCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfd1a09c-0f93-41a8-86fd-0a6ff83b98c0", "record_id": "flaws_cloudtrail:0000118:cfd1a09c-0f93-41a8-86fd-0a6ff83b98c0", "row_index": 118, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfd1a09c-0f93-41a8-86fd-0a6ff83b98c0", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhdlFZNDQ3QXQvdXZBMm1sY3AzN0JtQkdSL0hZbWoyQ0tVU0tRQUJmNFFxOWlXdUR4REhQSE9PQXMzakN5QlNtOG9KNm1sbzZCOHo4NlJEOTc0WENsWVZReHhJeUNTRmJqVlhmVi84NndhVUo0SWhJSGZ2L1o1dVoyRURRN2dBYitJaTFJbDgvTkQ5VGNqLzJmVFJ0YjlHS3B3cUtlbnI1VWErNEh0eEJRelZ0Y0N0Tll5eExtclhobSt4RVI4RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "571567fdd-8c57-4916-b551-80cc31f18477", "record_id": "flaws_cloudtrail:0000119:571567fdd-8c57-4916-b551-80cc31f18477", "row_index": 119, "timestamp": "2018-02-24T11:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "571567fdd-8c57-4916-b551-80cc31f18477", "eventTime": "2018-02-24T11:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrZUJNWWhmQm5lWUoycHdzcWJ5V3NjL0U1dTQ3SHhFaWMweVBzeHRTcVc4dU9lME5KR0x4SXFzZW1yRjdQcHB3aDg3c0dSckgrYitxM0twWDBaRlh2ZFV2aEEyMFBMQ1IyUmxDK2d5NUxvOEVtKyt0dHNwL0xDTmVlVmc3aVhQSVVWbDdyTU4wZEk5YkNqTnZWbVlLcm9rUVlIOFR1YmlucmxCK2FOcjhMbk5CWkJMNW1kUFp1eE1mMlhBQkJ0Zz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eabe1991-c968-49e9-866c-656da528b07b", "record_id": "flaws_cloudtrail:0000120:eabe1991-c968-49e9-866c-656da528b07b", "row_index": 120, "timestamp": "2018-02-24T11:23:48Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eabe1991-c968-49e9-866c-656da528b07b", "eventTime": "2018-02-24T11:23:48Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5fee09b4-4ef3-492e-bb7c-2bf0f7d6e8b0", "record_id": "flaws_cloudtrail:0000121:5fee09b4-4ef3-492e-bb7c-2bf0f7d6e8b0", "row_index": 121, "timestamp": "2018-02-24T11:23:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5fee09b4-4ef3-492e-bb7c-2bf0f7d6e8b0", "eventTime": "2018-02-24T11:23:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzS1JqcURiS2dqSjJ0bVJUNDV1TTNLdlAyVitkT0hBTWZpcHppbUhzNm9zT0NXaWZEaFVOcGJrekhCR2kyQm5hQzZNUElib2NtWTBFcW5jYmVpUTEzZ1pVZE8raWFrcUMrSUtHTDgzQ0hxWU5XWE41VThpOXYzTXVhcjdkU2NDRmwydmFtQ2ZjeEMwVWJzaWhzaDdmS3RDZ2dsVnhVK2IwVDZxUlQ4c1dWcGtVVmtLcVVuWDZORTcvdnIxS1FQZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fec25d9c-d67d-47b8-8ea7-cc87af7f8fb5", "record_id": "flaws_cloudtrail:0000122:fec25d9c-d67d-47b8-8ea7-cc87af7f8fb5", "row_index": 122, "timestamp": "2018-02-24T11:23:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fec25d9c-d67d-47b8-8ea7-cc87af7f8fb5", "eventTime": "2018-02-24T11:23:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQU0NrZUc5RStub2dhK3kzTXg2Rk1sMGh0WGNtM1Q3TGVwVFRQK0N6VE1wQ0U4MXFmZjhTb2IyNE9FdTNVZElIUkhrbHVSMjFORGRKSjhjMkVNZXkzelFNS0ZFRzlQNTl5R3RldGNuM1RNaW16U3VoV0FPUzlPRmo5aThEVDM0ZzBuZjdvZ1E3SEZseHdveU9heW43K1poWWV2QWJMN29oOTBPb3MwZngxcXNvbGVwTzQ5UWE3RktnQ0tsbDFtVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10f0c466-3efc-4a0f-b547-99b93f340dde", "record_id": "flaws_cloudtrail:0000123:10f0c466-3efc-4a0f-b547-99b93f340dde", "row_index": 123, "timestamp": "2018-02-24T11:23:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10f0c466-3efc-4a0f-b547-99b93f340dde", "eventTime": "2018-02-24T11:23:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e148aa8f-5041-493d-af24-baf34fc273c6", "record_id": "flaws_cloudtrail:0000124:e148aa8f-5041-493d-af24-baf34fc273c6", "row_index": 124, "timestamp": "2018-02-24T11:23:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e148aa8f-5041-493d-af24-baf34fc273c6", "eventTime": "2018-02-24T11:23:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWSG85SFp0RUhDN083QWo5K0R1cTB5c3dQejl3LzhRUWtRRk9tZWxvdEJMVHE1MENHWnNJNHBEMXpZY0ZTYUpTVEZhZk80REpTWEF3WG5vQWptT0MzYTFWT3VSc3l5NE5EZ2lhTFdwU25mcGJlRDFmcGFNcDBTNVNHaVk2a1pUcHg4STN4aHpKTWtTTUJiQkNRTFZLOWxTeUFoaFNXYkZaNzc2MmxsVXNsN1pYeVV0QkpTSy9aSWs5RXVlRXRSQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0431e5b-8462-45e3-9c83-3126cad164cd", "record_id": "flaws_cloudtrail:0000125:a0431e5b-8462-45e3-9c83-3126cad164cd", "row_index": 125, "timestamp": "2018-02-24T11:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0431e5b-8462-45e3-9c83-3126cad164cd", "eventTime": "2018-02-24T11:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "048037dc5-0ddd-4686-8c74-bbdf68f550bc", "record_id": "flaws_cloudtrail:0000126:048037dc5-0ddd-4686-8c74-bbdf68f550bc", "row_index": 126, "timestamp": "2018-02-24T11:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "048037dc5-0ddd-4686-8c74-bbdf68f550bc", "eventTime": "2018-02-24T11:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2b1N4bzJpb1N6NGpTZ2NqdU5UMUhRbkpJdTR0N1hVRTBmOEZFUFZPeWJhZ3BiZFBsME55V0dKOG4wLzNqaVgxd3Zyb1JiR1pUUlpyWlErT2hyZnMwNGtYN0lhajJscytwdWJPQzZrTzV6Q0s3aEhwY3BCNHRSVEhVeWJTY2hlQm43OUNBMXVVKzFKWStpaVhSaENDR2FjVmYwRGxXSnNJYXp6SytWTHl1bkJtbTVZcDBCdGM3UG5oTTRjQ1JBZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfeb5ab8-27a4-4430-8db0-1edb621837e", "record_id": "flaws_cloudtrail:0000127:dfeb5ab8-27a4-4430-8db0-1edb621837e", "row_index": 127, "timestamp": "2018-02-24T11:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfeb5ab8-27a4-4430-8db0-1edb621837e", "eventTime": "2018-02-24T11:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxdUpwQVZkakRqZjMyV1VmdlYxN2E4NWVKcjQ1NHQ5ci9lQTdpRjhWV2VCVXB2K1ZLV0ZaSHJaUnFnVTRlL2NLSEhTVzlHdVNYNTA0ODQybUlLVXJMeGYrRlNiMUJVejVzKy9wVjJabHFLNUptZUpLTGpFMjNyVjFhSFR2Vjhackp3WnhobkZrT0M3SW9NSU9hMXhOcTBPRHFYRTlNOTl5eVpKZzMybGlBckRYNlliNEMrR2RDNGJoUmkzdzhHZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49ade3c0-6e6d-46f0-a1bf-b068158fd9cc", "record_id": "flaws_cloudtrail:0000128:49ade3c0-6e6d-46f0-a1bf-b068158fd9cc", "row_index": 128, "timestamp": "2018-02-24T11:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49ade3c0-6e6d-46f0-a1bf-b068158fd9cc", "eventTime": "2018-02-24T11:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwYTZSdEg4RE5yYytWZWNDVnRnWjArMS9xVjFjWTVKY0FZbWdVUUc3aUhheUxselBVTENERDJ6Tm4zVGRlcnYrMDdUOSt0TXVkODR0SmNJWmpIREZMUU40YmNNZmFvT2MyY0FDamZtcXg3NE5TbEJPRk93eW90WkdjdmlWdHB0RHkrRnBuSnpsNitMTFppWjBJcXkxc3BHNHBLSU42U2d2VlFtMXNzRks0RWlBUjFwcHd1RC9hc0k4NHNRZHV0VT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce1818c5-6a5a-4374-aae7-0ccd19371d9", "record_id": "flaws_cloudtrail:0000129:ce1818c5-6a5a-4374-aae7-0ccd19371d9", "row_index": 129, "timestamp": "2018-02-24T11:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce1818c5-6a5a-4374-aae7-0ccd19371d9", "eventTime": "2018-02-24T11:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3VWRzMnRoVHVKREg5N3BWVXI5OElhRkhXL0dteUZJZEZxMFVURzBBMDBsQVo2cmtqRlprVkJ5cTBuQlg1UUsrQmo1T0hSNXZpS0RRdlRFdVJYaTBEZi9RSFpxclYrcHZoRmN2azNPcWM0WHpVS1BaelRHRCtMSDd1WjhNWlgxVC95VkJhSVRqcFpHb3FmZllaSlM2L3lHMHJoV25iWE5XM29JbTRlckhtemJEZjl6VnNwVk1KMEM5S1krcjczaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8533faf4-576e-4860-be28-1075ae8be4c3", "record_id": "flaws_cloudtrail:0000130:8533faf4-576e-4860-be28-1075ae8be4c3", "row_index": 130, "timestamp": "2018-02-24T11:24:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8533faf4-576e-4860-be28-1075ae8be4c3", "eventTime": "2018-02-24T11:24:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89c1a961-249e-44ef-9424-9b5aa9013e41", "record_id": "flaws_cloudtrail:0000131:89c1a961-249e-44ef-9424-9b5aa9013e41", "row_index": 131, "timestamp": "2018-02-24T11:24:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89c1a961-249e-44ef-9424-9b5aa9013e41", "eventTime": "2018-02-24T11:24:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNSEtkbm1FRGpGQlAvUlRyMFdLYVlxTTZwNlVsZS9zWjBYd0RndTFOSE02Wi80aXBoYVBEQThPVW1VdjJSVE5kQzVEV2VkVVA3L1lrc0ljRFczcklNMWZLbTdXa1BWdmkzRGpvWmkybDZOd3VESE1nRm5JblJrYlNucWN2UUdIbktyNXFWSkg5ZG1KSEtqN3d1SUU0bnpob0oyVHkzQm9SN0llVnp5ZHZ1aG83RThuU3c0R3dHRDVENzRPZzMzbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0898f8a7-54ad-477f-a3d9-bc826451b6405", "record_id": "flaws_cloudtrail:0000132:0898f8a7-54ad-477f-a3d9-bc826451b6405", "row_index": 132, "timestamp": "2018-02-24T11:24:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0898f8a7-54ad-477f-a3d9-bc826451b6405", "eventTime": "2018-02-24T11:24:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQaWRFaXdTMFJkam5BcC9SeU5KZ1NNdnNJSHZlNE9vQkJ2TU50SndPdENKNmFWdHlqOWxJYkdscmZSZzNQTnRBS0JiUUZsWmVzS1ZXZXU2UGYyeUtFcWlBb3d3VXFGWnBJOXVkRGQ5bjdQaHZSQ0dzOHYxQmNwMkpTVFpUaFdjR2ZvTmtuSXRlWEZKamR6WHEvMlluZTdSTkYvK1c3U0E0WldXQ2c1dWJUSWEyTC9YakI4Q29zSjRFRFZWemN3Yz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32d04bb6-b8d9-489c-8aa3-df1768c1aa68", "record_id": "flaws_cloudtrail:0000133:32d04bb6-b8d9-489c-8aa3-df1768c1aa68", "row_index": 133, "timestamp": "2018-02-24T11:24:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32d04bb6-b8d9-489c-8aa3-df1768c1aa68", "eventTime": "2018-02-24T11:24:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2bkVBR1kxcEFwSU83VXJqei9GdWgzVEVzcDB5S1FncVAzQmtRUFRQSEl5OXVwQTNPeWdjWkJTMmlyWDFiM2Y5THAwMTNKVDAwVnBYN1VxMU5xSEc1RDhaQklyWWcyMHYwaHBQY1BySXlVWEp4dFBYcVUrSWVwaG5ScDBVUjIxUnpDZjErT1QwNU1qaDcxaXN4Mk9MdzJEUENXdGl3ZGYwVktVQ2VWS2Q1QUVYWHFNeVYyQkJVYUpkMHZHbkhDTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e7583d2-852f-4c90-8f90-3c6977af6e44", "record_id": "flaws_cloudtrail:0000134:9e7583d2-852f-4c90-8f90-3c6977af6e44", "row_index": 134, "timestamp": "2018-02-24T11:24:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e7583d2-852f-4c90-8f90-3c6977af6e44", "eventTime": "2018-02-24T11:24:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQTU9DYUl5SEhSMjc3ejJJQ0FlKzBZUHRvaUt6NCs3azR1OGVTVlZ1c29UeXNQYkFxdkQ4WGpuTXp5UU43eFFIVGYzR0ZUNzhUVkZPM2tsUWZ1Wlh4UzBlKzE1MnZrM2llc3A1WGl6SzdrL0UwOEY3L1c3TTZXWjdaMVhCRisvc1F3c09lTjhDSDNxS3k0aEtEa0pMNncxQVIwTzMyeEIrRGcxam1Ga1kvWWJmU0VpK0orN3lNMXVRSEFLeko1bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43b60d4c-af4e-4595-a077-9c53fbc090963", "record_id": "flaws_cloudtrail:0000135:43b60d4c-af4e-4595-a077-9c53fbc090963", "row_index": 135, "timestamp": "2018-02-24T11:24:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43b60d4c-af4e-4595-a077-9c53fbc090963", "eventTime": "2018-02-24T11:24:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07d636bb-5a8f-4ad7-8b5c-f9272c028f24", "record_id": "flaws_cloudtrail:0000136:07d636bb-5a8f-4ad7-8b5c-f9272c028f24", "row_index": 136, "timestamp": "2018-02-24T11:24:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07d636bb-5a8f-4ad7-8b5c-f9272c028f24", "eventTime": "2018-02-24T11:24:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsL1hqWDI5WmNwZmFUell4bTVEMEl6SHZNSHU1dVFHTS9KM2NyS2hVaHkzQWc5QjRhUlp4elBqS29BWXNiem16S2tWQ0pZL0pEdmhHeEVJT1lEWEN4Z1ROd1p1TTNCd0lDZmtzUXFHRUNKVFIvZndZbU15dzNsVEdDUFljOGw0bm14dHkwSWZpY0JGakdnWWk4RWRNQWdSMkNPbnplTGhjcXhNL1BIcUdNNUxSQVlhUDFJSmVVZVl0akhDMnBBTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3f3ed50-9a8c-45af-9ace-7a190c5648f8", "record_id": "flaws_cloudtrail:0000137:d3f3ed50-9a8c-45af-9ace-7a190c5648f8", "row_index": 137, "timestamp": "2018-02-24T11:24:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3f3ed50-9a8c-45af-9ace-7a190c5648f8", "eventTime": "2018-02-24T11:24:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEUUwvb0FYY2dzQUhtb2NPQ3JvZ0dFV28vdGtka1NxZi9HZC9qQTljWjFQOGloVmU0aHNLeWRrZ3g2ZnJjck0wdUxVTml3dE5ja0F4dUx2bWswdGFDWUR1MWxDd0tvaDNpNnVUc3dicVJteDhJYjU4QlJ1eVQ5WnFSb3M5NDNoaHM3ZmF2cnl6Wk04VExYYS9XKzFuTkpnaU81TE53djVkcXBvdUFiZDlaU2U3UHNSZDlzMXZtUTFWQ2daN0VZOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3707ec5-9171-41d0-bdd0-a178126be", "record_id": "flaws_cloudtrail:0000138:a3707ec5-9171-41d0-bdd0-a178126be", "row_index": 138, "timestamp": "2018-02-24T11:24:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3707ec5-9171-41d0-bdd0-a178126be", "eventTime": "2018-02-24T11:24:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlL2ZjVUNlWGRRNXlGbE5Bb29MQ1pSUFRqRFhST0doUGM2OVRlNU1qNStOMExPVkpLRGVmUFNHVlY5LytQdThXYTkxZGZuNzYxOWJia3BIWFRvMUFaNWZyODZhZGFQeW16REVTQ0F2cER1V3B6bi9qZzEyV0VaQ1pkcDNTWjlzMnBKR2Y3RGMxYUNXdHpwU1JFaGFrUEsvajNqQTJYOHQ2bTVDQzloaEZsNXFuSVZmQUx4eEhYVUpZN3ZmS1BNbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c07a1c9-103a-4d35-bbfc-7f9cda247764", "record_id": "flaws_cloudtrail:0000139:8c07a1c9-103a-4d35-bbfc-7f9cda247764", "row_index": 139, "timestamp": "2018-02-24T11:24:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c07a1c9-103a-4d35-bbfc-7f9cda247764", "eventTime": "2018-02-24T11:24:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuWGJac08ybHRoSy9Wa3ZoQlhYNEpxeFBjTnZncWloeTJzQjJCQ2JLUUVwYW9YR0pLYmQySCtIVnVQdTlYb0pRZ0ZheWRtYUFGQ0VvV084SXZlTDR6Z0hmYW0yMmFsbEp2U2t2RE1ZclpZTWs4TXpqVFdqQ09FaUFGMStHMk8zamRXbWVXV3BqVTlxUHk0Vi9MK2pLMTRBYm1EWjlSOFJ6OW1pVVhXcDRWSnZlT0dkcHBOazdqeUpQZkVXUkt3VT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1d8963b-1bdd-4e1b-b1f4-6ce52ae959f0", "record_id": "flaws_cloudtrail:0000140:a1d8963b-1bdd-4e1b-b1f4-6ce52ae959f0", "row_index": 140, "timestamp": "2018-02-24T11:24:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1d8963b-1bdd-4e1b-b1f4-6ce52ae959f0", "eventTime": "2018-02-24T11:24:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a33e6e34-87dd-4a4e-bf62-06ffd891bf4f", "record_id": "flaws_cloudtrail:0000141:a33e6e34-87dd-4a4e-bf62-06ffd891bf4f", "row_index": 141, "timestamp": "2018-02-24T11:24:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a33e6e34-87dd-4a4e-bf62-06ffd891bf4f", "eventTime": "2018-02-24T11:24:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCY3ZMQkdEd0RzVVlaWUpIVUo2a3FnVXIyMnJ0a2NuVllYVTlORDdVckNuLzdrNGh1MWJxYnB5ZzZpS004QXJ4WHgvYzdZcVlTQkpoN0VSekVUelgyM3d6WTcyRk5YN2NkMGwzVlVIczR4Ty9kaWw0dVpDSU13MnlMU1hCTjVNWlMzTDBxazdZL2NabGpDTVBvZ1FYMWZwQ3JJZkJvSGhjSlpGTjVVcmtiZGxCWnZlVHh4blhVc2xPdEdBSSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d193619ae-8d6f-4250-8de0-02157ae825f", "record_id": "flaws_cloudtrail:0000142:d193619ae-8d6f-4250-8de0-02157ae825f", "row_index": 142, "timestamp": "2018-02-24T11:24:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d193619ae-8d6f-4250-8de0-02157ae825f", "eventTime": "2018-02-24T11:24:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1K1ZHZ3FmUE4zdTluREkvaWtmcy9yb1NkYnA0VDFjK3huNk5qbzV0ZTR2c1RFSU9EcU1VbWxFRDNJZkdnK3k0cXJwbWZycFFMV2xGV0pyMTI4Uzlwek1wSG02dHpNWGsxZktmWmZVMk1nTjlscklHZFRveDUyd3I3NTNXNHIrT09TbGxqVDVtOTM4R2l6aGVUQWpMYzlVdUhRSzI3VEY4V1B2WjIydGtlVXNobXlwMiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9daa0bf4-62e7-4970-9fcf-3d9fa5cfb790", "record_id": "flaws_cloudtrail:0000143:9daa0bf4-62e7-4970-9fcf-3d9fa5cfb790", "row_index": 143, "timestamp": "2018-02-24T11:24:13Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 682, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9daa0bf4-62e7-4970-9fcf-3d9fa5cfb790", "eventTime": "2018-02-24T11:24:13Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbc71f86-5c10-44dc-842d-b0351c6c0be2", "record_id": "flaws_cloudtrail:0000144:fbc71f86-5c10-44dc-842d-b0351c6c0be2", "row_index": 144, "timestamp": "2018-02-24T11:24:13Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 871, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbc71f86-5c10-44dc-842d-b0351c6c0be2", "eventTime": "2018-02-24T11:24:13Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'availability-zone' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c412672-f4e7-43fc-9212-a4e38421ade", "record_id": "flaws_cloudtrail:0000145:7c412672-f4e7-43fc-9212-a4e38421ade", "row_index": 145, "timestamp": "2018-02-24T11:24:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c412672-f4e7-43fc-9212-a4e38421ade", "eventTime": "2018-02-24T11:24:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJleGE1Q01uSm80Qzh4Q25lK0dhYmlXS0t6WFR1d0tHU21Bb0xid3RWN05YeEhFNUdGdVVuaElUaG5TRThFa3ZLWk40dGdRV0JyYzFralFkSUZPdFdOcHlHT3ZtaDIwNUVqWGtVSy92TVpldUhZRFBqT2dxZ1B0YU0raVp2NDEzc2c1VkhYM0pPbmZURUJHZmNBUHhiNWVNT3lpNVAwZzJlOXdGRHVUcFFNQXpLUXhac2s1amxRN3Jzekp1TFFjWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1dcc4472-8ea9-434f-816e-088be202670e", "record_id": "flaws_cloudtrail:0000146:1dcc4472-8ea9-434f-816e-088be202670e", "row_index": 146, "timestamp": "2018-02-24T11:24:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1dcc4472-8ea9-434f-816e-088be202670e", "eventTime": "2018-02-24T11:24:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFVHRIMmFtS0JQR01MdVM3WDVUSGtRM0hIcjAwbmorN29xWk01T0R5Qjk5QzExUEZFQldscmZUZDluT203RE5jRXdiZEZrVlprZXdqWjdKV05qOXVIZUgreWVnQjcxSE5QUG1rVzMxMitNbkxUWGhRemlxMWUvV2lTazlMTnVJL1ZVeVBYTE5wVEdrNFAySGtveVBxeTI3NEhuS2lvQitKeUlXMWVmS0JjYmFtRkNaaTRnZW5OWmFoU3EybWVLMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "446884ba-a657-4eb3-989c-b87c2731aa88", "record_id": "flaws_cloudtrail:0000147:446884ba-a657-4eb3-989c-b87c2731aa88", "row_index": 147, "timestamp": "2018-02-24T11:24:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "446884ba-a657-4eb3-989c-b87c2731aa88", "eventTime": "2018-02-24T11:24:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d440ab6d-73d5-4bba-bac8-2079aa7f3ae9", "record_id": "flaws_cloudtrail:0000148:d440ab6d-73d5-4bba-bac8-2079aa7f3ae9", "row_index": 148, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d440ab6d-73d5-4bba-bac8-2079aa7f3ae9", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPNmwrVXhMUzlUS0tUQWpoTlB1bDFUZEhyWW5pakhPMUdRN1dDYTJsaGU1d0h4QUZvRU0wZUJHMWdkTlUyTkJqaXM1bzdTbUxMcGxwSGg1c2c0ampYRGZkQmhOS21EMnlxcHlYRUw4Rmw0Z2FnVHo4TEpPTmFTOGN3amFFb3FtMjZNQVN4K1VlclU0Q2Y0R1BMVHVYQjhMTVMzcDEvNzArc2NRTTNKcC9zMk1oZWI4UWpadXEwTnBQdDdudlQ5MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8ab0a6d-d053-4d22-a595-69ce02639f4d", "record_id": "flaws_cloudtrail:0000149:e8ab0a6d-d053-4d22-a595-69ce02639f4d", "row_index": 149, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8ab0a6d-d053-4d22-a595-69ce02639f4d", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5SzFRY3ZxWUdNVmMyZzNmQ3FHUk5uQkcrcGFQak51Z0ZvbFdodmZGMnE5ZEd0UzB5VVR0eHNmNXl0czcrSnNZUy8yend1LzluMFMwVUdsWVlnRWJndkZ5c0xoNU1WQ1NVclcrL3oxV0twT3oxdzFQQ2tTWERhdisycUhHcjBOREdWUHZxTE1EZ3kzWFh2d1BNNm9WSjVDN2d5RExWbXR5OXRXemhWVEcrQUUrUEZGNTJxNE1FMmxhSXNlUEFBRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "545019b-9be0-40f5-a681-cfc7758b381d", "record_id": "flaws_cloudtrail:0000150:545019b-9be0-40f5-a681-cfc7758b381d", "row_index": 150, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "545019b-9be0-40f5-a681-cfc7758b381d", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPTjZiaCs0WjUyWVNDaGJ0a1NMVFlIc0dPcE4rbW9lTTVIQmlQV2tBd05WRUFSdy83K1h0UVR2akxDSHF5WkxJQjI2eDg3Tm5MMDRWb0U1bVd5NWpHVjFlTmppR0VIL0NOdXIxbjI4OHB3c1hpMW1EVnhSTEdkZWlMeFhqcVZMVEFBWHZ4aE1KZ3YyUU1lenpsMzFQb1NKMmxlbTJyY2x3UG5Gd0hnYmpKUlV5aUczVUgzbnZ3cHJNcGh2MldXUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7633f8c8-7c4a-4604-99c3-551c14f4b1aa", "record_id": "flaws_cloudtrail:0000151:7633f8c8-7c4a-4604-99c3-551c14f4b1aa", "row_index": 151, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7633f8c8-7c4a-4604-99c3-551c14f4b1aa", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIcFVhay9LQ3FRNVhhRXZ0QWpUVk5FK3FvOVNuRUNnQ01XZkp1L0loRnZNa0tWN0dEY2c5M2M5S3FlK3JHMW9xb1dtNWplZDFtTVNRS2cveDJCdEdiS1cwaU1LeXhYRnhhbHNobmFqNnp1L2lpSXFlVFVISks3dEZTMWFFZkdhTjJsRDkyWUYrWkJ0NnpaYnBsMmE4dUZBN3FncTlvUVFNbG54czdiTGs2WWdPR3VDZGMrREljOXVGemtVQjBTOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "211b8f75-2d97-473e-96af-5153d744513a", "record_id": "flaws_cloudtrail:0000152:211b8f75-2d97-473e-96af-5153d744513a", "row_index": 152, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "211b8f75-2d97-473e-96af-5153d744513a", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXdEdkSkp6MXhyY0pCTGxCaXJRdWI3d2h3MUgzQkgwQjFiRzBTTHZJN3FSQkFlUVAyZzk5Q3p2N1p1bmxpK29NWUFyWjFlWmtsSzVUOTBSbG40R2s1d0xrVTc4SnhhdUo2UzVwa3JQSUcyeUVGdVhiRlo0cE45cENSYjRjYkc5dHhhYUtoMGtRNWg5MzhyRmNZK29ndzJNNEdEdmNjS1ZZWklKakMzTGlsRnNtR0huS3FoVGljRUNaOHR1MyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ad6bdd3-655a-4d0e-9108-05a98a08fad3", "record_id": "flaws_cloudtrail:0000153:2ad6bdd3-655a-4d0e-9108-05a98a08fad3", "row_index": 153, "timestamp": "2018-02-24T11:24:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ad6bdd3-655a-4d0e-9108-05a98a08fad3", "eventTime": "2018-02-24T11:24:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsUGhDN0ljMHhBTmZIV21oNkNnMFNMbVBQVEV2OGJ5NVpQU2JwdGkrNzVpK1kxK1RRTjA0R1EzaFc3cGh2VUxxUHVqbHhMR0M1KzRUTnl0amFZajMrVHFVSVdKZFZwMUo5bnlLWFF5bThxNDY1cXVwZmVBK0hVMmtsNElnb1hjYW5QdnQ1V0VUZG1vSW5LRkg4VHdoYVU4RFk5WUxUdTRud25EWmk1cHptQzhKU2JNdzIwR3BobUtBTGJtbWRtRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "823088d13-707d-4580-94c1-438b14b74b7c", "record_id": "flaws_cloudtrail:0000154:823088d13-707d-4580-94c1-438b14b74b7c", "row_index": 154, "timestamp": "2018-02-24T11:24:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "823088d13-707d-4580-94c1-438b14b74b7c", "eventTime": "2018-02-24T11:24:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoR2Q5OE1KY2VSY28zNS9UNnZZMWxLMi9jOUZlZWM0aWtvV1krbWZ6dFV4R1lyQ05sbWdDbWxvclpGSEhBK09oL1pqdXVlaVgvRTRPbFhkWE83RS9lT1k2WEZyTDhoUThGc1phaGdJbGpEZ0g0bTkrUTYvcytNa21nbDlxTmRUM0xGZk1RbXFOb2xKSWVSV0dIRi9LTEROTkd0bkJHNUIwZng3ZU54T242NklCWThLVyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f492250-1075-45b8-8071-87ddc2bf55ec", "record_id": "flaws_cloudtrail:0000155:f492250-1075-45b8-8071-87ddc2bf55ec", "row_index": 155, "timestamp": "2018-02-24T11:24:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f492250-1075-45b8-8071-87ddc2bf55ec", "eventTime": "2018-02-24T11:24:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmNXhVNGNsay9Rdm4wWlpSMW1IOWc2cUdJVFkvZGJCbG1iWU9BWDFUTVhRY0h0MFFIS3Z4RmYrb3d0U2FPNkJBbUx6QWx1QllhanZjOCtKL0NHWFJWdnlZblBBWXR0QlpDL2lmdzRhUUlpMU0rNkhscEE3RHRidE9rZk43MmxHUkg5SE9NdVNuS2psR2EyelQzWUNmYlJuUWptcFZXNG10aGJoRVNJRmliaDlFK1hVK1I4VnhvQkxaNDJUSUlGUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e443f21-fca2-4c57-a2f2-db5f62d50aea", "record_id": "flaws_cloudtrail:0000156:3e443f21-fca2-4c57-a2f2-db5f62d50aea", "row_index": 156, "timestamp": "2018-02-24T11:24:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e443f21-fca2-4c57-a2f2-db5f62d50aea", "eventTime": "2018-02-24T11:24:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlTFI4OWFadmtDK0hZMjlNTjA3UkM3N2JFUVBNVzFnak15cndoaDNkTlQ2cm56a3dZY3VXTkMrRkJ3WHlhemM5MytDVVJWbVlZTWJnbUZCS29FcXg5VHh1Vzd3dzJYZ1VhQWQ0VVdxem1pd2xLREtSRzU2bGNIbW5hMFc1c2dDZldEekZnUStvNVhaajEyK083QnBhNE9vV1ZyN3d3Y2xzR000QVZsMmh1SXBpd1d3aW5lRjhvTFBmZmdiQWJXMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ff0dea1-d63a-4793-a9d8-ffa54fa0d30f", "record_id": "flaws_cloudtrail:0000157:3ff0dea1-d63a-4793-a9d8-ffa54fa0d30f", "row_index": 157, "timestamp": "2018-02-24T11:24:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ff0dea1-d63a-4793-a9d8-ffa54fa0d30f", "eventTime": "2018-02-24T11:24:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "826607c-f565-4b85-9139-4655a8ccb2a8", "record_id": "flaws_cloudtrail:0000158:826607c-f565-4b85-9139-4655a8ccb2a8", "row_index": 158, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "826607c-f565-4b85-9139-4655a8ccb2a8", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1SjY0dmRIK2FYUlp2MFZFZHZEWUJqWE44SmJ6NTlKZkRmRjR4Qm1mS2ZuZzYxVVdQZjJIdGFWamJSY25JdXlaVEdTY1hOQmpldW5tRit1N3lFUTV4WklKSzltdk5vSlpkakFYM0Z0aW9RWTl3eHRSL2dxVHVWbnVId1JyWS9WUUZ4dTNRV1ZORHVjNHNVdFVJdFpHR0Z3c0M3R1J4MnpQeEIrMDh0WStrOHRxK0p2M1JuVkIxaERxUjRkMSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "665ef215-66a6-402c-b993-8e5cbd4a6d10", "record_id": "flaws_cloudtrail:0000159:665ef215-66a6-402c-b993-8e5cbd4a6d10", "row_index": 159, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "665ef215-66a6-402c-b993-8e5cbd4a6d10", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhWnlVUlI2NENSNnhjY1NvZXpUdTdSYlllQXZqTlRXbWJVL2JzekpkTlU2ZkRLNXFzQnI2ZjhkZ2sxWXRsdDNZS0ZVdE40VjhQUGVPTnRpRHU2OEV6NEVYUzNzdWRCZVplMHA1Q1lIRitCdzZUWkdKbU5CRmczSjVSUkU4ZStOeklWbit6cUliTUdMTHdUN0FMSUxQNHlzNU5pTXhyV0lMT1lyV0pJUERzeWlobjZNeWQ5aFlWb3dGaXZNVEsyQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ec275ec-5957-46e0-b151-3a91d6de66dd", "record_id": "flaws_cloudtrail:0000160:3ec275ec-5957-46e0-b151-3a91d6de66dd", "row_index": 160, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ec275ec-5957-46e0-b151-3a91d6de66dd", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwdFBPNnppdmw3MURJS1h2cUdiZnVxbktDTWovdXA2UGR2UTZZQVk4ODZmUE1sVXZ6Z1Y4VHNNVXRwbGpaSDJTNktuU1dDT0NOamxaekUrVXNUWVpHYzhuRjlFRHBkamVhZXFoYmlNS1l6T1kzNW42WG15VDlIbGJtU0pKSW9XbVQyR0JYOHRUOEJKSCtPclVyVlhoRUtkNlhiNURuazF5cEFqeEpFRmd3UEJ3MkdWYzYzMEd4a2NkQTVGeXlLTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae24836-0387-4029-8da2-65e4ae60ee00", "record_id": "flaws_cloudtrail:0000161:ae24836-0387-4029-8da2-65e4ae60ee00", "row_index": 161, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae24836-0387-4029-8da2-65e4ae60ee00", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXTzFkUEtSS1hqQ1d1TDNUVitFZ0gzdWhjQUhoYjBWKytiK0xvamE1cmZMM0ZBMUpyRnJWOVJzWWhQY3VYTXBjbktkR2JGYjBCVnAwZnpId0RhRkljQXJjY2pDVVQwK2tON3dSU25YampORFB2OTFGd1gyY2NIenFLK3g2eDVvNTdTQVh4UDJpQWdBMzhURmI4MmgxN2tidFJwTlg3VkhZMzdVcWRsOTNRMmxScTlwQURFYmRwQ2syRGdBVlJzZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31146f3-30fe-43b9-8d22-760822f94f85", "record_id": "flaws_cloudtrail:0000162:31146f3-30fe-43b9-8d22-760822f94f85", "row_index": 162, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31146f3-30fe-43b9-8d22-760822f94f85", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmeVBONEVMdWJ3SFUzT3Rrc3lnT3RXeFR2ZU9NTWdvUXF6ejVIUEwzTnNwRDAvVXZNd2NvanBkRkdiZVlMcmJyTzdwZ3BDY3FaazQ5YU80bHd3akp4UDFCOTJwdVpvb3JnNXpjUmhTcXFqN1VubkRXSUJUd0pidXZmVEc5Qk5tUDlsNVZoSS83Skk5dy90MXJMcnRIVGZqNktJTE1XNkFYQjk3dVNtd1R4WDN0cmZGN0VXZjN1RGRuRHVLYmk0az0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "191dba22-e2bf-4c84-8431-d2dc4f9911fe", "record_id": "flaws_cloudtrail:0000163:191dba22-e2bf-4c84-8431-d2dc4f9911fe", "row_index": 163, "timestamp": "2018-02-24T11:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "191dba22-e2bf-4c84-8431-d2dc4f9911fe", "eventTime": "2018-02-24T11:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1OGNFQ2h0Mk5hZFZ4cTdFelFDTVBLbjRCclF3U1dTdWo4Wk01QTVYL1c2SWl2MXc1UHV1ZjFjOEtWSSsxbXFOVEpzbWV0Z1U3TW9JR2lSN1JkVzdWOVVTRU9KaHpmRkxTK0pLeUdBK090bG5TcUp0bTVESVdvWXFZS1dwOWxqUDBMdjRSV2JxSnZVdnp5SENBOE1aWEdPc2x0eVQxS2pqc1pOK0NvMFhGTTU1QWdpbnBGaTdkSDkzYXBHSTRrVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08feaf6e-7190-4b55-a4ca-dfc7cc3776eb", "record_id": "flaws_cloudtrail:0000164:08feaf6e-7190-4b55-a4ca-dfc7cc3776eb", "row_index": 164, "timestamp": "2018-02-24T11:24:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08feaf6e-7190-4b55-a4ca-dfc7cc3776eb", "eventTime": "2018-02-24T11:24:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDUTh0ZlhGZURXK1JsKzV6UVhWNWJlYkNtdjJ4dWhIMmRDSHJLak5acS85RTRrVEpBaFNndjJTRkw0a2xwY2o1NGtacCtXRUh2QlRrN0t6VUxvVjRiQVVhbjNhSXBXeHROMThhQTZYbUtiVS9ER1pUeTdvUGhDL1BqSk1EeHlIR3Rxa3E1Y3A3dVNhK2VkMFUxM09hV0E3NmhENzhDS2hXdzMzY0NURTZ3SHVxNzRuSiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "64cafb7d-978d-4094-83ad-d7689c593cf3", "record_id": "flaws_cloudtrail:0000165:64cafb7d-978d-4094-83ad-d7689c593cf3", "row_index": 165, "timestamp": "2018-02-24T11:24:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 854, "raw_record_depth": 6, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "64cafb7d-978d-4094-83ad-d7689c593cf3", "eventTime": "2018-02-24T11:24:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'nginx' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "nginx", "valueSet": {}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8d18c9b-e5a5-4fa9-b26b-433f28c7afb7", "record_id": "flaws_cloudtrail:0000166:f8d18c9b-e5a5-4fa9-b26b-433f28c7afb7", "row_index": 166, "timestamp": "2018-02-24T11:24:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8d18c9b-e5a5-4fa9-b26b-433f28c7afb7", "eventTime": "2018-02-24T11:24:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d30f320c-74fe-4690-a163-2e0492f2fafe", "record_id": "flaws_cloudtrail:0000167:d30f320c-74fe-4690-a163-2e0492f2fafe", "row_index": 167, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d30f320c-74fe-4690-a163-2e0492f2fafe", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBVUh5dXhXd0wvQlVaTWhGMkVDUHcreHUrQnBFR29oSUdaUVFnTUJMOE5oZmptQ01nRUR3bU1meWtNckRUcHlpWWlrUENiSEIwb3hjU2kvNFROQXpQSEoyWERod0Q1Q1ZzRysxMHBsY2F2UWZpRjdOb2tDaWRqOHhzQXJLcVRORndJUVdOK0UyRDQwcHhSWlQ2L0FMeW5TdURvMjQrQm9iL0pVbm1vb2tobGZ1N3ZiVmlrdVhHenRtTzFjREYxRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d18f3dfe-1fa7-41a8-aee2-835c50265b", "record_id": "flaws_cloudtrail:0000168:d18f3dfe-1fa7-41a8-aee2-835c50265b", "row_index": 168, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d18f3dfe-1fa7-41a8-aee2-835c50265b", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOdmU2Wk9YYlR5OEt3bzBpSUNWVnZWc2dTcFFLQUlJV2M2MzE3ZzBaZzFPQWkyVnRXcUFxWC9WcnVES2NhV2dpcUgwODNTZjVaQXlMZW0rS0RKSlZFeFJvOGVReWRKRkVjc25SVUUrZjBvb0gxOUlJLzU2VUlmL1BxbzBIdVdOM3I3emJ2VEUwT2NkOFdXSVhkQ1N4NERvQWt4SEZ1bHk5bGtwaE1LNGtiUUJ1VzJGZU9sbDFNdGFYUnFHQTdGST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d881dba4-63ae-4ca0-8289-bed019423f3d3", "record_id": "flaws_cloudtrail:0000169:d881dba4-63ae-4ca0-8289-bed019423f3d3", "row_index": 169, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d881dba4-63ae-4ca0-8289-bed019423f3d3", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrWlgyYlNsbzR1a3VRTUk5Q1MzNi9UTjVVSXBVQU9LV1VhTzRqaG9zbCtrNU4yN1F4UEtwbExKK3h6bzJmeElOQTZsSjVuRFdMaG8weHhFczVUTUlEamJJUkMreUJKRUJybUMxR2FRUldkU0R3ZGkxUHZHN3VOamNzYUhOc1BkMjk2ak1LU1ZyYWxuYU5jcUMyNkhXUkwrTW1GWW1qWWtRSVp6Y0JFSTh6MkFxWVMyUnovZXNEY2F4MVlnb3hwUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebe358185-e8ce-4eed-844a-87df63166362", "record_id": "flaws_cloudtrail:0000170:ebe358185-e8ce-4eed-844a-87df63166362", "row_index": 170, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebe358185-e8ce-4eed-844a-87df63166362", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxSm1hRjFnQk1XcFhzR0JVMGRKdjJYM3RQclBKUXNBeEpJRkszcm1sVnlNa0pKc21uWTVqeXJMcEtXdjRJTHNQQ0pyZm01MXBpeThYMDhzdXhWdGppUEtETVRFSmxnWU9lckdEVi9vYzhVRE51MG83bzYwTkJ1dTZ5SUR1d1F4cGRLWFhod1JGTTdLNVBva1lZU203RmROdno2NC9CNFpmdnF5SnovS3I3TFg4Q1RSS2drWjVvdk50d0RnWmllcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3f69eae-3aa6-4ae7-8e5d-30cab9012cbd", "record_id": "flaws_cloudtrail:0000171:d3f69eae-3aa6-4ae7-8e5d-30cab9012cbd", "row_index": 171, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3f69eae-3aa6-4ae7-8e5d-30cab9012cbd", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpNGZPQUU1cDRGdGo3UllIeU13ZGRZUUVBelFwQkp1NG9tRGVjVzdDVFZ0TkpwVkZrUEF4K3N3TVR3ajBXaWtYekdwemVFOGxlKzh0VzZQZEk3Zkhyajh0YThJQkF1a2JFYmtac29xbHBJbjZxSk9XZExFYStkVU05MWU5bjlLSndZbWNRTnRpSjIxUFE1MS9sSnhDRjZwd1dpcTdIOUlzSTBKYWtXWHRGOEptMUQ0M0t6R1p2NE1JVjh5VXJMdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eeea508e-7c92-4fd5-97a8-68552d979b01", "record_id": "flaws_cloudtrail:0000172:eeea508e-7c92-4fd5-97a8-68552d979b01", "row_index": 172, "timestamp": "2018-02-24T11:24:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eeea508e-7c92-4fd5-97a8-68552d979b01", "eventTime": "2018-02-24T11:24:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUN1crWjZSWDBxZm9xRkVGRlFHTEVxSVNQVGs0TVBuYkY0OGYxYVlNMExiSng2TGlhY1Azc3I5aU1pcE1oajVJaG1lNnMzV2tJNDZHNXNOVVJRblJZWWxQQWRnNE0zOFhXQ29BOWtId2UvNW5PcjJyUTliT3k5QUgrUWtWbDdGVlA0eVZWRTljRU0wVnFONlRueFVxRG0xZDJJRzc3dFIwRFUvY2hnQW5NUjQ1Z1FoQWRZd1VicWw5YklUWkxvYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ba9b257-b796-4620-b5c5-a2d71dbc89ca", "record_id": "flaws_cloudtrail:0000173:6ba9b257-b796-4620-b5c5-a2d71dbc89ca", "row_index": 173, "timestamp": "2018-02-24T11:24:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ba9b257-b796-4620-b5c5-a2d71dbc89ca", "eventTime": "2018-02-24T11:24:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1QUhUTjV1NHhqMDJBc0hJNXdVNGMrOHFKZnpJTEttcWk0ZkRpNktycmhPZVJTZzJ6aG1Pc2RhSG9VYU5TUmNWdmwrdnlMZXQ1N2l1YSs0QWRUVkFXSTNNT282NmQ3cTVPNU1SOFVKM2htSFFFeXR2SUhFcnRiN2ZYOTFuSGJXZitxRUpadmZrOUFVK1JIdWpudWVLVFVlTGxpdkFjR2U0N2JjQTBLcDQ2MWxrdTV0UFM2SytpczlkQTlrZzJVUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e97ec591-9662-44c6-b64a-8fb20e0514cf", "record_id": "flaws_cloudtrail:0000174:e97ec591-9662-44c6-b64a-8fb20e0514cf", "row_index": 174, "timestamp": "2018-02-24T11:24:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e97ec591-9662-44c6-b64a-8fb20e0514cf", "eventTime": "2018-02-24T11:24:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtT1N2SVpUL3dBTEQrNU8vbUtadW9ud3pLWjE2Z0M0SHdQL3IxRnF0YVJRbm9WaFRxSkl2NmRia05mcktFc3V6RCsyWW9ITjNSampRZERqTU1QWi9IRXlRYW9RM1E5T3pCcXBlQVJwbXZLaVJvSUE5dFJhZnF4OW1lMzJUaTBsZmFqUk9hQlV0TUlJd2E1SkRwZ1VVYUFOUStna2xsNVlBTFZqYm5JbFJ6N1NPQjZ6cSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "072fbc89-cd7a-4295-a31b-253b7b3115bd", "record_id": "flaws_cloudtrail:0000175:072fbc89-cd7a-4295-a31b-253b7b3115bd", "row_index": 175, "timestamp": "2018-02-24T11:24:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "072fbc89-cd7a-4295-a31b-253b7b3115bd", "eventTime": "2018-02-24T11:24:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrNW15bEFRbDNhM3FIZGVFY1ZxbWJOdnU1REhVaEE3SU9vVjMvMVBjb2FaWCtpQ2dEMGtwNTcvUlM1aGFkUzFBaTN3dGREOFFRZS9nK2o0Uk0yOXdtU3R1L0FnYThTYmh5WnVXMWphQ2czeGpWaGJTdnkvdERlSWRpaVZweHdUMXk0alRsNjUrMVI2NnhyRS92ZHdCR1BpN09WcFZORXV6dXZnQWFEaklsYlBhTkcvSmk4UndLbk8xVEFqSiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c833c6c0-a5a7-41b0-a507-2f3480ca983c", "record_id": "flaws_cloudtrail:0000176:c833c6c0-a5a7-41b0-a507-2f3480ca983c", "row_index": 176, "timestamp": "2018-02-24T11:24:35Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c833c6c0-a5a7-41b0-a507-2f3480ca983c", "eventTime": "2018-02-24T11:24:35Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c1163ee-7b61-42a5-9f22-69fc821a6e6c", "record_id": "flaws_cloudtrail:0000177:2c1163ee-7b61-42a5-9f22-69fc821a6e6c", "row_index": 177, "timestamp": "2018-02-24T11:24:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c1163ee-7b61-42a5-9f22-69fc821a6e6c", "eventTime": "2018-02-24T11:24:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ead2104e-9095-47af-8801-f805c0879da6", "record_id": "flaws_cloudtrail:0000178:ead2104e-9095-47af-8801-f805c0879da6", "row_index": 178, "timestamp": "2018-02-24T11:24:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ead2104e-9095-47af-8801-f805c0879da6", "eventTime": "2018-02-24T11:24:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca48d2d3-6f54-4190-b979-8831f80ecfa4", "record_id": "flaws_cloudtrail:0000179:ca48d2d3-6f54-4190-b979-8831f80ecfa4", "row_index": 179, "timestamp": "2018-02-24T11:24:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca48d2d3-6f54-4190-b979-8831f80ecfa4", "eventTime": "2018-02-24T11:24:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3e23696-5ca2-47c5-a4b1-340299ec6d0", "record_id": "flaws_cloudtrail:0000180:a3e23696-5ca2-47c5-a4b1-340299ec6d0", "row_index": 180, "timestamp": "2018-02-24T11:24:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3e23696-5ca2-47c5-a4b1-340299ec6d0", "eventTime": "2018-02-24T11:24:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxME9YSjRZUWlMNHlUS0x0MVNWQ09rYlo2ZE1hbUJJaUdzK1JlSFV5NTU1N1ZRVmlOaXhIQkMwdFQ1VFVYOVc5M2hkU3JuRjdmQTRjQStDYnhyUUZSQThFRyttQXNyL0tpVlByVHo5SG4zRnpydmRuTzF6SHVpaENTa1RwTWg2VDFtSWN2MXF0dnFPTDFtbFBnNFI0eC9BQmIwMmxaSXR3eGpVMzJFaGtOdC9lTzBrSjNaMHBVRTZ5ODdjSTExaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1607a459-e0c9-48f3-b5df-ec9bd86d8f39", "record_id": "flaws_cloudtrail:0000181:1607a459-e0c9-48f3-b5df-ec9bd86d8f39", "row_index": 181, "timestamp": "2018-02-24T11:24:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1607a459-e0c9-48f3-b5df-ec9bd86d8f39", "eventTime": "2018-02-24T11:24:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0OS82VWMrMVBaazl5cTdUM0Rqbys2RUJPSU1EdTloa2RzS2tVVHg4UUxrTm5qNDFRekhxOE03RDcrWGlOTEk0RFRGajFTZHh1SjVpamNQTzlqeTI0dlFHN0ZoT1graURINk05eDhVTzBhbE1zQjhiWC81RVdzRWExMjBkUUp2VmY3SkxzNmM2WlNoUXRFY2RWczlVVXh3SzNwVEl3cGphdTR4MjFycjBwU1BGM2VPQnhEWlZMSXZVYXlGWHdZdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f429e005-b91e-4464-8857-79b48e405152a", "record_id": "flaws_cloudtrail:0000182:f429e005-b91e-4464-8857-79b48e405152a", "row_index": 182, "timestamp": "2018-02-24T11:24:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f429e005-b91e-4464-8857-79b48e405152a", "eventTime": "2018-02-24T11:24:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "acbb2cbe-8e9a-4d67-b0b1-204684d", "record_id": "flaws_cloudtrail:0000183:acbb2cbe-8e9a-4d67-b0b1-204684d", "row_index": 183, "timestamp": "2018-02-24T11:24:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "acbb2cbe-8e9a-4d67-b0b1-204684d", "eventTime": "2018-02-24T11:24:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78b75e63-d4f1-4a23-ab68-9653b04601e9", "record_id": "flaws_cloudtrail:0000184:78b75e63-d4f1-4a23-ab68-9653b04601e9", "row_index": 184, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78b75e63-d4f1-4a23-ab68-9653b04601e9", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1SnBJVDRNMXFZdDVJejVodXhFREgwU291NnBheCtUM0dkTlpPcStic0UrbUpCVHRhOHA1N0ZxUFpvbjVBK0pncjRPQU1YcC9Va1RMMTFCQmJNdzBSQUFYdlg1bE1BZHB4YkNrd3QxL3lZd0U5TEllVDNFVlZGWGtuWFRVUDF1M0lOaE9yY3BYTUZqbHpHZlkycHpodTNjK01ONnZpS3FoVUJkYVJlODFOYjl2cjU3TmJCbE9sYlJIZ2VjZHduUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93b05df3-482f-442d-8786-0b4091b3e964", "record_id": "flaws_cloudtrail:0000185:93b05df3-482f-442d-8786-0b4091b3e964", "row_index": 185, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93b05df3-482f-442d-8786-0b4091b3e964", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1Qy9JcVJTbTFkbk1YQ0Y2SkxQYU5oa1laRE5hMmd0NTJKWE5SWjBSWXRITjRUeVAra2NpSFRKL0JBYmNwZTg0b2h0OHRJSkNlbUxFSVU3dzNnbTZpYWJ6NG1ZM1JZeE1lT1h6eTU5aWwyaHZ1dkozbmpYdDFaUWxVb3hocUJPaXkrOEpZb1F1ay9xUUYrdWtTaFR2bXBoWDJYZ1dpdHRBNzUydW1Rb29Oby9xUGU5SUNvODRqMHZRN2FKbkhUdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf3789e3-2600-4fbe-ba08-687d9d801d93", "record_id": "flaws_cloudtrail:0000186:bf3789e3-2600-4fbe-ba08-687d9d801d93", "row_index": 186, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf3789e3-2600-4fbe-ba08-687d9d801d93", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqdjRWUFBWYWc3UXJZaDhIM1FUSEk0MFNEZ2JqS0tkZ2R1ZnJjekRzOTM5aHJpM1Y2aHhUallBd3hUR2xJNzBJWVJ6K3VucE5TTlZ0THJkdzM4bEdUNTU3aVNnVGtsNnYzamEwU3VKWHFPVUw1dzVHN3F6NmN3NkJPTGtsc1dHWDJMRTgwNzNueTZZeEVqUGFtUzlIS2kvQWNFY3VZNmp5ejB5Ymtnd2kyWWJQVGpsaUlHRTdzS0VyQ01pTUhOVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9b1c446-7123-40d9-8225-a539610a", "record_id": "flaws_cloudtrail:0000187:c9b1c446-7123-40d9-8225-a539610a", "row_index": 187, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9b1c446-7123-40d9-8225-a539610a", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXSnBBbXRhd2NXejhXemlxSSsweHRmQ2RkdWg2cW1MYkY2bDhlSmlvWk5Xa1lnUktra0VNcnBWT1kzRkZ5d01JNXlTQmJURjhVUlJiSmVyKzlkVWVySHRPT0lRZ0trUEpPSW9RV1VPZHNBUzBBYzRBQkpxenhTWWRNSnpQK2F1UjIxZ0dsRFpUVndsT1VTWHpBK3JRaTllL3FFc2lHT0wvUEVXY2g1MXl1cTVMM1laNHVUUXNhcC9TNUNoRiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89af30c6-b3d3-4ad8-8f52-cce87c5288cd", "record_id": "flaws_cloudtrail:0000188:89af30c6-b3d3-4ad8-8f52-cce87c5288cd", "row_index": 188, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89af30c6-b3d3-4ad8-8f52-cce87c5288cd", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0VG5oajltOVo1eDRhbzhjZ0UvanFwQksvaDVYQVVVYUZwQ24vWjRiS0pzcTMxNWx5QldGUmFWSGVBRzA4N2xmUTNFSU1Ld3ljYlVSc3hvZlJpR3IwTURJeWdkWWpzYXVWRjRERGRRL0o1S1J1d21oQjhtNlBQclh5Vk1tZlNXNjBrQ2lMYkFZN3lkNXJDL2VFQ0xTbVFobjIyQ3Avb0s2K3E4QjhYd0xCeHZiOEFEZmpxMGZpMXNZTG1EeGpBOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbbd7824-6a5e-4d30-9768-d388aeeec2a0", "record_id": "flaws_cloudtrail:0000189:fbbd7824-6a5e-4d30-9768-d388aeeec2a0", "row_index": 189, "timestamp": "2018-02-24T11:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbbd7824-6a5e-4d30-9768-d388aeeec2a0", "eventTime": "2018-02-24T11:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHRlpHOS9FdXFlZEhjYkNzVWFiTDh5RjlwSjd4ZitSOHhtb2Vpc093YXFPVTZ5bThQWGwzcTdwUFIyU243UWE5NnBhdnA5OENIT0ZaRFJiclJoZFcxeWVKWVVKUnFRYWRHRnpvT3pBenpKQVYvcEczbFV5c0hhelhwaXJpSWxSbFFMR2Fjd2F3NXdkSXhEVjE5M0QwMFpIMktSVTRURlhPQnBOVEs3UXZ2NFFBemJ4QStEbXlNWU5hTVIrVnhFQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68d8bfbd-f6b9-4b57-928c-bb95682233f7", "record_id": "flaws_cloudtrail:0000190:68d8bfbd-f6b9-4b57-928c-bb95682233f7", "row_index": 190, "timestamp": "2018-02-24T11:24:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68d8bfbd-f6b9-4b57-928c-bb95682233f7", "eventTime": "2018-02-24T11:24:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fd5f0bb-6b01-462a-8884-289f82a0c05a", "record_id": "flaws_cloudtrail:0000191:7fd5f0bb-6b01-462a-8884-289f82a0c05a", "row_index": 191, "timestamp": "2018-02-24T11:24:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fd5f0bb-6b01-462a-8884-289f82a0c05a", "eventTime": "2018-02-24T11:24:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMRVQ0OGpGenNqOHltZjNPeVVNSVQ0cjlkVWhJTFNJUFprbWNhSUpPQ0FlbFVLMlZoNnh4UFM0NnM4c1U2OWF1VWhKcEpFdkpxeW9uY0g3UTdDOTZ3dU1IQXdPRkc4Tjg4ZFZzclBwMTU1Mmd1Q2ZYQ1hYUW8vVUdTS2M5cWxPaVhWWUsxVkdNODhsa2xwcCtuVXhCU0IvdzdLcld4U0p6T28xVlZkYXFsV28vQWQ5cSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49b8d477-0ad0-45dc-841d-65a4d3d2d3f0", "record_id": "flaws_cloudtrail:0000192:49b8d477-0ad0-45dc-841d-65a4d3d2d3f0", "row_index": 192, "timestamp": "2018-02-24T11:24:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49b8d477-0ad0-45dc-841d-65a4d3d2d3f0", "eventTime": "2018-02-24T11:24:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20fe64b2-cc4b-488c-bbcf-87983764c9fc", "record_id": "flaws_cloudtrail:0000193:20fe64b2-cc4b-488c-bbcf-87983764c9fc", "row_index": 193, "timestamp": "2018-02-24T11:24:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20fe64b2-cc4b-488c-bbcf-87983764c9fc", "eventTime": "2018-02-24T11:24:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10c842c1-d54d-4850-b111-772afcb0ba6b", "record_id": "flaws_cloudtrail:0000194:10c842c1-d54d-4850-b111-772afcb0ba6b", "row_index": 194, "timestamp": "2018-02-24T11:24:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10c842c1-d54d-4850-b111-772afcb0ba6b", "eventTime": "2018-02-24T11:24:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a122adad-b5fa-462f-af65-558593c532d3", "record_id": "flaws_cloudtrail:0000195:a122adad-b5fa-462f-af65-558593c532d3", "row_index": 195, "timestamp": "2018-02-24T11:24:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a122adad-b5fa-462f-af65-558593c532d3", "eventTime": "2018-02-24T11:24:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7f73b32-7c82-4de6-9c6d-1ec255f7ce19", "record_id": "flaws_cloudtrail:0000196:e7f73b32-7c82-4de6-9c6d-1ec255f7ce19", "row_index": 196, "timestamp": "2018-02-24T11:24:48Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7f73b32-7c82-4de6-9c6d-1ec255f7ce19", "eventTime": "2018-02-24T11:24:48Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54b39fc5-1868-4ae8-b2b4-ad1b0ad714c2", "record_id": "flaws_cloudtrail:0000197:54b39fc5-1868-4ae8-b2b4-ad1b0ad714c2", "row_index": 197, "timestamp": "2018-02-24T11:24:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54b39fc5-1868-4ae8-b2b4-ad1b0ad714c2", "eventTime": "2018-02-24T11:24:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38b73014-82a6-45a7-957e-ee0068215812", "record_id": "flaws_cloudtrail:0000198:38b73014-82a6-45a7-957e-ee0068215812", "row_index": 198, "timestamp": "2018-02-24T11:24:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38b73014-82a6-45a7-957e-ee0068215812", "eventTime": "2018-02-24T11:24:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21e00a90-a28a-4f7b-8333-e7530d81af75", "record_id": "flaws_cloudtrail:0000199:21e00a90-a28a-4f7b-8333-e7530d81af75", "row_index": 199, "timestamp": "2018-02-24T11:24:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21e00a90-a28a-4f7b-8333-e7530d81af75", "eventTime": "2018-02-24T11:24:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04d69b59-aed3-4fd2-b7c0-55c246a0a0be", "record_id": "flaws_cloudtrail:0000200:04d69b59-aed3-4fd2-b7c0-55c246a0a0be", "row_index": 200, "timestamp": "2018-02-24T11:24:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04d69b59-aed3-4fd2-b7c0-55c246a0a0be", "eventTime": "2018-02-24T11:24:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "711343f1-2798-443f-bf9b-4c12917eecca", "record_id": "flaws_cloudtrail:0000201:711343f1-2798-443f-bf9b-4c12917eecca", "row_index": 201, "timestamp": "2018-02-24T11:24:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "711343f1-2798-443f-bf9b-4c12917eecca", "eventTime": "2018-02-24T11:24:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3df2896-1ac6-4f7d-807b-a0e3532bf4a0", "record_id": "flaws_cloudtrail:0000202:b3df2896-1ac6-4f7d-807b-a0e3532bf4a0", "row_index": 202, "timestamp": "2018-02-24T11:24:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3df2896-1ac6-4f7d-807b-a0e3532bf4a0", "eventTime": "2018-02-24T11:24:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4eadabe-5f0f-4d5a-bc1b-e3f8eae0d00d", "record_id": "flaws_cloudtrail:0000203:b4eadabe-5f0f-4d5a-bc1b-e3f8eae0d00d", "row_index": 203, "timestamp": "2018-02-24T11:25:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4eadabe-5f0f-4d5a-bc1b-e3f8eae0d00d", "eventTime": "2018-02-24T11:25:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d39b0151-8384-452c-a7cd-403187e008cd", "record_id": "flaws_cloudtrail:0000204:d39b0151-8384-452c-a7cd-403187e008cd", "row_index": 204, "timestamp": "2018-02-24T11:25:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d39b0151-8384-452c-a7cd-403187e008cd", "eventTime": "2018-02-24T11:25:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd82175b-1976-4db6-8437-f095ce3d6cc5", "record_id": "flaws_cloudtrail:0000205:fd82175b-1976-4db6-8437-f095ce3d6cc5", "row_index": 205, "timestamp": "2018-02-24T11:25:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd82175b-1976-4db6-8437-f095ce3d6cc5", "eventTime": "2018-02-24T11:25:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e471bf0-ad01-4eea-b3e1-9da6da29c5ad", "record_id": "flaws_cloudtrail:0000206:6e471bf0-ad01-4eea-b3e1-9da6da29c5ad", "row_index": 206, "timestamp": "2018-02-24T11:25:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e471bf0-ad01-4eea-b3e1-9da6da29c5ad", "eventTime": "2018-02-24T11:25:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a770f652-4bc8-450a-9d82-4c787efbafc1", "record_id": "flaws_cloudtrail:0000207:a770f652-4bc8-450a-9d82-4c787efbafc1", "row_index": 207, "timestamp": "2018-02-24T11:25:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a770f652-4bc8-450a-9d82-4c787efbafc1", "eventTime": "2018-02-24T11:25:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoS1NxbnZxQmhQRm5saVRGQkRLeSs3akhwRlozT2xWQzZHNWxSMURZOHcxV295ZytoRi9zck5xNEI5RXNQVHYxbDZvQmtjanYvb21vN0R0UlQyVC9DZXQyZXlKbU1sem9EMUVVbVFiN1NFZXBGc29pQVN0L2tQU1UzK3ZIK3hPWko4RlZ5aUJsY2dYelZxT0JuaDJ4TjhxNjBiYXJxd1R2NnBzdUZHeWZBSmpra0hiMFFVQVVyL0g4UGJ1a3FnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9219f8d6-4035-4c22-a6dd-8445276c4cf6", "record_id": "flaws_cloudtrail:0000208:9219f8d6-4035-4c22-a6dd-8445276c4cf6", "row_index": 208, "timestamp": "2018-02-24T11:25:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9219f8d6-4035-4c22-a6dd-8445276c4cf6", "eventTime": "2018-02-24T11:25:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzajVhL0dsTFNZNDVzc3FYZWt6SmtTcmI5RjVkRGd3ZFRabHh1dGtnZytCdEJHelJ4Y0RsSlAyY3JIS1I4SzluK2NnTFR3S1Z5czgwRzBZTUhsQ1AzNXlhM3E0b1pzSzZkNmxvK0FRcVBxbW5uazdLdmwxOU02WGRDdUE0Nyt5aEx5TVdaSGh2dGJ2VkhnUmxUVEpDWTE0S2Zuc2x4a3IzazVUbVAyTlQ3MThlZlRrTnhvNmR3SGJoRXBYNEgzZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10c70495-1bc3-4774-9977-4f2a68b828071", "record_id": "flaws_cloudtrail:0000209:10c70495-1bc3-4774-9977-4f2a68b828071", "row_index": 209, "timestamp": "2018-02-24T11:25:16Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 736, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10c70495-1bc3-4774-9977-4f2a68b828071", "eventTime": "2018-02-24T11:25:16Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "952359f8-42ff-4474-be4b-99fcc21af737", "record_id": "flaws_cloudtrail:0000210:952359f8-42ff-4474-be4b-99fcc21af737", "row_index": 210, "timestamp": "2018-02-24T11:25:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "952359f8-42ff-4474-be4b-99fcc21af737", "eventTime": "2018-02-24T11:25:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrV1NZbjdhUzZscHU2SVBza1dIVHZmZ3JyY1NCVEVNbFBsV3NBRWZBc0prc0dDL1NRM2hMSVpEV3A4bWc1TXBhUjZrWVhRODhjTnN3OENGd1pGYmtTZ3VPWWZMWnpjMGFvb0VjTGNObnFkTDl4a0Q5Y082N3ljWDk4TFNUZWx5ZnAzRktkeEUvL2plU1pPcTRTb2VWNE9qRmJpeStMK1gyRjRCWGdiaGo5cDJ0Ui9DUzRxcHVXZnBia3QrYjNNZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99c677eb-69a2-4c76-8578-94cb0cc378310", "record_id": "flaws_cloudtrail:0000211:99c677eb-69a2-4c76-8578-94cb0cc378310", "row_index": 211, "timestamp": "2018-02-24T11:25:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99c677eb-69a2-4c76-8578-94cb0cc378310", "eventTime": "2018-02-24T11:25:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnM0ZRVUF6OTIzOGFOUWtPL01IRC9CbEgrZHg3dUEzWHVCVnNTRVpjZDZTNXhXanhwMlRBNmJ2YThyeHdFMU90Y3N4eXdrNkpsOTh5NDU2Z2N1b2lYTmpzeUN6eEdoakJuVnJnNFVwRE5ReG43QjdZbW9WaGxRMDBrK3ZmSjlvSWZGNDNIaG01VTFSZmZWaklIRVMwNG1QSzJ3Q3RmR2wyKzFOYi9yNjdjME1HbW4xcVd5WE1TUEhoNndjQnBBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81b8ea41-3284-4706-a8a9-9d49ed20c0fc", "record_id": "flaws_cloudtrail:0000212:81b8ea41-3284-4706-a8a9-9d49ed20c0fc", "row_index": 212, "timestamp": "2018-02-24T11:25:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81b8ea41-3284-4706-a8a9-9d49ed20c0fc", "eventTime": "2018-02-24T11:25:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUb1Fvaks0aENaN3pFUDVuUGlVV2pMZkxnTm9icFpVdTZKTVgySGZhM1J4Q3F3dkJ2M1poTkJHNmdEQjRkNDlINGp1U1dPNVhlcmZ5cllVYnpHWTU2NFZyL1NhMEdoQVRoOWFpY0tDR0xFeEl5dUM0ZHJ3NTZsMmw4UCt5V3NhNERCY1YxczdZdmlrNUxrWEpQRU9YNVNrRVZzOEF3dTh0UWdwTmNVMzhwMDMwSlNXL3RMLzVsTXBHQmVJTzJlWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31c3ade0-ed1c-416b-b786-b7cfff0ff8d1", "record_id": "flaws_cloudtrail:0000213:31c3ade0-ed1c-416b-b786-b7cfff0ff8d1", "row_index": 213, "timestamp": "2018-02-24T11:25:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31c3ade0-ed1c-416b-b786-b7cfff0ff8d1", "eventTime": "2018-02-24T11:25:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvcC9pcHMra0FpeEhEM1V5MmxPaC95VnR4VllQVnpTSUxMQVF2cEVPRXI0NXVhMXJuM2lGNHAvUEJTbVdEb3FHajl2UFowRU1oU2hNdUx3WE44K2dDd3l0RXNsWGdnYm84WXoyT0RRT2JyeHlERlFFeEZPWk9makozTVJSanV1QU16SHZyN21yY08wZ3gxQnZNOGJIK2pndEl4dU5XSEI2YWoyWWpza1dzN0Zjem9QUStCYTR4R3VDaTBBYlQ5TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc811cc8-5d27-479e-b350-6c72be103c0b", "record_id": "flaws_cloudtrail:0000214:dc811cc8-5d27-479e-b350-6c72be103c0b", "row_index": 214, "timestamp": "2018-02-24T11:25:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc811cc8-5d27-479e-b350-6c72be103c0b", "eventTime": "2018-02-24T11:25:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6L3hNR251MlYyS0tpakx4RGMweHZWQ3dWREtERzNZc09VZCsyeFRWUFZRWkh5K29kUitTeGhYYkVXWm1ZVWJXTDNZd2FyOEJjNkMvR1ZFeExLdVAvZUtTNXFVUGVLYTgxb3VTYmI0dlZMREJBd1M5Rngyc1prU3FlMnJxcGJwaGdFUzRoSVBkOU1FOFJXU3hYcnlHd3Z2eHFnUGgrb2I4eEVPSnd4bEZQOVVxL2hnZXNUbkh5M0tabmZSRlRKdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0fbad7e-4645-4853-a886-4ab8a031f8b4", "record_id": "flaws_cloudtrail:0000215:d0fbad7e-4645-4853-a886-4ab8a031f8b4", "row_index": 215, "timestamp": "2018-02-24T11:25:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0fbad7e-4645-4853-a886-4ab8a031f8b4", "eventTime": "2018-02-24T11:25:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11ce2e25-2703-4f54-8511-74b809874a", "record_id": "flaws_cloudtrail:0000216:11ce2e25-2703-4f54-8511-74b809874a", "row_index": 216, "timestamp": "2018-02-24T11:25:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11ce2e25-2703-4f54-8511-74b809874a", "eventTime": "2018-02-24T11:25:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0NHN3TjA0WkpPWVFFangvcnFKZmI3dHZtWG9MOTFkWUxRUE83N1BsVElQTEtkTHVPbjQ1M0xEbGtWVzkyUWVabm52eWhwODhqMWZvNVB3SEMybnlvVkltb1RTb3pzaXdrdENIczU4RWJYL1J6UVNmOTM0TGFHb3J0M0RqcGloM2ZGM084Z2Z3M3J2UmN4Z1VRZUpRbVl2ZGZOVlAxYm1uMFNxYkFOSmtXZkc5bnFRUyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac9aff07-6b44-47e3-bde7-6d72f631a88a", "record_id": "flaws_cloudtrail:0000217:ac9aff07-6b44-47e3-bde7-6d72f631a88a", "row_index": 217, "timestamp": "2018-02-24T11:25:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac9aff07-6b44-47e3-bde7-6d72f631a88a", "eventTime": "2018-02-24T11:25:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhNmI5WkxETnI5aEpYUEZiM2FsNU0zTDhNbDVVRkU1YTF6NFVjRU1JcXpseUxkT1pjd3owQ2tLaU43Ym1aQm40bjhYSDRscldLNUZMT2lBMHZyV3o5cTlrSTgwbCs1VUdrNFVVVWJhQWFIMWljMzRveUhIcjB2bHpJb0hMVXBKazRIKzdKWFdtNEFHeFdKUlZpWHViRnM1dUlCUDZYUDA3YWRxZDVpM2c5WkFmanYxUU5nb3BqRGtrTEJrUllBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20139-d57b-482f-96c3-3dcfd545d3b3", "record_id": "flaws_cloudtrail:0000218:20139-d57b-482f-96c3-3dcfd545d3b3", "row_index": 218, "timestamp": "2018-02-24T11:25:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20139-d57b-482f-96c3-3dcfd545d3b3", "eventTime": "2018-02-24T11:25:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8d945c3-559e-4fbd-8f76-10f4075f060f", "record_id": "flaws_cloudtrail:0000219:b8d945c3-559e-4fbd-8f76-10f4075f060f", "row_index": 219, "timestamp": "2018-02-24T11:25:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8d945c3-559e-4fbd-8f76-10f4075f060f", "eventTime": "2018-02-24T11:25:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ee287a7-3099-4c9b-aca2-cd78733", "record_id": "flaws_cloudtrail:0000220:1ee287a7-3099-4c9b-aca2-cd78733", "row_index": 220, "timestamp": "2018-02-24T11:25:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ee287a7-3099-4c9b-aca2-cd78733", "eventTime": "2018-02-24T11:25:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFeWpNcXpzN2kzZG50U2JMdTFqb29uL25BdkVGc281Q0VZTWs1WWxIaWJMZ3lCdmEwWkpyKy9NcXRGQ0pvaTdLTnU2SFl3T3R5VE84V3N5cWMraDhpZjZHU0VBd1lKbUJWOURCSGtLejVXWVZOWTdVSWtrdEtsTjZzS3U4akxIZ2hrbFEzNER2dlFkZ2l5Y3hjekZVNWV5d05VNmYzaXlBQlhOejU3cEhUSWU2Vi81eW4vbXdSMW1MY2FwaG93dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "774336-48c5-4772-841e-28e56de9e6e0", "record_id": "flaws_cloudtrail:0000221:774336-48c5-4772-841e-28e56de9e6e0", "row_index": 221, "timestamp": "2018-02-24T11:25:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "774336-48c5-4772-841e-28e56de9e6e0", "eventTime": "2018-02-24T11:25:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJndVpSMDcvMUpYdzRiNm1sUGpmejBDUUs3K0RwRnc5SFptSktQZWRpdmpXR0VLN1diWGppK1lQMFN3QXpxNW1vYlZPSTF1Ulh6QldGVTkzcVVad1F5T1hOMk1HaFFBQ2JmaUVkVUdCM29tUkViOGNuTDJTRTU3RHVQeThPZXB0M2tEcjhacWd4aXh1WXJRT2VZbFg2Um1Sc3lFTkZQYzNyTHIvYWk2TG5CYkpmRVcvVW5RQ1FhNm9NWXNIRFBRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae78108a-41e2-4797-9fea-9b70d7512d6a", "record_id": "flaws_cloudtrail:0000222:ae78108a-41e2-4797-9fea-9b70d7512d6a", "row_index": 222, "timestamp": "2018-02-24T11:25:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae78108a-41e2-4797-9fea-9b70d7512d6a", "eventTime": "2018-02-24T11:25:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwaWRMT1EwYVc1cUFseVhiemJUNHh4c3NsNTNaaWZLcENsbktBYm92R3VjUzlSMjN4NE5YbDMyMU1QYUlDdzIwLzVEbkQxTmUwa3ptOGlsM3ErNHB1bVJ4MjQ0MnRwbFVrOWlBT2NmTWM1c0RGa3o4ZDlwY2Z0V2ZNSm5UaFZQeEFWUUR0eldOaGl5ZmRBZjJ6c3hsTXI0aWpVNWJrYjVQaU50SndWV2diN1VpckxWbnRnRmhscUxrR2RISVZwVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c471a8e6-d1f9-4ac2-a826-4d6cadd3b92c", "record_id": "flaws_cloudtrail:0000223:c471a8e6-d1f9-4ac2-a826-4d6cadd3b92c", "row_index": 223, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c471a8e6-d1f9-4ac2-a826-4d6cadd3b92c", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJbm40NDlRelVNYTAwOWNPMUx0b2FISnFSUjV6eE9pcHZBZFBWdWRFMmo0Yzc2RDVqS0djSDhJM2RVeGNJN1FuQTBwRWdjSHlLK0hKUjR5blpMMFZWRzBwRlpmRlYwN2gzNk45eUNNNjFCWHFGanN6V0tCUFVIeDZHZnNpbEhmenNoUFJGNzZOaEZZdnpnTGZqVXo2dzAwV1MvSEdpOFVKU3JnZTdLSVNUNTFzVTcrN2JSblBqSXNRNzZZbzZGYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef09d9df-6e80-4da7-9c65-06bfdcc9c373", "record_id": "flaws_cloudtrail:0000224:ef09d9df-6e80-4da7-9c65-06bfdcc9c373", "row_index": 224, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef09d9df-6e80-4da7-9c65-06bfdcc9c373", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVU0RkbWIxTnQvcGdBVUJNb1A5R2ZhQzFNUU9aU2NvVnUyN1ZlVWFNYmZIN3YyQWRMMDFMbE1nRGV1bkxvaVRjSjNMSXI2RlI1bVVsS2taZzFyRzFPeXE0Umhqeks2TjBnS2ZlelJtZjhyZWhkNXI0MFJ5WWJ4K0pkOVhSSlVPMXJHYThPTFVQMThOT3B6RFd2ejJTVjBNdW9RcGhuamdpV1k3WW16VXFQM2VpeU9VbSszYXVsMHI2VmpQTks1UT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0172a8c-504d-42db-a018-a26a596eb3c9", "record_id": "flaws_cloudtrail:0000225:c0172a8c-504d-42db-a018-a26a596eb3c9", "row_index": 225, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0172a8c-504d-42db-a018-a26a596eb3c9", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHZ2s1OFMvTVRJZHJSV1lRUUJtYXJaWTBpK004eXFVZjB6anBhcmwzVFM5b0JHdktsYTJ3NEQxYkJHTldLYlFuR1R4YTh5VWxNZ2t0MjJlQkRIS2t4bGhSS21aRUQwVHlMc0I5UHdXRVh5aStqTjBWTjhGU0kwODRPUDBRQWx0ekdINThVSnEwZEJ5dUY5dzVPUjd2NXNaM0N1Q2xsRys5cmEvM2FMUkppMkJQWStycUpEZzg4MXY3RGNlL1JnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5998f247-2565-4396-bfc5-f9b3cb818d70", "record_id": "flaws_cloudtrail:0000226:5998f247-2565-4396-bfc5-f9b3cb818d70", "row_index": 226, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5998f247-2565-4396-bfc5-f9b3cb818d70", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1aXNoL05zQzZhUmYwWllENUhnd0hyaTZDVEpGZndBbXA1bFNscmVWS3JzQk4yR0Vid2FLRDdveDd5WWR0SHZJY1NoVlhPMHlPeStvWHp6MkVDQXovSnVZNXl5VjQyMUpjZWd4VGJxajFlWVpIQVVaaXR4VHhvWlNWRWxxT3oyQTE0dGxVQVViWXovQ3ZRM2JYV0V2TUUrQ2tNZFN1UGdrdzdYZElzRFEwWElTUm8wV1p2QzNsbm4zU094QURBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0a915bc-15c5-481f-b290-d871f29241d7", "record_id": "flaws_cloudtrail:0000227:c0a915bc-15c5-481f-b290-d871f29241d7", "row_index": 227, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0a915bc-15c5-481f-b290-d871f29241d7", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqZlRGOGZJbHp4Z3lXeDd6aCtzZkRHQ3o2OThwWWFaSDFTTXRaZjNWSFlSNlN2WFd3VkFObXU3R09VNWlsdGtBQkdkSi93Zld3WHU5c2FYT3VOZHV4Mkl4d2daU0R0em1Vbm44UXYzVmxac0V3RUg4WlVKQmVPZkFNUGZHRnN4WHVaekNQUkhwZk5zUzVJamgvNStiaTkyVFBFcXU1dzBRSFZ5TVdlRDVGYUVrM0RmZzZkU0tJNUtoRlJSQXZ4dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54b8940e-2ec1-4a36-b434-9c6f025eeebf", "record_id": "flaws_cloudtrail:0000228:54b8940e-2ec1-4a36-b434-9c6f025eeebf", "row_index": 228, "timestamp": "2018-02-24T11:25:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54b8940e-2ec1-4a36-b434-9c6f025eeebf", "eventTime": "2018-02-24T11:25:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzSDhRUG1GQlRCWndyYkdQZklvSGtqV2dZaWpXUVA4YVlXTEpFRWswTCtEeHFINFNYaWpyY0Z2cnZMcTJvUWpxcHhLSEE1WTV3ck1GbTI1VFFLVUF5dm9lOG5jaEQ4cHcyOWJEaWE1L3ZiQk5MTWpYRW9SbGFKQVc4dEN3U2ZQem5vWGVablNGZCtYaXZJWHZ4Vm5tdHNqTEpjSHlqSWVSQ3Q5UkRuQjZKakZkWDdYViIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcacc682-efba-44e9-803e-2d66e493a72c", "record_id": "flaws_cloudtrail:0000229:dcacc682-efba-44e9-803e-2d66e493a72c", "row_index": 229, "timestamp": "2018-02-24T11:25:32Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcacc682-efba-44e9-803e-2d66e493a72c", "eventTime": "2018-02-24T11:25:32Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05fc326f-0138-4254-bbf6-2172f82a452f", "record_id": "flaws_cloudtrail:0000230:05fc326f-0138-4254-bbf6-2172f82a452f", "row_index": 230, "timestamp": "2018-02-24T11:25:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05fc326f-0138-4254-bbf6-2172f82a452f", "eventTime": "2018-02-24T11:25:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4609fdfa-a9da-47fb-a067-23ed6534c1db", "record_id": "flaws_cloudtrail:0000231:4609fdfa-a9da-47fb-a067-23ed6534c1db", "row_index": 231, "timestamp": "2018-02-24T11:25:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4609fdfa-a9da-47fb-a067-23ed6534c1db", "eventTime": "2018-02-24T11:25:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2R2pRZlVGMkxZejZiWXFsdlh6ZlM5QmN1ZkRrOTdHMWo0clFFYVZidGIzS3hGVGUvT2U4aUcwMjE4OHlRaG95ZHpXRGx6Wk51UTZBU0FhRmtKUVFhblI0cFh1akk5djA3c3F3Ry9USllyQWdhR2xraWdZbmNNWFV1OTZLYWpuSUN6R0Y3dG5RckVZdlBDWFZ0RmZrSHFiVmh0NWlXVjVDcG43cEx2NlUzUjJQVmxJL0d4Tk90VFM5aWhBSDlnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abdf91d0-b157-4976-a9ff-175f0b269824", "record_id": "flaws_cloudtrail:0000232:abdf91d0-b157-4976-a9ff-175f0b269824", "row_index": 232, "timestamp": "2018-02-24T11:25:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abdf91d0-b157-4976-a9ff-175f0b269824", "eventTime": "2018-02-24T11:25:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a933b936-daca-4559-a9c9-547af577cd4b", "record_id": "flaws_cloudtrail:0000233:a933b936-daca-4559-a9c9-547af577cd4b", "row_index": 233, "timestamp": "2018-02-24T11:25:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a933b936-daca-4559-a9c9-547af577cd4b", "eventTime": "2018-02-24T11:25:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWczdOWU9OUTdCYmpDaGR0R2dmeEQ1d25nbEFhSzBoK1VGRVVDSjVxVWVYZ1llWThqZ3VjN0oxcWo4U1ZqQis0a3kzTUdWME56djNReUhFU0l1TjhHdzdLTWJvRGQ1dEZsLzVxRUZvS1IyVEN6c2tkWk0xblcxblNhdjBHVjZLWXNYb2tFUGtFa2ptc1VOYWE2b2hrZDdZUFEyNmNPdGZOVEhTdE9aLzZNWXNvMW1tSzJZU0tCOHMvWEtjOE43Yz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "832262ae-3e6b-4c82-bce7-ee70e8d9bcd4", "record_id": "flaws_cloudtrail:0000234:832262ae-3e6b-4c82-bce7-ee70e8d9bcd4", "row_index": 234, "timestamp": "2018-02-24T11:25:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "832262ae-3e6b-4c82-bce7-ee70e8d9bcd4", "eventTime": "2018-02-24T11:25:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2Q0w5aGgyOGhTT25uQXlVQVBWVlh6cm5adDlpQWxvT2VyRlN6U0RXVlkwcEZJNnJ6azFuTFpoVGs1WTdyTkRFcnRqWmxaRjgrUUJxYkp4MVZobGZPdnYybm0xb250bEViN3B1T3FmRFFsYk5kMWoyNDdERUhDRWtmWUlXWTlkRzlodTlPTVp4M21mY1FrbjZpV1U4cmxaNFYrSjc5OCtVZXhzQmVlSTVmVEVuS0tTZVBNYXpxV2tnQ20xY3p3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "733bcb5c-94bc-4a12-b9a7-d67608bf4", "record_id": "flaws_cloudtrail:0000235:733bcb5c-94bc-4a12-b9a7-d67608bf4", "row_index": 235, "timestamp": "2018-02-24T11:25:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "733bcb5c-94bc-4a12-b9a7-d67608bf4", "eventTime": "2018-02-24T11:25:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoN256R1hJZzNKUGU3VkFteWxzS1lzTWNWTDlpV3g0V0lYcFZGUU00SjhTby92SEY2eGlrUUJNdTArTS9ZTUlsRTVWSFhBcVp5MUdiRnpjYkEyOVFwRnVQMFdqU3plUlhVbXRqMlZUd0tpWXpWZTBJTHE3Z2U1U3BvTzQrbTRVUlExZnQrYk1aRGlwZUNpWHRJTGxnZk9nUXlIZFBocVZyTHdXQk4zdUVqZkdTcDB4YXE4M2xrYkJaTmhHRXFlRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "076f4131-c85a-470e-ae01-521e51e4c863", "record_id": "flaws_cloudtrail:0000236:076f4131-c85a-470e-ae01-521e51e4c863", "row_index": 236, "timestamp": "2018-02-24T11:25:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "076f4131-c85a-470e-ae01-521e51e4c863", "eventTime": "2018-02-24T11:25:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzT0xmcFJXU0pjSHhtbGhZZDBmSjk1c0tjYWRRYkV1cjhZQk13bHh0MzV0dHV4UlFCZERqb1pEbWlKM3dwdG5ZSExRQlFmNXFCT05UUWI3TWhkcDZSTTRDa0ZMcFpYeGE1dTJJdVMxN3k1dUJMVy9IemVYamZScVJ5dW9kUjhuVzFLV1dEZkhycFE4bmJxUEp4U3JWeFlZSEkyekMzUVE0NTVRM1VxL3hrNUNZVmswTWRGNnk3RGRRdldBZEFFWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ab85fa7-5f9b-44b9-bd30-7af34e14a418", "record_id": "flaws_cloudtrail:0000237:6ab85fa7-5f9b-44b9-bd30-7af34e14a418", "row_index": 237, "timestamp": "2018-02-24T11:25:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ab85fa7-5f9b-44b9-bd30-7af34e14a418", "eventTime": "2018-02-24T11:25:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSMGNXTXFyQXdBUFdTWnZTR1MxenlyNWRpZEZXZmhadU1rblF0VEMyY1duNzdzWlhHZDJSSW5IVnZSYnc5WmhtVjNuU0RKd2lwZDlERTQzWG5VdmZOa09zMCtjU0MwUGtlVHdEOFcwYmhpV2IzMTlQbFIxUDJ0RUZXc01tcm5NZmswMWdzL0gyYWN1RnJueG5SVThVVDQ4SGkySU9ORHhnaGh2V3FuUHJaa1lTbE1FTE5FRVQ2N29jL3pENDJ3WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "716531-84cb-4ab2-85ac-95929ceacb0a", "record_id": "flaws_cloudtrail:0000238:716531-84cb-4ab2-85ac-95929ceacb0a", "row_index": 238, "timestamp": "2018-02-24T11:25:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "716531-84cb-4ab2-85ac-95929ceacb0a", "eventTime": "2018-02-24T11:25:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKNnYxbjVFb3BYODJxYzlrT2t2RjBLVU1pemlLK3BDbXUvQWk1U3d3MUo1bUFjWEdkWmlYYU9CQmhLdHFpOWJ4dTRoL1VVYWgrZENRWDV2YUxwYmE2SmswK2RsUUdyeENBQUpuRFB3aWhGS2lXc1hxd0tYSVRmTjlSaXpuY3g1ZjNVUVFzQlg3akM5bzAvSStTRXduVVJjTys5OHFUamtBQWZ4WC9LT0ZKNVNWTU8zViIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8957e0e-5494-4dd8-a1d0-87bfd4e5895c", "record_id": "flaws_cloudtrail:0000239:e8957e0e-5494-4dd8-a1d0-87bfd4e5895c", "row_index": 239, "timestamp": "2018-02-24T11:25:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8957e0e-5494-4dd8-a1d0-87bfd4e5895c", "eventTime": "2018-02-24T11:25:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4VmRRcWMwT0V2R3doWmMvZWpxNkxTaEZyc2RZdUNmQWdUNG83NDNKTDB0d1pHMUI0ZDFMbTZ5bGc3ODltRU1uQVlHaEdjSjlGUTRQMjF5VTZGZ0xqU0l2U3hwVGxxU3EvRUxlMGRvblBNYzRRQlNpc1BYUEFaZ1pBU1M0SVJKaEVmcDhQbDM5MmRLWjU3aWNKNXdOUUl6WVNURDBseS9hSEw4R05WU2tHNVVST0xSVW1rcVp6b3RhdlVlRHlnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95a302216-4d71-42f1-a67d-afdd41af7550", "record_id": "flaws_cloudtrail:0000240:95a302216-4d71-42f1-a67d-afdd41af7550", "row_index": 240, "timestamp": "2018-02-24T11:25:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95a302216-4d71-42f1-a67d-afdd41af7550", "eventTime": "2018-02-24T11:25:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFOUIrdDdoU1NlUzBOekJWWUZ6Qjg5dkJaV3kvaHdQWU1PMmY4RDloRlloNVJqMFhvem81U0NVWVJIWFZxS3ZDcENMWEExai8wcmhyV2NFc2QxL3hodmI1WmYvVXpuekJwMkFpeFgvYmlXcStXUGFSZnE2UEJ2WVR4cEI2MnZ2RE0wRi9kZVFtd1hhaHRMbUw4Y3gvSm1ESVhDUGNHSTlGeDEyV3ZaZkUzNHBSSmtNQ0hFQll4ZEljMjhlRU9Icz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0025c40-8427-4232-8c8c-d0cb5c14f41b", "record_id": "flaws_cloudtrail:0000241:e0025c40-8427-4232-8c8c-d0cb5c14f41b", "row_index": 241, "timestamp": "2018-02-24T11:25:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0025c40-8427-4232-8c8c-d0cb5c14f41b", "eventTime": "2018-02-24T11:25:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "289f6cd7-7cd7-4f6e-a6bd-dfd5a08273c7", "record_id": "flaws_cloudtrail:0000242:289f6cd7-7cd7-4f6e-a6bd-dfd5a08273c7", "row_index": 242, "timestamp": "2018-02-24T11:25:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "289f6cd7-7cd7-4f6e-a6bd-dfd5a08273c7", "eventTime": "2018-02-24T11:25:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1eFdZZlBudjB6SlJYZHdKeVRtbjBiTWxoWUw5M3NoUW5OS0xCZjNMTTExdVFwS0EwdE5QdEhFVjhzZWI3MXpLL0hTWEdOSTkzWGwrZmE3OXAwZy8vTGZ1bzFmSXZFY0F2Y3RtbThleVdZS3AvZGtOZThYNDdXZzh5Q2J1bEwwb0FyMWxyRm9Pby8zaGxpTDZmd0FpSGxMQzNjSE5ZTmFOSkJMeFN5TjEyODlHMHp3alB3bW41akRZQjZNSUdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85b628e5-fc77-44a8-9850-b94773d5", "record_id": "flaws_cloudtrail:0000243:85b628e5-fc77-44a8-9850-b94773d5", "row_index": 243, "timestamp": "2018-02-24T11:25:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85b628e5-fc77-44a8-9850-b94773d5", "eventTime": "2018-02-24T11:25:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuSDNwaGYxNVB4aFBVSjQxY1BrU3VtVFgwd21Ma1BFQVN0a0RMakVmd0h2Yzc3cTlFRE5zVURJMXVFQW1NNFF2cHN6M3JRTE1md3lkdk5vVTFxSUx6WGpYMXludHM0em9lcGthN1dLTjRUblpmbFprSldEdjVmMXVPckNGNXZROEF4d2wyYVhDeHlBOENqemNyTk1DRXQwdHFnUjhURWl0RXhXa1ZaWjJtWlcyWWlGZUFrTk9vOCsrbVV3OUh2ND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0df643b-6538-40b5-88e3-a543ce80e9cd", "record_id": "flaws_cloudtrail:0000244:f0df643b-6538-40b5-88e3-a543ce80e9cd", "row_index": 244, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0df643b-6538-40b5-88e3-a543ce80e9cd", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWR3lLcStONFdncDlQL1lUbmRvK2dsTnZpMlZQbUhjUmV2V3J4Y01FVThVU2dPdHlvazRoamVuV3dCM1hJa3lmVTBtV3RHdllKZjYwaThXbGRZczdzSUZyVUF0YWZTOFFRL3ZVRUt4aFpnZWxpZDllRHNJTDR0c2FPdkFPQ05WRUdGeGFnMHlYRk5yRjJsQ3QyanlRRU5KK2hxd1FLd0JWL2ppRVkzTU1XMVB1bXVCYWVaRU84TzZVNFZ1cmNnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3939db7b-1901-448b-9ca3-d94146f1a8a0", "record_id": "flaws_cloudtrail:0000245:3939db7b-1901-448b-9ca3-d94146f1a8a0", "row_index": 245, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3939db7b-1901-448b-9ca3-d94146f1a8a0", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBRC9teXY4MkhuZEJ3bVh6djZqL2c2b2M0MlhHSE4xdk9FQVFDTTVweWtTVGU0aGE1TEdKcDN5YVpFcm5pcHVPSmtVdFM0T09ibzBMNUg4OGsrajZrbGp2NHZwQmc0Mm1NQWJWZzV3TWRBZjlHVGtMOUV6S2JuK3pDaXMrNDFScWRyakYvZVVvSk5QME9Mcm5HaWZiQWt1MVJNdG1zejNrTXM3Y3ZkMEZhcTRZZ1RtNGU5UmhKSEkrRmNzL1ZiND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "912bc2b2-fb93-4917-ad17-93d3a323e8af", "record_id": "flaws_cloudtrail:0000246:912bc2b2-fb93-4917-ad17-93d3a323e8af", "row_index": 246, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "912bc2b2-fb93-4917-ad17-93d3a323e8af", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtclMzRjNlZGo3WmxMeG11RFRIclRTbG1QWkFLbUxrWS84Mlh1QzFRN24zVlVwc2JPejBrc01mUkoySDYrTzlGQ0tiaDJIZXI3VTBrMi8zRWdFN3E0dmEydUxaWGgwMUFrQXFqMUhMK3Ewc0l3RmliMXI4K0hGZ0FrWGxpTXVVZlJVUjA0aVJ4K3V0WHpyRk5sOEpSSEhRSnBiS0lJQTRtc3pGdmY5Y21vRThDUTIxNHd2cE1DVCt6dkw4aGVnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af142e31-35c6-4619-960d-7610535ddcf0", "record_id": "flaws_cloudtrail:0000247:af142e31-35c6-4619-960d-7610535ddcf0", "row_index": 247, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af142e31-35c6-4619-960d-7610535ddcf0", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1Nkt5d3hsYlVJcE9EWlMzZnFFL2tOeHdONldCc3dyWEhqa3FUS3RhNDBjZFlCMjcxM1A2RzZadnpKSEhhdkN2RkhXYWoyY1FTMTlad1VUUjJqandodDVrb0tZeTMweGJhVVcxMFhmREZNOUlYVzk1UjVhREp2NTlCTi9VVjN1ZUE3R2kxT1YwMTltRUx1SG1PR1d2MVIzb0tnZWhTeWRtVmpIUGg3OEJuQ1BMcnpxaGZ3RnUvMG5nVXdqUFgyaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae60c0b2-41e7-43dc-8cf0-c7140a3e19b9", "record_id": "flaws_cloudtrail:0000248:ae60c0b2-41e7-43dc-8cf0-c7140a3e19b9", "row_index": 248, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae60c0b2-41e7-43dc-8cf0-c7140a3e19b9", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGY1RESmtCdndJSWE1MDVWdm5uSUxFR3lxVk5MNE9sUWNlUWxVZ2tHcVdzaXZEL3hEZ09UMnQ5aTJXcFhmdkIwTlNEZ3JsWGZNTnJxRlM5enF5SnIycGFoWVlZWXhCZitscE5JZFJabGRZYmE0dHlwVGU3czNHTDR2bTJ5Y2RFYVlJdlhJYnhGajVzQWgxTFFRN2pYMXp2eXc2dWZpQWcyVlJYZnpxNjBDbEkrMlhaM0toRzJQc0pWQkdWbWJ0TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c805f270-8aba-4dd6-a8cc-3261de65d6bc", "record_id": "flaws_cloudtrail:0000249:c805f270-8aba-4dd6-a8cc-3261de65d6bc", "row_index": 249, "timestamp": "2018-02-24T11:25:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c805f270-8aba-4dd6-a8cc-3261de65d6bc", "eventTime": "2018-02-24T11:25:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0Z2FmL2wzc053bVBFcDBWZnJjd3NBQkphSlVzK3UwKy9vRyt1eXhSOFRPU0h5Qit2UTA3RVRxL2NxNWdyY29sQjVwcVJiL3k5K29ubEx4STVXdlZUaVVHZlFiTWdlY1pHR1REaWRvN3FlcGFuejFFa014UjVleG0ybHRhQ2F2VWxJeGdyZjBLMVBrOUhXZ0hUUEwvWWRTL3AwM2dQN0RKbHBrZE54MFRkeWIwcGZEajIvSHRnR0Z6ZnR5aXE3Zz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f26fc969-9879-43bf-beb2-b4c304d9ab6b", "record_id": "flaws_cloudtrail:0000250:f26fc969-9879-43bf-beb2-b4c304d9ab6b", "row_index": 250, "timestamp": "2018-02-24T11:25:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f26fc969-9879-43bf-beb2-b4c304d9ab6b", "eventTime": "2018-02-24T11:25:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqZlcvZDlBUTdTdkprREwwL21NMFZuMGE3TGNmSy84cTUwNjNwMTJxM1E5MGRwcG1hUWRzZFJva1E5dzdwWm1TaCsvaU5WTDlSY0VUMkU2bkJlbGFWMzMyYzI2ZU1MdW1PSENTZVpyd2N6dUx6TFhFZHRZTHFEOUIzeHZGVFNNRXRYNzlSQ055RFhleE9BQUU5dW9FLzRLbGxaTlZxT2dpeDd6Z3gxbFFPeU11L1FQayIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68802e5f-8504-49ea-b196-6bd4665f478b", "record_id": "flaws_cloudtrail:0000251:68802e5f-8504-49ea-b196-6bd4665f478b", "row_index": 251, "timestamp": "2018-02-24T11:25:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68802e5f-8504-49ea-b196-6bd4665f478b", "eventTime": "2018-02-24T11:25:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42c237254-82f4-40d6-a378-577900de54d0", "record_id": "flaws_cloudtrail:0000252:42c237254-82f4-40d6-a378-577900de54d0", "row_index": 252, "timestamp": "2018-02-24T11:25:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42c237254-82f4-40d6-a378-577900de54d0", "eventTime": "2018-02-24T11:25:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bb918702-9931-47ac-ba3e-359d59565165", "record_id": "flaws_cloudtrail:0000253:2bb918702-9931-47ac-ba3e-359d59565165", "row_index": 253, "timestamp": "2018-02-24T11:25:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bb918702-9931-47ac-ba3e-359d59565165", "eventTime": "2018-02-24T11:25:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2OEd4blZDc1RyMmNINitYZ1JycXlFRFh5ZUs5ekpNWUtuZE41VlUydnJ5TDdaYkNlcHF1cmQzWkZxdDFVZmg1RCt0RXFENXpnbk5nd0NVSHpmL1RTK3AvUEo0UGduQlVDak54a1R6VWlXRUt4dFpwSVZBMDdIR2NFZ3BiMUJwQWh2SzdtVjBPS3BlR3o3ZDRLMTJZSHJMZHlLeG10dkRLbWx0eGtTRXJWK2xSUHptUFVaNnpNaEJuK2I4OWdURT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a12a05d-ec09-423c-afb5-b9f6059ec67f", "record_id": "flaws_cloudtrail:0000254:3a12a05d-ec09-423c-afb5-b9f6059ec67f", "row_index": 254, "timestamp": "2018-02-24T11:25:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a12a05d-ec09-423c-afb5-b9f6059ec67f", "eventTime": "2018-02-24T11:25:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5571fb4b-d358-4d41-8712-7b1e49cb38b6", "record_id": "flaws_cloudtrail:0000255:5571fb4b-d358-4d41-8712-7b1e49cb38b6", "row_index": 255, "timestamp": "2018-02-24T11:25:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5571fb4b-d358-4d41-8712-7b1e49cb38b6", "eventTime": "2018-02-24T11:25:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoOWpEaVR6NGdGRThRNnJzQXNwemtPaWNnb2p2d2JUMW1hbkRLNDBWVEtBdVhyM1FOenJKdDhMaitxV0R2OEdzblo2S0VlTHBObnNqaGhDNzE1djlnNmlwYlVwbWJZcFRHVzV6dnlTWUc2cDJBMVVUWTFtWDcvZG01Q3E3MFFNNXBDc2N2ak9hV05jdnpEZ2VqRmVXdHY5d01FRVVza2Vwa25nL0VUUnlEL3BLbTlid1Z3OWIranpBazgzanA1bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c38a30d3-60e6-48d1-bb78-45da4ea6f664", "record_id": "flaws_cloudtrail:0000256:c38a30d3-60e6-48d1-bb78-45da4ea6f664", "row_index": 256, "timestamp": "2018-02-24T11:25:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c38a30d3-60e6-48d1-bb78-45da4ea6f664", "eventTime": "2018-02-24T11:25:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLV2pWOWhabGU3KzR1K0FvSlRnNUhDdXl2anlPcGJIZy91MHpiVjZ0S3dmUUd3Y1Q0R1gvZ0Myd1ZnUzFmeUlPb2t1QXNQcXNmWnZsSlRYQWk3anNaT29ERXhyaTZ0WnVXMllJYmQrM1hpditoSnNZYXdVK0NNYlpPOFpOV2hVbUVMMlNHRGVNalJtd3pqbnlMcVFhNURZNGhNV1B6d2VwaUN0c1ZpMmpia0k2OWl5WEVaQlA5emFncDJPSkx3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "176bcff0-40cc-4d98-a6d0-526a107c70bd", "record_id": "flaws_cloudtrail:0000257:176bcff0-40cc-4d98-a6d0-526a107c70bd", "row_index": 257, "timestamp": "2018-02-24T11:25:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "176bcff0-40cc-4d98-a6d0-526a107c70bd", "eventTime": "2018-02-24T11:25:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTbE5GdVBUc29zeDZXSGViUFBXaVRnNWhVS3d3d2c3QTc0VDVNNTlkRk1vbk5Dbkd5RHh0a3JyV0dWaUZPT0x5OWc4WG9vbjRnSEo4L281b1RTUUowcUMweHRIQ2E2RzBKamloZGxlVVpiWVBIT0EzTzVSSXB6STZCMHZqNXpaK0FNMmV1MFVTY1cyalBwL2tuSEhkS1c2SHgzVkp1RjY1SFBkVUpIRG40Q2hoYWZWOU9PdWRPQ1E2VmdzTnE3QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "439b312a-f358-4ad2-b421-5d3e501c673b", "record_id": "flaws_cloudtrail:0000258:439b312a-f358-4ad2-b421-5d3e501c673b", "row_index": 258, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "439b312a-f358-4ad2-b421-5d3e501c673b", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtc1FLYkpSdGMwdzc4b2VRRXlzdFBHRDhQNFhtUG8yWGxwaGFrSnBoZTh0WXlnZmRMdXJ1b0c4MUMraW9Wa09iVDlXbExNTE9aSENPRFJxLzNSSWsxZmtDSXZYc1RtR0hxbk1WK3hZU2JwaEN6eExQZktHa2UzZlA1elpQTjRndThYc3pIRVprdm1QWGVSZWFsSjJZR2dxQjJLcktjNVZJVWR1VkFOUkdjOFNYUHVBc3hjTkRaclhCRlhvQ2RnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc63ef3f-d3f8-4d3a-acf7-82437fe1c7", "record_id": "flaws_cloudtrail:0000259:dc63ef3f-d3f8-4d3a-acf7-82437fe1c7", "row_index": 259, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc63ef3f-d3f8-4d3a-acf7-82437fe1c7", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYNHBYQ2txRHJSUk5Tc0cxWTNwaG5TdVJvbWc1UU4zTGhoRUozS1AwYUNDOWlndTFlNmd6YkF5bXJIV2lhaE04WXNENnBSQ2tRRkxmM2x6OVNiSTVrZjlvcVVmNERsNWhucWVQcGl4WXlHaGtzaG9BaktxR25TUlpmallMRUhxUTF0c0U1am9ucFpJVWtQbnk2bjR0anFUNE9RMkZnUGVzeFpseTIxeGhWVkJwa1ZzSEJHYWNmUHRlcEFkanBaRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e91fb38-5486-40f5-b481-5390c52114", "record_id": "flaws_cloudtrail:0000260:9e91fb38-5486-40f5-b481-5390c52114", "row_index": 260, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e91fb38-5486-40f5-b481-5390c52114", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjMVFoVUNscDRQblB2aEtsdDVxWjdDbHR6RkNla1JSM3Z2Rm9ORHg1S3hSQ2FnTXRmY0l6WlhTRm4wMnI2TmNsY1gveHZWdCswN0FRTEtjM2RXbU9CdmhORGNGYWZKVVgxK0wrRDRSakhYcjdlWHpzalVhMTlnS015QzZ3T3FwYmRUNWtVMk1GOVkwZTlyTlRRWTZ2SmxCaHZyZEpiZ2N3d0RwWlgrUWxmM3AxYUFiZ2hUcXBKSjRTeHNUcmxCOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "496ff070-c2de-4baf-b35c-137a810dd7ef", "record_id": "flaws_cloudtrail:0000261:496ff070-c2de-4baf-b35c-137a810dd7ef", "row_index": 261, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "496ff070-c2de-4baf-b35c-137a810dd7ef", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvRGlheUpqOG9UdzFLTHZVR3Nrcm1tK2ZrL2VhQjU0bVZnTi9RMlp1MThLNFVTbTkrUW8wRE1HNHBLYlZCdnpnZVNveXJKSURNZGsrbllqYTVNcnpGQUxwYzdVZlZTYVdJQTM5WE4zVVdyNm4ydzczTXRKcEtRcWxhNSs0OWF1TmwwWCtBZVh1aVI0NVU2ekRua3gyRzNtWEtGSzB4WFJhMnEweVl0QTJIemI4bHloUEprbDJXWUdYZFFUVTNNZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "043751dd-2b7c-480d-a049-3365b43343", "record_id": "flaws_cloudtrail:0000262:043751dd-2b7c-480d-a049-3365b43343", "row_index": 262, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "043751dd-2b7c-480d-a049-3365b43343", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJncGMwT2lCU0NOaFZDWUJMOFhrTWRxOEtlU0FPWlVGbjJBVk9aQ1F0OHJRUmpPQWorVzE4T1grSTFzcXIwQlhJc0lFVjF2N2hBUCtBY3lacGNmblRKTGE1bGdSMll1ZC9yR0JPejk5TWZhQUJ4UUkvNVRpd013SmlwNFNGay92SXZlMWh1L05WZ01Ndms5RWw3SWtPK1hsLzcreGJUTzZIdGNYem85ZGk4WUpjdXJVR2VRMDBKNk1HbVpsZm93PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed0ff99b-5bc2-4371-a333-ed812118a2d6", "record_id": "flaws_cloudtrail:0000263:ed0ff99b-5bc2-4371-a333-ed812118a2d6", "row_index": 263, "timestamp": "2018-02-24T11:26:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed0ff99b-5bc2-4371-a333-ed812118a2d6", "eventTime": "2018-02-24T11:26:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqSlJ6UHZFcm5Fb2xNMnRZYW1FdlNidkcvS1JocG9ZZ20wZnZ6SWlMV3pEcG9BQnBMZWo1ZDNKdUNJdERFWDlDT2FlcnF6WVMxRDMrK0tDOURMamlBd1k4WWhXMkRHelpnZjhMTzFvTU55NUhkcTQ0OEN3UzlaN2N6RDY5WVkrN2xjL25TblNKaTFqaktlVzZxK3F5RTA2bVhzZlhnc05GZVl1MUpRbVNlc0VUdGMreiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45b6329d-6352-4452-a9b4-ad6dd219d7af", "record_id": "flaws_cloudtrail:0000264:45b6329d-6352-4452-a9b4-ad6dd219d7af", "row_index": 264, "timestamp": "2018-02-24T11:26:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45b6329d-6352-4452-a9b4-ad6dd219d7af", "eventTime": "2018-02-24T11:26:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzLzhaNDlrLzNkZFYyV0JvSnpZR3hNVWxpVWtFNzVpT0E5RXFOQ1k1YzhMSVBpZlJpUnhWVlpMdzFEMXpiZnlQam02eGJBbGtuUUpyZitRbmFKbVFZT2NXOXJJTU93c0dXWE5GaUJkelZsWUM3eFcySTdtZ09Ta1hxemZWQTJCVjBKUGxoNnNtQlVianh6eUE3anBKdFYwaDZTci9WWTVhTzVIakJYSWF1ZTFFeHJGaytzTHdCR0VvRFdJMSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b35ecb79-8a0a-40be-a7fe-a68b1bf8ce46", "record_id": "flaws_cloudtrail:0000265:b35ecb79-8a0a-40be-a7fe-a68b1bf8ce46", "row_index": 265, "timestamp": "2018-02-24T11:26:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b35ecb79-8a0a-40be-a7fe-a68b1bf8ce46", "eventTime": "2018-02-24T11:26:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtUDN2d2pzcmhTN3ZyQlU1OHBFVFd6NHo1Y2tpOHhVKzRpUGhZZXlYMGNJRi9zQkZGeW9ac3RqL1AyRHBxY2pSSjdCR21GSWNjb1llcXN1WkdnVmE1K3k2eUdmcWpMajFmaEltdmtSa1V0czJXZzMyRCs2angzVlZWclc2UGpNeHJsd0p5WjFqdDBrUi80Q3pkTmh2Y2FnN2JPeDZDSXNtKzVDalY5eHo0ejBXSS8wZFNvelFNLzU0TVplQ0JIMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3feae45-e487-47fe-80d0-4cec5b4e3996", "record_id": "flaws_cloudtrail:0000266:e3feae45-e487-47fe-80d0-4cec5b4e3996", "row_index": 266, "timestamp": "2018-02-24T11:26:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3feae45-e487-47fe-80d0-4cec5b4e3996", "eventTime": "2018-02-24T11:26:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiWFJzZDJWVmo3TzZzaVI5NEFQZ3NEYVhXb2RVUXJ2NU84NnRnVDU0OFNtaU82MTdaTGhKMG9hU3VnaCszcFFsZUtFbkdKeXVzYUxnclFPRElwNjZ3UVlYTzkwQjFUMGt5WkwzRC96SmE0OUJCejFnNi9LZ1lzZ3JaZVJUNm9qdXBOVisvSlpNYWRHQjZmRjNNaUdTRXd1ZDZzb1c0cHc3Wjd0WElEZW53TndpYTVBQmlLbE41dk9nQ2pFVklqaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "621b8a60-e8fa-4e93-a73f-441a81b13ac7", "record_id": "flaws_cloudtrail:0000267:621b8a60-e8fa-4e93-a73f-441a81b13ac7", "row_index": 267, "timestamp": "2018-02-24T11:26:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "621b8a60-e8fa-4e93-a73f-441a81b13ac7", "eventTime": "2018-02-24T11:26:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1WW5nbVNJZnFSS3F4OVJRdm80TnFGbUREckx3ZVlDMmtwck1GQkFaL3V1NU53bG5TMGNVMFJIbEhRQ0Z2Vmw5empKRjB0clovNXpGcVBwMEVTTzZJdnAvQzRMZ1hsaWx4enFjczJ2YXpRT0p4aDJESTc5OHBVZzE1a1pXUlRTdFZ0YXZiY2s1RUYzZktPM1l1akxSOXJRbDRXclpLYWRsYUZXb0pKQnZGK0ZIM29ucDJScW1mMTVPOUxVZiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6278b27d-c70c-413e-894e-96dc5a0bc1b7", "record_id": "flaws_cloudtrail:0000268:6278b27d-c70c-413e-894e-96dc5a0bc1b7", "row_index": 268, "timestamp": "2018-02-24T11:26:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6278b27d-c70c-413e-894e-96dc5a0bc1b7", "eventTime": "2018-02-24T11:26:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXb0VDWTV6YTh1RDNvTGtTaXR1TmVsMFBFMmpCbmozNU9sNE5tbWlEbjMzSnVRc0pQQ25uU2hqUGQzWVFaTjNkbEhPempwOWdPTGZjbEd6S1FwcG14UFZrRjl6dlZlNW5sSWprRm1IUFYzUzlXb09FaXNHQ3AyVzJsdGR6QkowMTVTNnJMcmRFenAzcC84bjk1MENLbXhiU0xpYlhPZzJqblRUZEFzeWNZSFg2MkZVcUo3eFdmWitXZ3RlcG5mND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "545a0905-85b0-46f6-bec9-d66f1b0634cd", "record_id": "flaws_cloudtrail:0000269:545a0905-85b0-46f6-bec9-d66f1b0634cd", "row_index": 269, "timestamp": "2018-02-24T11:26:24Z", "event_type": "CreateSnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 841, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "545a0905-85b0-46f6-bec9-d66f1b0634cd", "eventTime": "2018-02-24T11:26:24Z", "eventName": "CreateSnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "eu-west-1", "errorCode": "Client.InvalidParameterValue", "errorMessage": "Value (snap-83d15d668fb2941db) for parameter volumeId is invalid. Expected: 'vol-...'.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeId": "snap-83d15d668fb2941db"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57e3f7ae-c25b-422c-8d02-8a55a1f146771", "record_id": "flaws_cloudtrail:0000270:57e3f7ae-c25b-422c-8d02-8a55a1f146771", "row_index": 270, "timestamp": "2018-02-24T11:26:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57e3f7ae-c25b-422c-8d02-8a55a1f146771", "eventTime": "2018-02-24T11:26:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQUjVTRVZQdS9LZHBuc2FrRVdwNXh2U0kwV0NlRmdvVDd3blFyTk93RG91UnE0OEt2ZWQyTDQ1Tm5ZM1Zja0NKbHArdUoyeGx1WjJnMUhXVEgzYTNvRXUwb25iaXAya0x0UHlueTdwRnhwbDAzWHFqWVlDZWRlcXVic3V2Ym8zejRaWTNXS0hLMml6SkkyZzJhckRucTNDNEZHVkR6L3pQSGZnR3B2UHpORnRKYlROYTJEQ0FiSy9hTmp2YyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b24205-2139-4d5a-860c-85d4c37c95c6", "record_id": "flaws_cloudtrail:0000271:b24205-2139-4d5a-860c-85d4c37c95c6", "row_index": 271, "timestamp": "2018-02-24T11:26:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b24205-2139-4d5a-860c-85d4c37c95c6", "eventTime": "2018-02-24T11:26:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrZXovalNERjRmWmdGR2dWQTMwZFVYNzBOektaZ3NUVzYxNC92aG1KcGtOeEhXb2dwdDl2VTRwMCtDcE1pcC8ydEZHZGpOcEtuN1IraWxPY0tHaVZaMlVsenpmV3QzWWY2NzJnWDFndExvWmwxeENabWpxeDRrUnZWdFJoZXBUVFYyTGxWT2M3bDc3UEZnY1B2VFFhZTJHT08ydjYxSEVMSWw5eHlpcm5zYnRxdktSamVNNUhzbFdhVXFsNnZ3QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9ec5894-d0fc-4a05-80f7-ec7fff57c8fb", "record_id": "flaws_cloudtrail:0000272:c9ec5894-d0fc-4a05-80f7-ec7fff57c8fb", "row_index": 272, "timestamp": "2018-02-24T11:26:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9ec5894-d0fc-4a05-80f7-ec7fff57c8fb", "eventTime": "2018-02-24T11:26:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwK2t6UDdyY3l5T2duaS9BWlhBQzBsSW9QcU92SFRXVU5ncTArNXpBSUxoTk1jbWw2a01uOEMvUWxVME9uUnpZUENRYTNLRzBzYUdaR2Qvd1JldkVGSmRrRmJmeDlvWXRtTXVvMFhhTHNkU2xQelBkeG5XQVFha29lWDd0TkR3MFBjaHZSNjl4MjhCUlVReE9DdTlkVk5oczlMZnhRRDdoUXovNEwzY2QvUk5VcmgwMzJPRndKWVlwcFUzQllBZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b26b6bc1-cd3e-4208-92d5-40fefd2d9f14", "record_id": "flaws_cloudtrail:0000273:b26b6bc1-cd3e-4208-92d5-40fefd2d9f14", "row_index": 273, "timestamp": "2018-02-24T11:26:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b26b6bc1-cd3e-4208-92d5-40fefd2d9f14", "eventTime": "2018-02-24T11:26:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZWWZRYlNwMmg2WmFmZzhlS0FtcExLUjNtR3M0dlFtUkFNWTRVelBndUNZeExVaUFiZVVmVnFLeVZnNU1vZ2Y4QlJicnE2Zlo1SWlHNkZ5UVd4UlhVRVVVSER4aEJHZ29wK2pNWmlUbkh0dTdWZ0h0NkhYWG9wMlNwcDMwZFJOVW8zdnZUNlBMcmIxMWlOMGVDQ1cvU3JzY09TSFZlN2xNNXNNYmVjdGVwTmhxS0puWHJVeHdkNUJCc041eEg0ST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7faa3c7c-c9ae-47ee-a5db-c8be52e8da73", "record_id": "flaws_cloudtrail:0000274:7faa3c7c-c9ae-47ee-a5db-c8be52e8da73", "row_index": 274, "timestamp": "2018-02-24T11:26:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7faa3c7c-c9ae-47ee-a5db-c8be52e8da73", "eventTime": "2018-02-24T11:26:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMK0E0Vlp6U05HSUp2bEJFdEpQT0ZIbFJHR0ZiSlg5UVhVL3djd0JVczl0ZVFHdkx2bWJ1TENYZE5uOTl3enY2MFNiWTJsaEw0WHVsbnM0NFpzcjQzdXU4V3V5RVJSR2lUeHdxd0pCTXFmUDVmOVZmekhIUjRoNFRyOUJKL1FyODBJQmFYNDM2MEVNVXEzeTNwRjVqTXhXaXRnWHQ5KzVNVk8yNlgzL1hVQVl0ZDUzM2VHckJGZlo4ekgzYiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81e165557-15af-41f9-9f88-7fd7c6ba74b0", "record_id": "flaws_cloudtrail:0000275:81e165557-15af-41f9-9f88-7fd7c6ba74b0", "row_index": 275, "timestamp": "2018-02-24T11:26:40Z", "event_type": "CreateSnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81e165557-15af-41f9-9f88-7fd7c6ba74b0", "eventTime": "2018-02-24T11:26:40Z", "eventName": "CreateSnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72", "awsRegion": "eu-west-1", "errorCode": "Client.InvalidVolume.NotFound", "errorMessage": "The volume 'vol-8e100f305b7a6fef3' does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b228c33-e6d6-4bb8-9b2c-b4150feb261f", "record_id": "flaws_cloudtrail:0000276:4b228c33-e6d6-4bb8-9b2c-b4150feb261f", "row_index": 276, "timestamp": "2018-02-24T11:26:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b228c33-e6d6-4bb8-9b2c-b4150feb261f", "eventTime": "2018-02-24T11:26:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPbFl4Qno0dUxBVm5jR3MzVWYxWURZUlk5blMwYzBKV1ZXa1hFeldLNTlyQ3hpUHc3UU9kZHJsUUlZS1pBQUZQMFhMTGY4bHRyNnBLUERWUEhQV0VkWDZuQ0dBNFVGZmwyeFZ5L25uZVFtT0FQVnEvenVRLzNralBQOTRlTlJKYWdKb0xhWld0clowS2RXU1hQUjVyOU11Q3YrOEJMd3F1R2ZKeTI3YXVhbFE4dkZtNGxkTXlHakJBUmdzPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48e7f10d-3e41-421a-a937-8ddd7ed950905", "record_id": "flaws_cloudtrail:0000277:48e7f10d-3e41-421a-a937-8ddd7ed950905", "row_index": 277, "timestamp": "2018-02-24T11:26:50Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48e7f10d-3e41-421a-a937-8ddd7ed950905", "eventTime": "2018-02-24T11:26:50Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eef31a64-fcfa-44b6-b319-22c5fc67844", "record_id": "flaws_cloudtrail:0000278:eef31a64-fcfa-44b6-b319-22c5fc67844", "row_index": 278, "timestamp": "2018-02-24T11:26:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eef31a64-fcfa-44b6-b319-22c5fc67844", "eventTime": "2018-02-24T11:26:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwSHNvMWNmc0pDR2s3dUxvbFUvSFVPeEVmd0x0RVI3d25FNkxmWUJHZ1FVL2RkdWhyZ29uKzdGKzhsb2lrYTBnZlYwMnFFQ1FjOTRUUjdnVEZsTDFoV2NtanBLWW1ZdGJyUFZqKzBwelBzZXhIVHFXbUhUK0oyajFMdFRZNFJNT1lLNXlnSFhtcndwV080NGVPaGkreEx5bmtTNk5nSXNCTG82NElUTjBEU3dqeWI4PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09ef7207-db54-4a05-bda7-cb1951d6d093", "record_id": "flaws_cloudtrail:0000279:09ef7207-db54-4a05-bda7-cb1951d6d093", "row_index": 279, "timestamp": "2018-02-24T11:27:04Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.14 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09ef7207-db54-4a05-bda7-cb1951d6d093", "eventTime": "2018-02-24T11:27:04Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.14 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a28ee764-22d3-42b3-a11b-e77dbbca2fdd", "record_id": "flaws_cloudtrail:0000280:a28ee764-22d3-42b3-a11b-e77dbbca2fdd", "row_index": 280, "timestamp": "2018-02-24T11:27:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a28ee764-22d3-42b3-a11b-e77dbbca2fdd", "eventTime": "2018-02-24T11:27:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17bbce1b-eb87-4cd3-ad98-2bfde3ff43a9", "record_id": "flaws_cloudtrail:0000281:17bbce1b-eb87-4cd3-ad98-2bfde3ff43a9", "row_index": 281, "timestamp": "2018-02-24T11:28:12Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17bbce1b-eb87-4cd3-ad98-2bfde3ff43a9", "eventTime": "2018-02-24T11:28:12Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterCombination", "errorMessage": "No attributes specified.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1c88cf4-cc14-42dc-896b-8c6b3ddf9b9e", "record_id": "flaws_cloudtrail:0000282:a1c88cf4-cc14-42dc-896b-8c6b3ddf9b9e", "row_index": 282, "timestamp": "2018-02-24T11:28:32Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 789, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1c88cf4-cc14-42dc-896b-8c6b3ddf9b9e", "eventTime": "2018-02-24T11:28:32Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterCombination", "errorMessage": "No attributes specified.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8602a84-45b5-4b29-97f4-e575bfcf3505", "record_id": "flaws_cloudtrail:0000283:c8602a84-45b5-4b29-97f4-e575bfcf3505", "row_index": 283, "timestamp": "2018-02-24T11:28:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8602a84-45b5-4b29-97f4-e575bfcf3505", "eventTime": "2018-02-24T11:28:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "description", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb8366f1-72d8-419b-91f2-5a8f63b1cbcf", "record_id": "flaws_cloudtrail:0000284:fb8366f1-72d8-419b-91f2-5a8f63b1cbcf", "row_index": 284, "timestamp": "2018-02-24T11:29:45Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb8366f1-72d8-419b-91f2-5a8f63b1cbcf", "eventTime": "2018-02-24T11:29:45Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "324d0290-4331-474a-a141-8431d28f3fd4", "record_id": "flaws_cloudtrail:0000285:324d0290-4331-474a-a141-8431d28f3fd4", "row_index": 285, "timestamp": "2018-02-24T11:29:57Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "324d0290-4331-474a-a141-8431d28f3fd4", "eventTime": "2018-02-24T11:29:57Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "031ad9cd-1a41-43cd-afeb-f8b811ac14b2", "record_id": "flaws_cloudtrail:0000286:031ad9cd-1a41-43cd-afeb-f8b811ac14b2", "row_index": 286, "timestamp": "2018-02-24T11:30:00Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "031ad9cd-1a41-43cd-afeb-f8b811ac14b2", "eventTime": "2018-02-24T11:30:00Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67aac3d5-d315-408d-8a64-85a4f8c8a464", "record_id": "flaws_cloudtrail:0000287:67aac3d5-d315-408d-8a64-85a4f8c8a464", "row_index": 287, "timestamp": "2018-02-24T11:30:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 739, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67aac3d5-d315-408d-8a64-85a4f8c8a464", "eventTime": "2018-02-24T11:30:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ba3900b-50bb-457c-a5db-f0ce4c64f1ab", "record_id": "flaws_cloudtrail:0000288:5ba3900b-50bb-457c-a5db-f0ce4c64f1ab", "row_index": 288, "timestamp": "2018-02-24T11:30:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ba3900b-50bb-457c-a5db-f0ce4c64f1ab", "eventTime": "2018-02-24T11:30:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNWQ5U0VyRVB0Q2JVTjVPUnppUXRDYTkrQS9zZXVIR1d1VGZVNWcvMnFJNDlEVjVPVjNQaXZVMGdkNDJpYVhhVWUvbG5tKzRKVWZQS25VYlVtYWhnM09MUVM1N1BvalZVTUc3TmxUL0lvbGtiVHNKUk4zMnM5c1FIRG16cEpsYXVFNHBINmNLL3dKaHpCVGd3M3RJSEtIM1lFem9CSFJDa1dhek5CRjQ4RnZTa2xOK2dyZjBnaVd5dnh4ZVYyST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c612e82b-8858-4e08-a4dd-51601b2cf0d3", "record_id": "flaws_cloudtrail:0000289:c612e82b-8858-4e08-a4dd-51601b2cf0d3", "row_index": 289, "timestamp": "2018-02-24T11:30:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c612e82b-8858-4e08-a4dd-51601b2cf0d3", "eventTime": "2018-02-24T11:30:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNa3Q1azc3YkpjUXg5NlRzdXY5elF1c0Z5cGk3RzVVTmpwYlZ2dDdNS21hMGdjRlBFMWNCQmdSQURpbzNKUU51c3NMdkJmS3lONkpMai9DZ040VUt0Mm1BQUNyczZXOWhvVHJuQm0wcUNEdDFEdXA2ZFVidDB4QjFKbGVVeVVLMlRzR043YXhiWC9aVmhUdDcrZXBDeGIraUNNUnM5emFxRzVmRDFtbVpNbnovZDVsMUhKN1BBaXJ1clVra1V5UT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b7a2a6e-49d3-4826-9a2e-c5dfeee2bc8c", "record_id": "flaws_cloudtrail:0000290:0b7a2a6e-49d3-4826-9a2e-c5dfeee2bc8c", "row_index": 290, "timestamp": "2018-02-24T11:30:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b7a2a6e-49d3-4826-9a2e-c5dfeee2bc8c", "eventTime": "2018-02-24T11:30:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtaUpjSkZ2ZndENlZ4QlFBdDZmcmh6M010MEZXdmpBazgxSXE4cGlKNlVKMFlFK1FJZTFmTFVsb0R6TnQ5RWRZTlZOMDdJL0wwcGl1U0poc24vaW0yZ3BGUGFEaVJiYUpZYnZPTjhlcUo2Y0FsaEUvdEZLNXp4SVFTekN0b2FQWmhUbmZNc29NZjlORUtocDFoaDMvWUpOWENWdDdsa3RUbk9mMmp6QXlkNVVTQVVGTzY5T24xVjJDbEt3SSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80993-a463-4b98-a62b-9c6d23d7f0c7", "record_id": "flaws_cloudtrail:0000291:80993-a463-4b98-a62b-9c6d23d7f0c7", "row_index": 291, "timestamp": "2018-02-24T11:30:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80993-a463-4b98-a62b-9c6d23d7f0c7", "eventTime": "2018-02-24T11:30:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKYmlWREs2MDdxdFdWY3ZCcGhOa1hHbzZPSEJweWlYazJIVklsVDhuell5b0tnbXNXUm8yb0MvZDdjNmhQRkxvOE9rT1NXVXpiODh1Mkt6OEs5eXFHek00TUFYUVBxQ3FIdkNaY0dLR012bnlGVWxua1pxbDdaMnF0ZHVnUWtJN200OXRrcXExM25xY2locFg0cVhJNVRZdkN5eUs3d1NmVUJHb2c3enVhRHp2MlhJc2RkWEJJTS9LbVBBSDhMST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b7e730e-d14d-46cc-93f7-0d32c354b03e", "record_id": "flaws_cloudtrail:0000292:2b7e730e-d14d-46cc-93f7-0d32c354b03e", "row_index": 292, "timestamp": "2018-02-24T11:30:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b7e730e-d14d-46cc-93f7-0d32c354b03e", "eventTime": "2018-02-24T11:30:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhYnZ4dVM1RzNXVUMva3JWY0ttaHQvS2UyQTU2Rm5iVDFMaW55NVRzM2lYWWRHSmFOcWJMM1Y1RGJvYUFYcGNUVmxLQzkwWlhsbjU2OXVVR25SaEZUQ05qOUhpSXluVUhwTnRZUkJIUmIrbnk5L0hBSGdoWThxazBHb2dQczZRWWFUMFNUU0gzNHJYa2dIZFlvYkc0djhWVnY5ZktVbWhFd0dVWHJWVFltc3loTUFDN3pFNVF3ZGdJcDdYNnVOTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76ca7f9f-64d4-4a76-864b-1efcec1e7118", "record_id": "flaws_cloudtrail:0000293:76ca7f9f-64d4-4a76-864b-1efcec1e7118", "row_index": 293, "timestamp": "2018-02-24T11:30:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76ca7f9f-64d4-4a76-864b-1efcec1e7118", "eventTime": "2018-02-24T11:30:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJleHdoNHZCVzJvUGNwYXRZNXIxalY0L2ZqcUUxZDN6RVcyMVJ2MEpKcXVWTDZlM0F1OC9rYlpzaDI0dG5lMnQzZERsWndCREhDYkQ5RHZRN3lOYlBLM1ZtZHJnVzZwMm9vOXEwelJqeUovSzZHT2lpL3BDRksrbERDMzZCTW9Sa2oxdXFiMXdyNVNEelNodFlrcDRkMVUycE85MkJWTWR5VzZGa29pTWpwc25Wb3FuL1FjV1d3M3dyVzIxZSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2931aebc-078c-472a-8aaa-de461631419e", "record_id": "flaws_cloudtrail:0000294:2931aebc-078c-472a-8aaa-de461631419e", "row_index": 294, "timestamp": "2018-02-24T11:30:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2931aebc-078c-472a-8aaa-de461631419e", "eventTime": "2018-02-24T11:30:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxazd4MWVlTm5wbTJ3MnkxeG5wa2psVW1qMUJOMW1xY2c1YlBjM2p2eXlOZW9icjJlSGYzbERyOGErRTFkSlZDbXlaVmRTZVVWMytoUjFIcGRLMzFjSGJObVB3STRBaWRmd3AwTFBDMEdkRDZUcEJ6TTNqV3NMeW5mbWJndVRqVmErQ0VkeXhZdUxVc2Qxblp3MERKVjBSVzA5MDNKb2phMUtXUTVmSXpTUEZoelhBRlhjTFZnYTFJYzZFMyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a555e87-a8bf-4a8f-a4d4-bbd9b9a3d1c0", "record_id": "flaws_cloudtrail:0000295:9a555e87-a8bf-4a8f-a4d4-bbd9b9a3d1c0", "row_index": 295, "timestamp": "2018-02-24T11:30:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a555e87-a8bf-4a8f-a4d4-bbd9b9a3d1c0", "eventTime": "2018-02-24T11:30:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYWFhid3FKNkFjVkZ1NWFWa2huMjdkSmNyV3plUnJ1RlJYUUtzTTQ4UjFGYzZ0dUlqVVNMQzQraVZmNjFGSzN0anlzcHpFeVJmcWJuNXFlOVlKMkw0Nmt5SThMRnRrUTNkWU1US2liUU43Vmp6alJ0RlBiNHRBYmU1TWRGQkhIK1pkR1g5VGVtejlCc2paTm5hWXFJQmNmUWU4UW91T2J1WnJPV0RhZjJWSVFmMll6R1k2engxYUpndm13cSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32030-edb8-4b25-9d12-fbfdd84c25bb", "record_id": "flaws_cloudtrail:0000296:32030-edb8-4b25-9d12-fbfdd84c25bb", "row_index": 296, "timestamp": "2018-02-24T11:30:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32030-edb8-4b25-9d12-fbfdd84c25bb", "eventTime": "2018-02-24T11:30:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzSERsTXhFZUhIcEtLNjVsaXFsZFE3YjlxbVdESWNKNExQTkFDZUYrQWcxRWtFSU1vbklMemF5YnZ0SmtwQ1NVOGh2T1MyVXNnSGRnODBZVDBTMTk1Tm02NnBZZ1c2cTRQSjZlVHd0RDhoYnNZZlVGbXVrZ2VsS0xib2wwL1VTdVAvakJ3eTd3a2J5c3BXZTc3U2F3MVdGWk1Vc2RLMVVCeUJvN3dpZ0FjbURLVUhHSEFraFhtS2txQmlKRyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "342005b-c8b1-411a-b0af-86674b0e94bf", "record_id": "flaws_cloudtrail:0000297:342005b-c8b1-411a-b0af-86674b0e94bf", "row_index": 297, "timestamp": "2018-02-24T11:30:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "342005b-c8b1-411a-b0af-86674b0e94bf", "eventTime": "2018-02-24T11:30:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUYXJuVTIxUXZMTEMrc2FmNDlCZWlTMDZMTGlhNjJJRXQwdGJTUkNQaXByanh0eEVJSmQ4U1UwSDhwdzBTVHZpY1pMWWZhUzZMQWFjSEdETEVKNDFKRmIzaTh5MTAvZ2owbXNEU2FOTG56Z0dOdGZPSzhIQWpISVJNdFE0bEczb1M5aXNhM0NPeUFjREllaWVTQTd4TGl3WHB2RmJPd1JNRHllTHprWGtmdHp3cmtpZENaMGxhWlVDTlZQUms0cz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8defbd5d-0e5c-4cf9-8578-d0de35c824552", "record_id": "flaws_cloudtrail:0000298:8defbd5d-0e5c-4cf9-8578-d0de35c824552", "row_index": 298, "timestamp": "2018-02-24T11:30:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8defbd5d-0e5c-4cf9-8578-d0de35c824552", "eventTime": "2018-02-24T11:30:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOdzdQWkM5QXI5eHlaY3FmaWpkcHYxNkZYM2x3d0dyQmdKOFZWVFpNRFRwMnVieStjVVpITzRBQ2FrUm04S0ErN1c5bnhQMDZMN1V0Zm9VN3BPVjlUZVVtNlpDUWludmtjWXJaU1hMcHhtSFEwYjdsbTQyZnY1NXVuNWp6Sk9Mano2SmphaDF6a3ArVytNWEJPQ0gyWEhYVHBaZTlpY0FackF0K1QyYmRDU0g1TjVIS0xuNnRFekJrbGM0dyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83d972950-3229-49e0-a784-ba03901", "record_id": "flaws_cloudtrail:0000299:83d972950-3229-49e0-a784-ba03901", "row_index": 299, "timestamp": "2018-02-24T11:30:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83d972950-3229-49e0-a784-ba03901", "eventTime": "2018-02-24T11:30:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIveTQ2cG9PR2lHUzFTa0hwMzArYWhKQWRKTzlyWWJtTnVpNVB1M0RWa1VGN1pXU0JIVm0rT0VRWm41bkhFUk9udVdMY0VHWWJKbUdRYjNVb1U2eEpyOWpmUnYvSTd4em4yNlM0ZE4vazBqaDFJUVpuUjFnek5SWU9Sb29yWjVOakc1cFlNcndpQmdmQzNSaTZWa1dWY2dIWm9pMmtFZFl5TjRiUUxyREN5Q21zRGRvM2lNZFVxZEdYRDBlSCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfd9b95f-2e35-42ef-9e02-9821f6f02ed7", "record_id": "flaws_cloudtrail:0000300:bfd9b95f-2e35-42ef-9e02-9821f6f02ed7", "row_index": 300, "timestamp": "2018-02-24T11:30:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfd9b95f-2e35-42ef-9e02-9821f6f02ed7", "eventTime": "2018-02-24T11:30:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwZ0J3N1p3MVNWNFQreEk5N1lHcG1rOGNwdGtXM3VxVWlVYmNFaWgvNHJsRUE3NmJudWFlWGFUNGRLTmprRGxTRXpXMU5vd2hIbnlaTDNYdzcrVmRNWTdMWm5USlNiV3lXb0tjMVh5S1NPZW1NZ2RWYmJIWFBNMXU4WDVIMzBDODJmWkFZVHI4YTNlbisrOHNINGhiWWdFU25MdVFhcThOdnJpVjJZakM3YkRwbmpJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c72c762-56a5-46c8-a76a-134bcd2becaf", "record_id": "flaws_cloudtrail:0000301:2c72c762-56a5-46c8-a76a-134bcd2becaf", "row_index": 301, "timestamp": "2018-02-24T11:31:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c72c762-56a5-46c8-a76a-134bcd2becaf", "eventTime": "2018-02-24T11:31:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0bc9ee2-8f34-44b2-a120-aaf1d7a70e1c", "record_id": "flaws_cloudtrail:0000302:c0bc9ee2-8f34-44b2-a120-aaf1d7a70e1c", "row_index": 302, "timestamp": "2018-02-24T11:31:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0bc9ee2-8f34-44b2-a120-aaf1d7a70e1c", "eventTime": "2018-02-24T11:31:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d740e7eb-6f01-471b-999b-eeab293b35dc", "record_id": "flaws_cloudtrail:0000303:d740e7eb-6f01-471b-999b-eeab293b35dc", "row_index": 303, "timestamp": "2018-02-24T11:31:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d740e7eb-6f01-471b-999b-eeab293b35dc", "eventTime": "2018-02-24T11:31:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2WnJFV0U5WDZMRHJxdkdWY0Fsa0VmVStGUXVIYlFwVmtqZjE5b05rdnFEUjY0TDBqbldKVzBxakVCcEVJVXNlZ3BaSzFieXFSZDU0Z0RHbms1c1VVU2Rnb3k2L3IyQlMyUmk2MnYxVHB4K0N1MVB3dStpNnpHWVcrZktid05IT1k4OHBEZ0lUaHprZnEydHJ6cUZkRW5meDl4TTkrdmNRM2FxNFQrdmt0N2V5ZlZPYkY1SGxKMDA4MnNxbEZ1WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7293c62b-27b9-4221-8d03-27e4b9a6ffe7", "record_id": "flaws_cloudtrail:0000304:7293c62b-27b9-4221-8d03-27e4b9a6ffe7", "row_index": 304, "timestamp": "2018-02-24T11:31:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7293c62b-27b9-4221-8d03-27e4b9a6ffe7", "eventTime": "2018-02-24T11:31:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCVHVsTVBSWlRDTVg1ZnAwYWtWbVZabi9lTGtIbU9VejgzV0ZzYUJlVFp2alBCbnBWZzdEeDVoc25ta3drVUx1UjYxMVJvQkI0QnlSODZpd1hQeWw3alNXVzNYMlFoSWIyNE5mMkYxS0ZMSW9VbTNxV3ExL2J1eHpFQSswMjYvMmZZTkd2M1MyZk95b2VWOUJQMndCcy9RQVE3TWdDZkF4NGIrUXR6UGFpbWwxYnRkam02V0s0bURaSUNDUnA5ND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d996374-c387-44a7-bc5e-0c574d6cf954", "record_id": "flaws_cloudtrail:0000305:d996374-c387-44a7-bc5e-0c574d6cf954", "row_index": 305, "timestamp": "2018-02-24T11:31:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d996374-c387-44a7-bc5e-0c574d6cf954", "eventTime": "2018-02-24T11:31:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIydmFSZ1pzVVNvMHl4VGFHRG5mQ1RpL0JUc2FBSk4zTTkrQ294MFl2bldXNXNpQWpUQzJUVG5qekpoN0d4WjlTUXBITlJ3aVlPVmxGWDZpVUdra1ZWZnMybmJQcm1sdTZjQkdPcVg2ZHlURTBVb0VoaE91LzNFaFpzcXJjVnNYNHdIcXJvMDJDbDlnTUJycEVnVEwyQ3krdGlSU2toblRhOUR5clN4eHJNYzAzRTR1a0MxWk4vZ01ZamtsNSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d1c40e1-c2dd-46df-bd48-3b75703f", "record_id": "flaws_cloudtrail:0000306:4d1c40e1-c2dd-46df-bd48-3b75703f", "row_index": 306, "timestamp": "2018-02-24T11:32:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d1c40e1-c2dd-46df-bd48-3b75703f", "eventTime": "2018-02-24T11:32:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.11.151 Python/2.7.10 Darwin/17.4.0 botocore/1.7.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59c6e027-88cb-40b6-a19e-bb9d03d02b83", "record_id": "flaws_cloudtrail:0000307:59c6e027-88cb-40b6-a19e-bb9d03d02b83", "row_index": 307, "timestamp": "2018-02-24T11:32:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59c6e027-88cb-40b6-a19e-bb9d03d02b83", "eventTime": "2018-02-24T11:32:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4761d2b-6c26-48b5-bdcf-06af49a3ffcd", "record_id": "flaws_cloudtrail:0000308:b4761d2b-6c26-48b5-bdcf-06af49a3ffcd", "row_index": 308, "timestamp": "2018-02-24T11:32:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4761d2b-6c26-48b5-bdcf-06af49a3ffcd", "eventTime": "2018-02-24T11:32:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSZExyczlFcWJKNFRqY1RYbUdwSTRvaFR3YUF3b3I3N0g3aW00MStVR0IyOXlOYTFzeXluYnBlWFE1VnltYU1raXZ1VTRxUlV3bFZlZFJJUlMwbkNxQzJObUJqNUMxdk9wNEpjOXNidGR6WmdyQTZ5YnRSNjBOQkV0L203dWs2OGpZVW9ycTVoTEpnZ1R6czBRdnlzR2Frb2FlTWlFbWpZYnp5YjUvZ1dzRmNoYXhNV3Zhd0ZpZm5JN0JnUUJaRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35c5d9d2-aed4-4d3d-8db4-e17b2594ebaf", "record_id": "flaws_cloudtrail:0000309:35c5d9d2-aed4-4d3d-8db4-e17b2594ebaf", "row_index": 309, "timestamp": "2018-02-24T11:32:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35c5d9d2-aed4-4d3d-8db4-e17b2594ebaf", "eventTime": "2018-02-24T11:32:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzbzdrSTVpMVgzOGxmSUJNNkppajNUN1hFVi8vaGxBc09BaEdiVlRjbUxrUk5yc0FJYVpEckx5V2VyTDRPT21RRkJEcDFrbE1HWFIva29vL05iZW04Y3JBRXpTVEdOSFdYK1gvNHczYkh3cDdiTGFFWXYrRUo4eGRFMG4rMG9MSWpGRjBNZk5FSEZGdlFkOWZ3R0h2YXpweS9tY2t6NzhGcCt1WjNKdlBQWUU3MjJtZk8yYnRzS3FQWjN0UDRnQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2421c64-bd17-48c5-bfc1-1a574647dfa30", "record_id": "flaws_cloudtrail:0000310:f2421c64-bd17-48c5-bfc1-1a574647dfa30", "row_index": 310, "timestamp": "2018-02-24T11:32:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2421c64-bd17-48c5-bfc1-1a574647dfa30", "eventTime": "2018-02-24T11:32:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4ZzlwV015aGxNQUMvdnpOeWtSdDRvNklDU3o4NThYb1cwcDZjaGxLMnNGMEZtbW5RUHBkNnkvaG1HNm1xNWpNaWkvc3Mra3NtL3pFbzJUNHFoOXhoVGR6YjFKS2ZUMFBseVhER09ZQXQ1dFhzRHkvZEZrL0ZsU2dxZkR4Z04vOUVXZVh2dXZzU2llNHBOV2JHSkFwUm5odDZpbmp6UXFld1JPdUtReTN1Y0Q4TzBqZmtJV2haOU03VzBMSCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b202471a-c472-4e82-b549-a0ece63bba51", "record_id": "flaws_cloudtrail:0000311:0b202471a-c472-4e82-b549-a0ece63bba51", "row_index": 311, "timestamp": "2018-02-24T11:32:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b202471a-c472-4e82-b549-a0ece63bba51", "eventTime": "2018-02-24T11:32:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2bWdOZzh3RUpwVEZBMGR3QUhrRFhwLzRvRysvQ0lPOGEwV1NhQkVBWjhqV3MrMFdEU3BDejUvK3c5NmEzZnV4S011Q1VnaGRtOUpsTGJWcVZMZ1pqaUdQSTlEekFKQWw4TUIzbjY5Qzl3cjkwd25XeFRxN3NMYlNpdGIveUUvQXlFeFNya1lnNjdXSXlmbWZWT2VJM0djUENxSEZyaEVxUUR2Z0tVOWNUbHVtcXRlVEVneUlUcWRORkFtTUkvZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd776478-c4ed-462f-a285-8b9fe7bf002f", "record_id": "flaws_cloudtrail:0000312:cd776478-c4ed-462f-a285-8b9fe7bf002f", "row_index": 312, "timestamp": "2018-02-24T11:32:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd776478-c4ed-462f-a285-8b9fe7bf002f", "eventTime": "2018-02-24T11:32:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtQks2YlBYaHExUmpNdDhvQ3pwTTFXd0J2bUFrL2pxTmZHeU9lSjhXVUhGTlBGT1grM3pZNUIrUStESnN2SVVjRS9Jd2xPYmowVGNJZ1pYL1NkRDRPaUwzdVkwK0xOR1BralhtRGZwbDBzSWM0NlhXTTBodFJ4NjI2VUdrVHRLb0hONlJyd0R1VXRUMFBTZ0o2d25uZVluYlUxSzVGd2RoKzRSaytOYXcrci9CWWdKcm1QOTJqV2c0dVAyYjZSND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0853f249-e149-4b24-ad9a-b1de8085c47e", "record_id": "flaws_cloudtrail:0000313:0853f249-e149-4b24-ad9a-b1de8085c47e", "row_index": 313, "timestamp": "2018-02-24T11:32:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0853f249-e149-4b24-ad9a-b1de8085c47e", "eventTime": "2018-02-24T11:32:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIycVdSczU4OVRRWUdMdE9PTVFnbGxJYWl0cXh5QmZtVlVNTU11Ym5McXBFZGw4eHIxNE5sVzFqZDlqcjR0S25oMDN2VHczVkhjbkNKWFd1VDlTa0hjU2o1eDN0TENhVllpcUNFZUc4OHhsdHM3R0FBKzg0UTFoTHlCTzRMdWFFeWJkUUxTOEl2RmxCTkJiVlZtQ2QzTUpXNmc2cTdWWDBKMW9DcUJaekpHNUhWd1gvWmRpSXNCZU05SnhuZiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd9d83ea-1716-41ab-afca-112bf8922886", "record_id": "flaws_cloudtrail:0000314:bd9d83ea-1716-41ab-afca-112bf8922886", "row_index": 314, "timestamp": "2018-02-24T11:32:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd9d83ea-1716-41ab-afca-112bf8922886", "eventTime": "2018-02-24T11:32:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaNGpsQ1ZzODdhMTVhRTVSNU0wck1UOFY5QjBneGVrQ0hjTVYrdW05K0RxWmlncTArRTdkOHltNENIaGw4T1ErWlJ5RVpVckhKWkxPUGQ2MzBMVkRWY1hKUCtDd3NObTdzNlN2clNkQk1oZ1U5LzZjZUhtS2ZvWjY2ek9wR1crRmdyVndVeThGTVZNVGo3N2ZCK2c3bCtNcG5ieDVDbzlZU2hwRy9XUU9QdVd2TlluUDVlOXQ3d0RTRlNuTCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f526ace-086d-4a6b-b212-8fd3b976554a8", "record_id": "flaws_cloudtrail:0000315:5f526ace-086d-4a6b-b212-8fd3b976554a8", "row_index": 315, "timestamp": "2018-02-24T11:32:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f526ace-086d-4a6b-b212-8fd3b976554a8", "eventTime": "2018-02-24T11:32:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtN29zaTE0QnpQRkttWmI0MHFudkk5Nlp4M2FYUHY0MHJRT09MSjlFdlE5YTlPbFFIaVVmaVVMQ21BQlgvWml5Mk91dXBubDVmZHNnRkVoWExFNVMvWW12TGVEL1dXcXNBQTVrQlJKbDEyQkFUeGgwbGxVSWRoRG1hcXhxWVhGNm9tOWRFMEZpeUxzWWNVL05aRnF5Y0dwaDMxRG8vTDBEVnVCeFNBMk12ZnRiZ0FHZ1hseUkvbUpKdlFQcSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "325b6b80-8e3a-4c24-8fb6-01a25b23e40f", "record_id": "flaws_cloudtrail:0000316:325b6b80-8e3a-4c24-8fb6-01a25b23e40f", "row_index": 316, "timestamp": "2018-02-24T11:32:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "325b6b80-8e3a-4c24-8fb6-01a25b23e40f", "eventTime": "2018-02-24T11:32:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFUkJscEoyN3djSlg5cE4rektHdFVkTDl1djJuUkV6REJtbjJBT3ZCL3l6OElYYTZ2bkxGZnNhQzlDZnBMaGJZQWpURHYyZnFaZEJRWEhHM1U4REJuaUpLWnlRa2hJZEpWNVJkUzNJS29SNW5wRVp4ZWZBSXlzRG1DYm5MU2g5dk1Lci9sMnV3TXJEWVM4WE5mb1hianBWUjJDWDJ0N1BMNnZxdmU3ZzRjMkppcEg4aXhxWDJqSkpFM3JGLyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "974656a29-b2a3-4f63-81a6-3360b21689d", "record_id": "flaws_cloudtrail:0000317:974656a29-b2a3-4f63-81a6-3360b21689d", "row_index": 317, "timestamp": "2018-02-24T11:32:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "974656a29-b2a3-4f63-81a6-3360b21689d", "eventTime": "2018-02-24T11:32:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJS2lkZ2F6RHg1TlhVWjdPQ3BtWC9sME9kYVdtdWx0b0RTNm9WZU5wbXgwcTkxMXlaak5iUERHS0tkRlY5T3IwWFRITEc2QUpWRktjT1ZJVnRHODVQcmpFNE5HSHVsYytrZlpJM3FmTDhYU0pNdHBrbUNibklHbmVqc25XZ0hhaXNSczliSDFXcmp5K21kUGJOZGw1R0FWZFNWM1VFaG8xSFZnM1pmRDVENHlOZ3FPdEo2MVIyQXA2Znc0cmhvcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03a80a30-d629-45b7-a6e2-0dba96057cf", "record_id": "flaws_cloudtrail:0000318:03a80a30-d629-45b7-a6e2-0dba96057cf", "row_index": 318, "timestamp": "2018-02-24T11:32:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03a80a30-d629-45b7-a6e2-0dba96057cf", "eventTime": "2018-02-24T11:32:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoUFJJRmg2OCtXRGtuR1F4UFM4cjFESkpYTkJCUWpiUE9sMjdMbW5SWnYxT1M4ZUNacVl1dUxaMTFvdGFKTTJzdWU2ckZUaS80Um9aRG9SeWVnY044dC9wQWpTeGgxbGJ1RDh0ZGFQYm1uVGU1L1NEOVNvTTl3ckZtTVdEL0hKam1yRlpMOW10R2h3YVR4NzhkMFgxb0NxbTNWMHpLaTkyblVhSGZLK0RqMnN6R0FNUUFqdFVGR0I3cTdZSyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e95472-b4de-4506-8e22-0ed6825d41f4", "record_id": "flaws_cloudtrail:0000319:6e95472-b4de-4506-8e22-0ed6825d41f4", "row_index": 319, "timestamp": "2018-02-24T11:32:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e95472-b4de-4506-8e22-0ed6825d41f4", "eventTime": "2018-02-24T11:32:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNNVUvTnduWjhwcmg3WVh6MTg0QlFYMmFmK0RIRWZHdW9XY05WTnZCNm91SjgrMkx3YU8vWlpiNVA0Q0VPemNoY0ZIZ0tGbnV6MDBZSG1NSjZTcFRWUDJzS0NMY0dSSHRZOWxiUGtrWGhOYzdxNzdKYUM3dE8veFl4NVBqNHlXbEVNNy9ySnV3c2hVSmZraVIvTEVybFVLTUIxN29Fd2tXdTA5cDNyajN5UWNpeGdlNGZiT2hTTkNlWHhuaSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8da3e30f-1d83-4e1d-b66a-1f6cd8a73026", "record_id": "flaws_cloudtrail:0000320:8da3e30f-1d83-4e1d-b66a-1f6cd8a73026", "row_index": 320, "timestamp": "2018-02-24T11:32:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8da3e30f-1d83-4e1d-b66a-1f6cd8a73026", "eventTime": "2018-02-24T11:32:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIybVRZSkE1VnE3ZkxmNlJ3azUzZktjc2RmaFZaS2E3ZEU3a1J6R1YwU0pFK2JRN3NIWGFxcHpNSU9aMk9GMXBiSGowd2VCdDEyK3R4U21KOWwyNUFSYzAvdE1maURiY0p6T1RlSFlaZk40bzJFZExnSTdxZ1d4KzhENkh4aW9xODg3aHR2cW5rNU44Y3BYSVB1aitvSEdONXltbzdwUTBzdVlDNGk1TmxKZHpic2Q0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22ffa2d6-898f-484d-bc47-a146d675d578", "record_id": "flaws_cloudtrail:0000321:22ffa2d6-898f-484d-bc47-a146d675d578", "row_index": 321, "timestamp": "2018-02-24T11:32:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22ffa2d6-898f-484d-bc47-a146d675d578", "eventTime": "2018-02-24T11:32:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ea06a1c-5f26-4120-a045-0cff11d2d339", "record_id": "flaws_cloudtrail:0000322:6ea06a1c-5f26-4120-a045-0cff11d2d339", "row_index": 322, "timestamp": "2018-02-24T11:33:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ea06a1c-5f26-4120-a045-0cff11d2d339", "eventTime": "2018-02-24T11:33:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbdf7ef5-67eb-481f-ad06-5c20f4fc5a4b", "record_id": "flaws_cloudtrail:0000323:fbdf7ef5-67eb-481f-ad06-5c20f4fc5a4b", "row_index": 323, "timestamp": "2018-02-24T11:33:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbdf7ef5-67eb-481f-ad06-5c20f4fc5a4b", "eventTime": "2018-02-24T11:33:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVK1U4RGNVQUdEOXVqNGpmd3paa2lOY241N1REUW1pNzByejhtbkd5YW1rMEJuSmtJNGlHMEMyeldBMkRmajM5Rkp1dTVKR1dGNzdEUTlQTDNBNjhDUHIwaXA3d1hETXN4RXUxWWw0QjdGbm5qUnhEd3pPcjNLR0pXbS9yTzBnM0xmUk9NaGpmVkVQcWNrSmI4UzN5aU9BN1R3b0pMcVlYSXprQWdmU3FOUmsrUmJRZEFyWXlXM3JtSEU2UVg1az0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6594afb5-b9fd-4309-a873-699629a8b", "record_id": "flaws_cloudtrail:0000324:6594afb5-b9fd-4309-a873-699629a8b", "row_index": 324, "timestamp": "2018-02-24T11:33:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6594afb5-b9fd-4309-a873-699629a8b", "eventTime": "2018-02-24T11:33:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVakRtVEZob3pMRVJvNVE0dHIzRkJHbEJobWZnakFOYkJKckl1Q0hrMHBBWWlFRi9KWm5GbnR6ODgrazAzVmw5UHd2MXVpQytNdHB4Zk9tWE11UHNidkxCMFhhM1RIRTROTnEzRGdpTzRVeXF2b1VVaFIvaTlFNjQ5WVA4Z0JWYXRETWtCMGFlNGVGYmQzTkVpY0loWldOTm55NGpFSU1aZ3ZaV3BpVFFpNU9UVlJhNU1WSFdxSWZvMEpmMkVqVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c107763-c6c5-48a2-88cc-7c55954363d8", "record_id": "flaws_cloudtrail:0000325:c107763-c6c5-48a2-88cc-7c55954363d8", "row_index": 325, "timestamp": "2018-02-24T11:33:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c107763-c6c5-48a2-88cc-7c55954363d8", "eventTime": "2018-02-24T11:33:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2Lzd5aUVJWXVsVGw5YVRmVGxhMW9GMlJHaWxUQWp0V2dZZUN2Uk8zQzdwdUI3OW1zQ2l2OTZqR25ZR0NZbGRMVzFrY0xaaUtnMXFURk9NTGliSzd5bzRJa2p0TXFEd1RoUmJkbFVielpxdzkyK1NBNVZ5M2NYT2hMck9ZQ2o1eERZdXN2ZVBaTlk3a3BpOElJSE1vdmlGN0p3RDFlaUtqZVRRdnJ6ZlhZeVNlQzdXNFVVK0ZxN2Q5cStJZSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69176a-1df9-453d-8fa5-1f74b57c8fad", "record_id": "flaws_cloudtrail:0000326:69176a-1df9-453d-8fa5-1f74b57c8fad", "row_index": 326, "timestamp": "2018-02-24T11:33:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69176a-1df9-453d-8fa5-1f74b57c8fad", "eventTime": "2018-02-24T11:33:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0UGJtYjNuOE1mUVhqenM4R1Q3ZWdQVFFxbzA4Z3FDay9XZVZVZm5QaTdDZW5TNTdZb0pNRjNIZDFHUkpndXlFU0sydGhsNllPaEhJcitQVnh2N3loZDMvbVJ5TXNTYVFvbEJlZUdCMXhUSHFqL2JXV3BlTlZqcmRzaUZMSHMreDZ2cEVXKzdyblF6RU9mcUJ0V3BLYkJ5ZFB1LzFqNm4xU1FpR2pFUm9DWDNjd3Z0QVUxbCtwRDFadUIxZVNOaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e52e3c0-42b5-443c-9add-247c43596998", "record_id": "flaws_cloudtrail:0000327:4e52e3c0-42b5-443c-9add-247c43596998", "row_index": 327, "timestamp": "2018-02-24T11:33:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e52e3c0-42b5-443c-9add-247c43596998", "eventTime": "2018-02-24T11:33:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUYnpGZDRDei9HREZlS0ZpNm05L214T3A3bFBwcmJhYjZhVzd2cFQ1bEprNFJRcUUyeFN4OWpMWk85WTRxYjFHNUtjNjAzL1JHMHVQTTVHQXRSMGoyamZ1Nms4ZVcrQ3FhWjlFY0Z2dmd2eVZ6ZTNpWC90K1lYVGlhRnVvTno5RTRyclNsV3JXZmp6VGIxZXc3QlYzcFN4cTNZdkxNOUIvWnJtclFnR3ovazl6Q1NEQ2Y2WmQ3b2NWUVBxL1BwUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f1e7961-ebb3-4004-a00e-f782a3bba825", "record_id": "flaws_cloudtrail:0000328:9f1e7961-ebb3-4004-a00e-f782a3bba825", "row_index": 328, "timestamp": "2018-02-24T11:33:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f1e7961-ebb3-4004-a00e-f782a3bba825", "eventTime": "2018-02-24T11:33:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBd0h2SWttUnhXa2E1LzB4c3owVU9tcXhoU1RrM3NPVXZ0Ujlha0YvMlpPR3ZOR3NrR0pRbVVlcTNVclVubGNXL3lIYTVzR3FlaTc5a3krZFRRdjJveXpuNThwYWJnVnNrUmcrdXdNRm54UzRabTF3ckF5Y0FQeTZoRUVtTlBHMHJnSXVYRWlxdkxXTzlxZlFJT3hNaHpCVUcwRzdPbEVoSXRMa0xZcXNXeGlpaXBwTXA1d0krb2xGMWwxYSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96ee1adc-697e-4267-819b-5df0d2e28c3d", "record_id": "flaws_cloudtrail:0000329:96ee1adc-697e-4267-819b-5df0d2e28c3d", "row_index": 329, "timestamp": "2018-02-24T11:33:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96ee1adc-697e-4267-819b-5df0d2e28c3d", "eventTime": "2018-02-24T11:33:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYZ2pMY0dzSFhDTlAvTjlJUGdHRkhOdWhMY0pCSWdrelpvTUFXRFIvNVJRWUxZT1pxVVh0ZklLRU5QVjlya2F0MXE0WFhQVE11d3NoUFdnSFZiMXRwdUlzUFROa3RZT2lYblNoUTZpVEJod2M1RmlJcjVKSkNMcXVEeE1aYVlTd29FR25PcnNaUkd5cU9VUEFkYm4wRWM3VXQzRjd3cVVUZFZmbnBTamFiMmxGZjRIeDhHampabGFBN2tqLyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4d206a9-09b4-46c3-8997-38561a8726", "record_id": "flaws_cloudtrail:0000330:e4d206a9-09b4-46c3-8997-38561a8726", "row_index": 330, "timestamp": "2018-02-24T11:33:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4d206a9-09b4-46c3-8997-38561a8726", "eventTime": "2018-02-24T11:33:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlU3NsUXl6R0w3VFc0Skk1anJIRkpGZ1FFdER2aExBa1Z3d0tKUVlsWWxTc0lTV0o5T0RydW1vd1gyNGxBSEdQYUEwQ3RaaGdjV3BUWkJZd1dtc1hWYi9MeU1DTU1hZWIyYkx6RERoZFJXSEJQVjBjdERLVkdNaWhYcWt6NllnRUdScFRIMEhrWVJERHdXblRuc1o1Ni9hdVl3bzFNVUU0eGNna3lLZjZ5U2xSdDlMTTVyRWpzazEwdEtuRzRraz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9b802236-fa42-45ef-9a56-e68e65daa823", "record_id": "flaws_cloudtrail:0000331:d9b802236-fa42-45ef-9a56-e68e65daa823", "row_index": 331, "timestamp": "2018-02-24T11:33:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9b802236-fa42-45ef-9a56-e68e65daa823", "eventTime": "2018-02-24T11:33:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyWDFqcFVWbDJoMlVpb240TTlXZWtpRExac3BZNGcxVUtvaTFoT2t3K3JFVlB1YVFZMkNORUU0dGozcmdUZnRxMlVGbGNvVUhXbmlmaVYxUktqQndrUE9vNkRJN01OSjlNWnF4QUxVWnMyaVN5SUhvQmlFaHFoLy9rSGU2M2tLcU5pZVBtQVNxSWdjT0VCNm9zbzI1ZGYydjFBRWQ4RGxya0w2d1NzYlFIUVE4N3I4UHkvQ081ZnNtUnNsSVliZz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a531380-742e-4a40-bf42-54cfe409d318", "record_id": "flaws_cloudtrail:0000332:a531380-742e-4a40-bf42-54cfe409d318", "row_index": 332, "timestamp": "2018-02-24T11:33:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a531380-742e-4a40-bf42-54cfe409d318", "eventTime": "2018-02-24T11:33:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJudWxxWW13aWpyVVNKS045WXhFSHZOL1F5VzFyNWg2Y2tVOGRubUdRaFVaMXJ0YWxLR1piaGpvM05BL2lHOW5LeG1kQzEvNGd3aFp5V2h0eFp1Z0tRN2xGM2NOdGs1ZVZoY0duSVVSenBlMzVid0NKNnJDRnAzL3hwUm01THAvTlFyanJKTlhvckZienFITmJidWJKdy9uOHVmNURWY2dBa0orME5SV0RtTllrbHphcWEraC8zUnJjTUYxVlExWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e2c715e-8c16-474c-b4ff-bf042b989f50", "record_id": "flaws_cloudtrail:0000333:1e2c715e-8c16-474c-b4ff-bf042b989f50", "row_index": 333, "timestamp": "2018-02-24T11:33:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e2c715e-8c16-474c-b4ff-bf042b989f50", "eventTime": "2018-02-24T11:33:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0NlozOEJlOExRUGxub3lwTzd0NzA1a01hb29xZjkzd3lNT0R0b2FLVWh0V3Y0WktDTnVsZHBra0hpdkJJbHRhUEtKS1BNTndjTExzQXQxSTA5ZVphdGhSRDRKMVB4Q1Q2WFhjOHVxTW56ZG0xSktQZS9QTS94OWhJTlowVExyeTA5RXNHR0haSlYwdjRrd2M5MXJWRjdBRHFabk4wQjFTaWZsemVJd1YzaHlEclhMV1JZL1l1QXFjSjZPKyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d7803a2-eef5-4058-bece-0ab20a9319d1", "record_id": "flaws_cloudtrail:0000334:8d7803a2-eef5-4058-bece-0ab20a9319d1", "row_index": 334, "timestamp": "2018-02-24T11:33:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d7803a2-eef5-4058-bece-0ab20a9319d1", "eventTime": "2018-02-24T11:33:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpczg2SS9icUhLV0lzUHhPQTRwZmFYdjBrZGJEWktrRXJidzRjTk5KdzRXOVIyZXo1L0hSODA0YmN0RS9IejFIdWtDdDB0MUZEWjh3b1lDV0Q5Z21Ocmorbzdwd0xpTDBsZW1qby9TRktmZk1UUXNkN1F1QnVFaWZuN1RmR0VBU2xGVzJwVDl4akw0c1poRk5RZ1N3WlRrNis3ckpudXY1dEVJMjcrR2JDWTlIMEZIMmNHRnprQ2o3QXUwPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4599ab61-bfcf-4b74-ade1-0badbeb70d28", "record_id": "flaws_cloudtrail:0000335:4599ab61-bfcf-4b74-ade1-0badbeb70d28", "row_index": 335, "timestamp": "2018-02-24T11:33:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4599ab61-bfcf-4b74-ade1-0badbeb70d28", "eventTime": "2018-02-24T11:33:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJZUZEalU5VmZBWFpta2Evbk02K0hvOE1rM1k3a2tiUnA2dU14L2tidDhmVWV3VXdITjJUb05acC9vNHo4cHNXckp3b3dJOXRIUlZuaU96UXFjV25LV2dPRzJGL0hZOTlMZE1HNXEwdHNXS25sSGlYOFFMWmtZZTBMcTVjY2pjQ2ErN09HcDJJV0ErRXJOYzZuQnpSWkZGdXNkSTNyME43VFAzOEJmNE96cWF1Y3BZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7501a9d1-8247-4504-a3f0-2291fcd03bc6", "record_id": "flaws_cloudtrail:0000336:7501a9d1-8247-4504-a3f0-2291fcd03bc6", "row_index": 336, "timestamp": "2018-02-24T11:34:13Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 646, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7501a9d1-8247-4504-a3f0-2291fcd03bc6", "eventTime": "2018-02-24T11:34:13Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d572460d-06b8-45ed-81d9-085e48099a97", "record_id": "flaws_cloudtrail:0000337:d572460d-06b8-45ed-81d9-085e48099a97", "row_index": 337, "timestamp": "2018-02-24T11:34:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d572460d-06b8-45ed-81d9-085e48099a97", "eventTime": "2018-02-24T11:34:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1173a90-e61a-4c6d-a1b7-942f1e99bc6b", "record_id": "flaws_cloudtrail:0000338:a1173a90-e61a-4c6d-a1b7-942f1e99bc6b", "row_index": 338, "timestamp": "2018-02-24T11:34:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1173a90-e61a-4c6d-a1b7-942f1e99bc6b", "eventTime": "2018-02-24T11:34:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCWlVFSDd1OThhTGhzVktSN3FGSGQvbGZwalk4MmxHQUZnWElMZFovR2VJejdvenpWbk40TDdIN0FINGJxTXA4T3cxcmpuM0hWVHFnVTJoUk96THVPWWVDNTRpY3Ezei9WdCszREhxRVJub25tWE1FT25KR1owb0pPU2oramgwbXFTNzFEYUJpbWJMc3BldHdWZ05FRFhpZU1PbUVNOUdoVDZoNzVZWFQ1dkgzbGJBZ2hlNEg0NHJiMmlJdW1mST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38534-990d-493e-86d3-b95044c99", "record_id": "flaws_cloudtrail:0000339:38534-990d-493e-86d3-b95044c99", "row_index": 339, "timestamp": "2018-02-24T11:34:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38534-990d-493e-86d3-b95044c99", "eventTime": "2018-02-24T11:34:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0bEpJZUVSU1Q5ZHVIbEJqWk1WMDlsU0I5Rk1RakJUMFlaM1V6bWg0WFd4aGdkMExHbjl0WmxjV1FoZXdxQWQvdEpuQXozbHFLTDlJMHBTMUtlMnlrR1ZxdUxtclRXRWJtaHA1SkUrRW0rNElyT1Z3RzVLbUU1ZDAwZ0R1bHNiVUJseG5aZUlpZnhKTzFMOXRPK0pybWJWbUZWYjFiTm1xOFhxUG9BZG9NZWJCcWo2amNNRVJ2ekNpRUxkenBzUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a682c22a-8a17-4aad-93b4-174dda8f0308", "record_id": "flaws_cloudtrail:0000340:a682c22a-8a17-4aad-93b4-174dda8f0308", "row_index": 340, "timestamp": "2018-02-24T11:34:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a682c22a-8a17-4aad-93b4-174dda8f0308", "eventTime": "2018-02-24T11:34:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1Ui8xd3JBbGFkVStHUEFQOHJsYnAvdC9RSEhxd3JzNXB0RmZYVm93eGJ1WVJDdzgrZ2JnUnB3aWtHRExTcFFJalFUbUhldjZ4dXo4dkc0TTROeitYK1d2T3ZLTkJ6R3ZVcFdERzl1ZytTL2RIamZ4Y0xUanVuNzdBVG9Fdnp0bDQwL2JhaTNpVkFEWmJ4VSs3OHB4M2tCaXIwbGhhY1BlT0NyRkU0cldVZFJpNFVCSHRkcktGUWQwVzVvRHdhdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12034-3475-4907-a738-39d1f62f3afb", "record_id": "flaws_cloudtrail:0000341:12034-3475-4907-a738-39d1f62f3afb", "row_index": 341, "timestamp": "2018-02-24T11:34:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12034-3475-4907-a738-39d1f62f3afb", "eventTime": "2018-02-24T11:34:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlaENybXlQMGV5RXJUNUd0WHZTWmIwKzU4SS8xTTBqcmI4Y3c3Z3RUS0RDT2srRG8vc2tQZ0d1VFlUVE9lM2tyNFFNMEpKaHUxSmZGbm5mR2xISzJ1eEFMV2Q1NHRTZWxYVDhFRnNjNlNVajFWdUZYRlFJblB1RVVpT1lSNXZPWVhRQ3AwcGNzS2p3M202Vklvem9Zd1liVWpUK1VKK3d4WHRlZEpvTTdnNDJDOVU1aXZ5UmVrVjFjQnJwRSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed22559-6616-41a9-9e0b-95e038c5c2c6", "record_id": "flaws_cloudtrail:0000342:ed22559-6616-41a9-9e0b-95e038c5c2c6", "row_index": 342, "timestamp": "2018-02-24T11:34:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed22559-6616-41a9-9e0b-95e038c5c2c6", "eventTime": "2018-02-24T11:34:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWaG9PYkNrbXBTZDNvVXlZZ29FMW5Nbk41ZGxEclZLcnBGZUR3SEw5T3FVZU1zcXFQcWFkS2V6M0NkNm1hWnVUOUdId3NhdG9nOVQ5a0lQNFdETmQ0WTF1OUNycTdmbDBWZ0crL1dia2t3MStmN1FIaE9GV1hQTU0zSndwZWlCK0piblgwdjJ0Rjl0RW9yTUdyZmlPNCtFcUdZdW5VZ3JSdnBKc0srbDhiRG9YaU0rUk9hOXRWZ1J4RTg0d2FYYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c370a8fc-df67-453c-a161-0981f816e05a", "record_id": "flaws_cloudtrail:0000343:c370a8fc-df67-453c-a161-0981f816e05a", "row_index": 343, "timestamp": "2018-02-24T11:34:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c370a8fc-df67-453c-a161-0981f816e05a", "eventTime": "2018-02-24T11:34:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQbmhzZGJzNnpZQXc4a1B6akdpS2FCd2NjOExDSjFaMm1GYUtWOE1xSkJMUUZIanVPaTByelJtUnFsQlBSQjhadEs4UkdqeTZQMWZ2MGk5TWFiN3ZYRkpTSlluRWRUYTFqWEJqblF1emV3WmxqNDMvYXdRdkxPZzd1bTZBREZBeFRZVVdEb0swaXA4U0ZpSzM0Mk1DeVNvY3kxTWZrVzVQWVo3SXpIYlVia2Y3RjF5MUZERmN6WFAwaWxERyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "090334b7f-c368-4822-abdf-42396a1da750", "record_id": "flaws_cloudtrail:0000344:090334b7f-c368-4822-abdf-42396a1da750", "row_index": 344, "timestamp": "2018-02-24T11:34:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "090334b7f-c368-4822-abdf-42396a1da750", "eventTime": "2018-02-24T11:34:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjSUlLQ3FzMDJ1citxa1VOTzJyN25BdlVhU0IvSklBQ3IxM045OTZVeVBMRVZrQnFQNlVRQmlCYmNhYVZ1bVE5clp4WXo2dXQ5UE5MQ3pUZ3E3QjV6S2V0OC9ZU2RNYkhLNnppd1ArSVp4c0dCRURmYmgvalhMdEozd2liTC9OR0JTMmgvKytiSTZqNC9hSWt0UmlXODVJMFoxb0hEeEs2V2g0WXFjcHdKZUd6UUVzMTFwaEVkS2RoTjdENiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "081eb328-f62d-4cc5-a552-6ff8daa5bce4", "record_id": "flaws_cloudtrail:0000345:081eb328-f62d-4cc5-a552-6ff8daa5bce4", "row_index": 345, "timestamp": "2018-02-24T11:34:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "081eb328-f62d-4cc5-a552-6ff8daa5bce4", "eventTime": "2018-02-24T11:34:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuWFM3dHEwcE5yRDg3azBVQTVvZzYxNkRuc0ZpZ2hMVzRyNWI5MktyVDNFSDFicENPNGN6SC9pdHRUNE1zaUoxd2ZwSXEvdkpmSHY3cFdPcXBFNU8wc1FEWFBnOHk5QnZYRVhwN3VDcXA1LzBEbzJ4MDhrUzhFZG8vclVkeW13a1VuZENuc2hUZTg0Kzc4Rm9yU1AycW5IaVdQSmI3WjIvd3U0bUhxRzVGa3M4NmJXdnN6eHh0cE9QclhVa0lWVT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "116934a90-a233-4f7e-a136-1136d7e6d73a", "record_id": "flaws_cloudtrail:0000346:116934a90-a233-4f7e-a136-1136d7e6d73a", "row_index": 346, "timestamp": "2018-02-24T11:34:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "116934a90-a233-4f7e-a136-1136d7e6d73a", "eventTime": "2018-02-24T11:34:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwek95bjJ3WDJxNVdTbGVNcVozQXF3MTZldWZXZFg1WHNNRENPN1ptV0hRamFDYlZ5UUJ1TExmWG9ZdTlhS25lOW1HVlFGVVY3RVJxQkVmOTB5VjFxWlRRY05aMW5BR29LSTZpMzlFWlNWYS92TzA0eEZHL1lCTmM5STlOR29YV2JDR1ZraDQwbXF1RjRCMWRueVFIcDRJbFgzZ0N6anJsVU9aY1EyU0dDcFhBL0Nqd3hDbHNQYlhLajN6eFZxYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65460-07cc-4f98-8439-22b84c5c7c79", "record_id": "flaws_cloudtrail:0000347:65460-07cc-4f98-8439-22b84c5c7c79", "row_index": 347, "timestamp": "2018-02-24T11:34:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65460-07cc-4f98-8439-22b84c5c7c79", "eventTime": "2018-02-24T11:34:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtTHl2TFZVMXRxRXFGMUhBemRlTUlRTG1YOUpDKzdSM21pV1J0cGVWS3NaTENXNU1wb2pud05TODdKSUhlb3NEVUZwczA2bFRBUnM1QjJxWVdjNDlhMGFLKzN6bklHaFFQcnNLK2x2bGpZTUI3V1hOTy9GdGpZQXBHazB2MEtqUkttb2RPK2ZNRnR2TUFqL2g0dDExMFFSZnFaVXZHWEhlZHZyKzZiYXE5THNoZCsvRVlnU2g3WURPbS9KK3g1RT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc8cb755-1da0-451b-b1ba-fc4c70a4902b", "record_id": "flaws_cloudtrail:0000348:dc8cb755-1da0-451b-b1ba-fc4c70a4902b", "row_index": 348, "timestamp": "2018-02-24T11:34:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc8cb755-1da0-451b-b1ba-fc4c70a4902b", "eventTime": "2018-02-24T11:34:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRMXJMWDZsUXRjYWtiUEtDcFNUbUVmazVnVjYxRG8zVDlhQStOTHBpZk5OaXVEblBwL3VDT1ZxRmI3emZ5T2ZsOE1oenlZSFNRQTRQUHFXNlFOK0p5QWJyQklvL2dCTmdQMFdLdTcwcGltQStoU3hKa1dkR2swSDViT3hidkNUSWNvV21tcUlCUy9QRG4xUHJCdDZ2TDFrNlYvT05kSjhmaml0eEkzN2VOeWd3MllybUEyQk1ldzhBejlZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb217763-14ad-4501-b1a4-f3dc50f6c651", "record_id": "flaws_cloudtrail:0000349:bb217763-14ad-4501-b1a4-f3dc50f6c651", "row_index": 349, "timestamp": "2018-02-24T11:34:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb217763-14ad-4501-b1a4-f3dc50f6c651", "eventTime": "2018-02-24T11:34:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5R0ZyY0lIT2s2UTYyMmlpRTIxY3JFaHVBZ0owZWxIWngvRVF5bzlOaGRWMFJiQUVMSjZkb2E0a05LTUtpTE5id2wvQ2FKZHFjanJudE9Ld3JWVEIzY29vVlR6UHRtQWpsMDNGaThWMm15c3ZxZEVON3RzR0JIQ2JYWEszc2ZpS1hxV0NOd3JHT3ptRUdMaDJwVkExdktMdWN2ZGtuaU1haEI4eXB5bXRpUkVXT0NhVUNCVU9KWm90UnlPQSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79ff7bf5-37f5-4d44-befa-50a562a08d83", "record_id": "flaws_cloudtrail:0000350:79ff7bf5-37f5-4d44-befa-50a562a08d83", "row_index": 350, "timestamp": "2018-02-24T11:34:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79ff7bf5-37f5-4d44-befa-50a562a08d83", "eventTime": "2018-02-24T11:34:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHS1dQWGlKNXhRODdmTVhIWGx3VmxsRjJmMXlubnlLanBCN0FwOEpHVEFISk1zcmZ0OE9ESjRYU082eDlncTFTTXA4Q3c4Y0RFQTF4d2pnT0l2K1hkTXdqSGtjUkZoWnhJS3NScklmZko0ZTlHSkx5VnFvNGNTZzZHaG9SS01id3d3SThObnlNbG5UMUNWcFp0NzBoMm9aVFoyWk91SUgxQldkSUI2RGl0aW5BSzhVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a671f232-71a3-4799-9d17-d6c5506f2129", "record_id": "flaws_cloudtrail:0000351:a671f232-71a3-4799-9d17-d6c5506f2129", "row_index": 351, "timestamp": "2018-02-24T11:34:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a671f232-71a3-4799-9d17-d6c5506f2129", "eventTime": "2018-02-24T11:34:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "24cce27e-24e6-4254-97b3-69c79fef3f93", "record_id": "flaws_cloudtrail:0000352:24cce27e-24e6-4254-97b3-69c79fef3f93", "row_index": 352, "timestamp": "2018-02-24T11:35:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "24cce27e-24e6-4254-97b3-69c79fef3f93", "eventTime": "2018-02-24T11:35:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6406b237-9965-40cc-a04b-9d9dd1530024", "record_id": "flaws_cloudtrail:0000353:6406b237-9965-40cc-a04b-9d9dd1530024", "row_index": 353, "timestamp": "2018-02-24T11:35:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6406b237-9965-40cc-a04b-9d9dd1530024", "eventTime": "2018-02-24T11:35:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvNU1SS0FYYk83ejR2cjJpZStBYXlJbjhldDY5M0J2aGljdVh5LzI5Qjc2ZjlJMk92bjBhNmdBMGxTem81U1ppVnJqeHZiMUtRMFVvU0oyU1lLWTcweUZzT05ta29lODVpMWx2UWd5MUJycFlwZmFLcFRJWTlwODkydlFKVjBtOU5IQzJ4M2JYa1RMWjVmU1hBUkxORXA2WnR2cVlSNlJIOWc1bFlUVW4yblIzYUl3alB2UmZ1c3VzUGZjdUZzST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72269d-3a6a-4563-93bc-fb97260f34e3", "record_id": "flaws_cloudtrail:0000354:72269d-3a6a-4563-93bc-fb97260f34e3", "row_index": 354, "timestamp": "2018-02-24T11:35:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72269d-3a6a-4563-93bc-fb97260f34e3", "eventTime": "2018-02-24T11:35:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVYzVYOUlqamMzSE1kajNLa3V0cThkWmp4QUpNS0JQMVBPOWhJcXp4VThuUTRnWjIyU0hYQ2p2TzJCZUc5NkhjdW9ieEdNTC9SR05CVWIyNWQ3Rk1ZVDdsM1RoYUlmdkpIUXEvOTUzQ3JDLy9oKzJZTmU2R1JkWnFES2xoa0RXcmpKVXZBRUkwVFR4dTBQdkpCbmdVSDIrOU1XVWRISVV6bGYwc2NzTXR4dVlaaXBTQXhmUDRlSFlFdE5PaWtaMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58dc5686-57f1-4dbe-81c6-532a8cb41edf", "record_id": "flaws_cloudtrail:0000355:58dc5686-57f1-4dbe-81c6-532a8cb41edf", "row_index": 355, "timestamp": "2018-02-24T11:35:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58dc5686-57f1-4dbe-81c6-532a8cb41edf", "eventTime": "2018-02-24T11:35:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwMWgwclVMUXpKNVllcUkva1ZoL3FVNkx1emV6OVo1cEVVRytpZHcrWVRWS0NBdVlLZ1ZFQXAzc0VIT2l2QmdIMTMzdlVjeEJvZnhTOWJpL2FoNVFmeEdMNlJTQjVmTERBVDdCS1U0WG1na0t6V2IyWllab1RRelBqdm5lVVFQaldPZGVRbXVlSnd3M3NzeTdtcGQrbURXQlFqa1VlWjJOUVg1cDZKTzNycXdMZXJrV3ppcGpyWmRIbFRkaCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77c7574a-0ba7-4f1b-b54e-24b63c8c74e6", "record_id": "flaws_cloudtrail:0000356:77c7574a-0ba7-4f1b-b54e-24b63c8c74e6", "row_index": 356, "timestamp": "2018-02-24T11:35:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77c7574a-0ba7-4f1b-b54e-24b63c8c74e6", "eventTime": "2018-02-24T11:35:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOdWJRempQQ2NFd0V6RS9saSsvdmlRQzM0YUJPUVNwclo4amtBZmx4NUNiKzh5cUFKOExxR1hCQ1dDeGwwV3dPT00yVTBwTlNITm1TQzJodWpuTzhjdTkwUGFWNDNmZlF2ZFE0UlNZMDZCWVNTU0QvT2JueTBUbTVnaGNEbFVDWlM0NWdoODYvNzNZaVhmZ1BrckJDZEh3aHh3aE1naEwxbjVTYlpMZFFjZlB1SkVSR0phZmwzVWpvOWY2Z3RlTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82c1dc30-9eac-4f47-8d5c-5b21325e3e26", "record_id": "flaws_cloudtrail:0000357:82c1dc30-9eac-4f47-8d5c-5b21325e3e26", "row_index": 357, "timestamp": "2018-02-24T11:35:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82c1dc30-9eac-4f47-8d5c-5b21325e3e26", "eventTime": "2018-02-24T11:35:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4QXJGTUZZaGh5djYvZVlNKzhvTklJSkM2OUVtOGpzNEVJQ1hFbVBibnJPdTVwT0R2Q3hJNm1Pd08rRlJFVEFzeDdYcmJEYWV6cklXdVFPbytIYVFnbXB1MWNHUXNHUWdQOHlUZjVuemtKSitDRXJiQ3VCK1VPenVYcXpaZitHaGJLNDZJeDYzOUFZdmx3emFzNG9NUm9GajVVVmlESGNNdEdaL2liVTBBRnFSbWZjbE05NGgzRlRmSkhYYXpMbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25a555dd-f266-415c-bfc4-769f1b4d0387", "record_id": "flaws_cloudtrail:0000358:25a555dd-f266-415c-bfc4-769f1b4d0387", "row_index": 358, "timestamp": "2018-02-24T11:35:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25a555dd-f266-415c-bfc4-769f1b4d0387", "eventTime": "2018-02-24T11:35:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnSDNielI1SnI4cXB2Z3pLRldiMTNiWWFUR2Z6ZEJTbThXemkvWWFTUlc2UFRMNG9Nd2xmZXZRU1ZEM3JIQWwwZ1NRK01zcHF3U2hCeVNvSDA3TTNYWmVqQ0RKcU5vaWM0WkEvNmtTc2o4aWQvQnNGR0o3M2J6TERFa3N1eEYwd00xM3NDS1MyQU9jTURPZURNT0tLY2NMdHZONVBvdk1RU1RnNktyTDlwcVdDdWZZNlRIV0dyQXVOM0VZNyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30e1ed9d-10e8-44f0-9c9b-39bc559c9377", "record_id": "flaws_cloudtrail:0000359:30e1ed9d-10e8-44f0-9c9b-39bc559c9377", "row_index": 359, "timestamp": "2018-02-24T11:35:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30e1ed9d-10e8-44f0-9c9b-39bc559c9377", "eventTime": "2018-02-24T11:35:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkbGZLeGF1UTg2eFhJQUo5SVJubStXVEt0Yi9HL2RXSEtNRkFVZjJaQ3RiQ0dpbFJqQjd5bWFzb1MvdVdab29TTVl6bUF4Qmh1aTA3cUpnM24xOGtaSVlHbjMwRzNyZFJ5bzVtdFRjVVBQYisyeWpNNWxBRHczUGJTODNKbmRYRWp0WTZ2aGdwSm9PK1MyWW9iZ0dyWVFSb3BGVGY5L2RoWkxFMG5qSlFUa0tUTjlRT05DbE8yYTAvbmRGeSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4836cbf0-fb78-4814-bba1-28b6fc9b6a01", "record_id": "flaws_cloudtrail:0000360:4836cbf0-fb78-4814-bba1-28b6fc9b6a01", "row_index": 360, "timestamp": "2018-02-24T11:35:33Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1490, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4836cbf0-fb78-4814-bba1-28b6fc9b6a01", "eventTime": "2018-02-24T11:35:33Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: cAMg0nHIXmX8IBwt5HHAB2121m4oUb4DbHwJyH8ZIOXUbtxQcrUXqcbil_yqC9-fVvPIMr7T1G4NJhbYHY21wZifptYHtTraYhkaX2S3ACFu0y7dJGyh_UHuHmeh-1mA9TNTvowWjmSDobGclCw33tKmU3g9XUPHjwbgUWbIQuII_d3dF2iHsQ3Wq_mx4hq7M0jwoqZcrZfr-AKdQqd4LJmIXPMxWwy14DfxZS6_ttLZbGI8uQfyirM0IuIiDuKpNEOB7pT6LdXicKw4EWSjdeJHAleBOSQ0WVw_5YhlUY4nJRvS93iEvgXdjo6klI2b7C5kIPSD4DWEAKcugM0kVoYQhay1T03Ntu4zcyJXM4lWxlEdKamUdcWMCuQskToKBrOCja57C1CiO5IXFqJa9ZB6VLLtmuf9MB8eM_j_NsIARCAbQjPJZNAx976PB9phtL1ORSU0B3Pi7yBczelk7nmVGTsYQtSKD1jMtOh80fILZo8VERK4eSgjaT0ovRBZ0VKd_q3R6j6_7izK7g0JUKjjcwVs_1rnYK7keKBLD9tVWKoVhytBB-mZA2hSpidmEgCuzCOiiKy3pifaPmM8oFvIyEZp0yV99pcsIAy0LJTARaN55qmzV7u-wDv7KQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0080f84f-76ea-4970-8129-0d22668a9b", "record_id": "flaws_cloudtrail:0000361:0080f84f-76ea-4970-8129-0d22668a9b", "row_index": 361, "timestamp": "2018-02-24T11:35:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0080f84f-76ea-4970-8129-0d22668a9b", "eventTime": "2018-02-24T11:35:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwWEgxVzk2c3NyMnVpdzhWQmwxSjNuZG9NWThVVld0RlRybEt2em82aVhOMU44WlZ3S0ppZCtZWkIvVjNYbVFoakNZR2kzSzM4YmErZHgxUjNwVWhIeFVEQ3ZoNmg1eFdQNVRPT2NiRXdBU3lLQjlrYnFJNTVJMXU0SXFxWW4yQ2ZZZ2R4bmJFQitUcHNNbzdvSEFpU0tYRXFDR1k1TDNuTUgyTDEvTlpLTjB6V0dYYXBWVXh1WnFTUHJ4YWtZQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52e39cd5-a883-48cd-bad7-9284a442198", "record_id": "flaws_cloudtrail:0000362:52e39cd5-a883-48cd-bad7-9284a442198", "row_index": 362, "timestamp": "2018-02-24T11:35:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52e39cd5-a883-48cd-bad7-9284a442198", "eventTime": "2018-02-24T11:35:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXdzVqSnVmKzd0RW9Ra3p1bGREM3ZtdzIvZmRRbGczNjlodmZzNjh3dXpCeGoyRzFLVEY3ZDlTYWtHUjVXK1ZOU2dETGdCcG1HV2grT2h3ZndKNlJYd2oxUTI0Wmx3SGhKT09DNUxOUUhLRG1wSnc2ZWk1K28vZXJrbldsZFFQQmkxbXVoZjJJTGpnSFUzdDgwaFVud0tTdzI5ejQzdTZ1VTZWWWpxckp1RVJzM3crUDlRNjZaMWdnN1owYm1Ldz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0577f8a0-2c04-4a5a-94eb-5d914ed67b7c", "record_id": "flaws_cloudtrail:0000363:0577f8a0-2c04-4a5a-94eb-5d914ed67b7c", "row_index": 363, "timestamp": "2018-02-24T11:35:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0577f8a0-2c04-4a5a-94eb-5d914ed67b7c", "eventTime": "2018-02-24T11:35:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkNGRLa1dXb3RBUXBuOW1ZZDZ2Ylg0eGZyRUpneWtlRHpBcVlXQ0tzTGwvbk42Qzl5TFllNGFTN1NhT3p3RmdkTHhSR0VXazRIYVF3WGhjMjFkcGFRNDNaelJlL2ViVU1US1F4SmtjazJJelRGbGxXL3FsbEtETUZuQlI0aVVTSEZKU1lMZnpYNGxtNkFCRXNTYlhsZmxVdjlaMExVbUE5ZUpab3RaQjVIemxNdjVxVXVhcW1RRDYxaE5FSHNzQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18fcf431-70a2-4ae0-9936-807521fc3056a", "record_id": "flaws_cloudtrail:0000364:18fcf431-70a2-4ae0-9936-807521fc3056a", "row_index": 364, "timestamp": "2018-02-24T11:35:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18fcf431-70a2-4ae0-9936-807521fc3056a", "eventTime": "2018-02-24T11:35:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwRFdOWHNuSFBJNDl2T2VhVXJDUnlrczFEc3B0L3dNR0sxOXpLZTZUNFhKUEJsOXQzNVJxWGkwUEJDODcvWTRXYTBsSGxGRlg5RWk1S1V0RFZzY1h0ZHJCcjNUZEpWeTdlNFZXR0s1dHZSV3ZNUU91VEpDT0xoMDhBYkQyb0Z2ODhmbXlUWVBiSkNRd1Z4djZyOHBYQlNCbWNDUnRDRlREUnE2ZUVWN2FMVFpuLzNtQU9pd0dpU044a3ptWCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b538683-5ca1-4d9e-ba7e-31eef3456c8f", "record_id": "flaws_cloudtrail:0000365:b538683-5ca1-4d9e-ba7e-31eef3456c8f", "row_index": 365, "timestamp": "2018-02-24T11:35:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b538683-5ca1-4d9e-ba7e-31eef3456c8f", "eventTime": "2018-02-24T11:35:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuSUhLR21rR3haZ2xEQ1M4UDkwTkJzSTRxMG5LVTJzakNLMk1KMG0xdzVQOXRZb2pFaEdzS2RkUTdhT1p2U3NFZlYzSFU0eFRlOFZ0b0h2MUNFWmRBQWt6Q0lQZzAzbDlLbE9XdWoxL01nWVFIQmpoMmFwbndLWExjcUVoalp2VGlocGxIb2ZNb1oxTy9RdEFnUE4yNkFocVlZWlJaSG93c2NnSUxRK1kyc1Q2Y21ieC9CSDIwSVE1MEowPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0ac41a2-b1d7-444b-9177-edcaf36b8347", "record_id": "flaws_cloudtrail:0000366:f0ac41a2-b1d7-444b-9177-edcaf36b8347", "row_index": 366, "timestamp": "2018-02-24T11:35:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1031, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0ac41a2-b1d7-444b-9177-edcaf36b8347", "eventTime": "2018-02-24T11:35:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGNE9LK0p6eDhOSmJzUXg2cldwaHd4dlBMVEhSNTF5ekh0Y0pNNXl2Y042QmtmZHNDclFzV2RqalVVMG1pL0l1Q0FhYjRZcVNodUxTdFVpeWpYWGxtZ0hVVFVTQXR0aG5WZEdjM0d0WVg2czRHbWQ3RWV3ZnRBQ3crRDVzOVNoLzR3eFFiL0pIckowbi90U3B4MkdZN2tBaGYyUE5oeC9iN3ljWDJPdm9pM1hTYzlvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa79ec00-c88c-4060-a4ab-2a4bfb5b4039", "record_id": "flaws_cloudtrail:0000367:aa79ec00-c88c-4060-a4ab-2a4bfb5b4039", "row_index": 367, "timestamp": "2018-02-24T11:35:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa79ec00-c88c-4060-a4ab-2a4bfb5b4039", "eventTime": "2018-02-24T11:35:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA6DSAQZZBN39NI9RT", "expiration": "Feb 24, 2018 5:53:04 PM", "sessionToken": "FQoDYXdzEHUaDIeLTi9rdxJRUz0AgiK3A7jX0w+ubk4rxH1q0fbDusgXHtxWfb9VyaU9m1axyWvZGDrIp5T9cxTR2M05lsv9uLpL/h0Fo8RHv5WmJfcQa2GVuWwPCBv6zEYsh13t9Kyph2KNNiZAabQ0N7NMIWpRbQZjvhv7RqJETddEl4xVxhcj3WlRFwGN07xLGVDPN3/rjv8n/OD3sWV9V8wOAnFIKFdi4Z6wRhJ4M3nKGmWgRJtOrO4JvB2Wii6AfzlpYiliTPBVWSOK1yjV5C8n8bEuwYTJl2CA+b7ah/tzlqNuClFXf4c6z+rJoYZPV5usCiu1N0h4ByGuuvk0NjpWxz3xgRdQBFZAiCwV5hxAQilZWQZCA1Oo2V9UwQEcYPTFhVme5ZCu0bTrF+U2ZfntMM/g0b8Duh/AQxwwU6ELLe6XWzzpjr58hAltq/E9npSI/9HTnMLcqBjl+M91P8B6xdb3Mit41pQdSUAe8X+1PWwYUKPAHPRMA2ereIrqvN6gc/FLhyJ80+waVdo/IrQ034EXRLuV4AGMsuM2rih4JZ30Rojo1KTjoBAWdMQgkpgGmCFctzHgtONs5UXh4qYI4rWAOWzs5jBAYlwoi5zF1AU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e126c4d-f92c-40a9-8f6f-092bc410b161", "record_id": "flaws_cloudtrail:0000368:3e126c4d-f92c-40a9-8f6f-092bc410b161", "row_index": 368, "timestamp": "2018-02-24T11:37:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e126c4d-f92c-40a9-8f6f-092bc410b161", "eventTime": "2018-02-24T11:37:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8733ac54-cb99-448c-9d2d-835115304b79", "record_id": "flaws_cloudtrail:0000369:8733ac54-cb99-448c-9d2d-835115304b79", "row_index": 369, "timestamp": "2018-02-24T11:37:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8733ac54-cb99-448c-9d2d-835115304b79", "eventTime": "2018-02-24T11:37:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnSEJyMWtxNnhtRmlBcGZSWWJCWERoRlQ4bE1hVDlLcE05c05IUFBYZUVqbjBlT3FWUVBpelllSXpuVDhEcnZVTEJ0SjdSY0F1N0V5YXZNNUkvWnNVNkNJOERjRUZUa3Y5TzJTV0tndnplek5qaitQY0tMMVFqY241d0cvamRScEZQRlJ0dmIrWkQyTFhkUG9ZbWN2V1FWWHJwRTluUkdkUkdMMUF5SG5UdDRBcHF6bnhjTkR2SkgzM0FZcE1pUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3280f014-aa21-4d71-99b0-9cc609bc5ba7", "record_id": "flaws_cloudtrail:0000370:3280f014-aa21-4d71-99b0-9cc609bc5ba7", "row_index": 370, "timestamp": "2018-02-24T11:37:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3280f014-aa21-4d71-99b0-9cc609bc5ba7", "eventTime": "2018-02-24T11:37:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvMjBoZjhuaktCSlRBcVBpQm5OSGlxTXVTREVvajcvZkpiemQzSkh4eTcvSktFcXp0VlJKR1FEN283ZGt3amJKbVRwN1VocWVmL0xza2x2S2dnUERGdjFtUjU5TlNLdWhnOFptSzlsUjVpRmdlZGlpOUpBWVAzVnpoeDZlclRpOUZWM0xTc1JjeXl1aElxemNSRkx0TDdjNlBIVW5Bd1ByOHhDQUk5a1JIRVc0ZUVXNXVIU254OGtBcEVINkZZTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a84c0ce9-15b3-4edc-903e-69c8147a6253", "record_id": "flaws_cloudtrail:0000371:a84c0ce9-15b3-4edc-903e-69c8147a6253", "row_index": 371, "timestamp": "2018-02-24T11:37:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a84c0ce9-15b3-4edc-903e-69c8147a6253", "eventTime": "2018-02-24T11:37:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0eTlzbFFnS29JNkxQRmtvTjhrOHZCY2dnV2lCdlNFSmR3T3p0Smlyb294NXZ4T2I0R0lBQzNUdzNyaHdBTnNHZnpXaFAvRzNic01KT2JmcGlPMlppTEt4N0RPYXV4MFVtZGxsRXJtUzRCaEJvYjZocExlM0l3T1ZpL0J0SDdHOTVhYVFnNEF0bUNMU2Y5bUx4MEoxWjNPQVRYVFV0UVRIZmliM2c2OVBGTkFZYU5hc0NZSHFHMkxFZHQyblJRTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c264f8e6-c33d-4a81-a7e7-0987f178aa95", "record_id": "flaws_cloudtrail:0000372:c264f8e6-c33d-4a81-a7e7-0987f178aa95", "row_index": 372, "timestamp": "2018-02-24T11:37:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c264f8e6-c33d-4a81-a7e7-0987f178aa95", "eventTime": "2018-02-24T11:37:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmR01veHlucGxSYm85VGN4ZmxCZG5kK2M2eWhNcHZuanMyeDluaTJpM1dLaGNUcE50cHVYNC9hVjVmdUtuZnFnUnMvcHQ2ZW1RcjJPcDRYVlBuWTg3UVJoOTNWVnFkUkdWaFR3Y2FiaWptZlhYdWxoSHIwamUxWnpRaHBEeW5JZGZxN1FHcDNUc0hhbzlwWjVrWXlvYmdRSlgyUFhxZEQ3UXBDMHlyeHhUTnB5M29tQmpEVFVCSXY2Z2FObTUyWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0a0ac56-713f-44c3-9cae-796cdf8a0996", "record_id": "flaws_cloudtrail:0000373:b0a0ac56-713f-44c3-9cae-796cdf8a0996", "row_index": 373, "timestamp": "2018-02-24T11:37:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0a0ac56-713f-44c3-9cae-796cdf8a0996", "eventTime": "2018-02-24T11:37:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0bzRvMElOVytrbUV5Rkh1VUg0OElIdlhMcC9UZFRKOWRlVWpzTWF2OXZ5b09pSnVGeTZnZHFkRTdQdSsyQTBYUWJvUGEvakkwOWNFZjZwdDMwUGdveDBpVkxISVQ3dTBuZlZWOThleUdBMFN3Qm9ackZtdWxUSitQaUNrSUNKMy9rSVJScEI2QVNSbS95VG1yMXRTNVBIdHEvZlZreEFZZWlkdDJPcUJ2YWU4UmZhNFZsLytBMVY4dmZaZyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd7735e3-85d2-43ee-aa97-8cf01c87acb5", "record_id": "flaws_cloudtrail:0000374:bd7735e3-85d2-43ee-aa97-8cf01c87acb5", "row_index": 374, "timestamp": "2018-02-24T11:37:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd7735e3-85d2-43ee-aa97-8cf01c87acb5", "eventTime": "2018-02-24T11:37:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvREdiVEtCOWkrOWRTZExSamRoNDFVVklHWDcra2dSbkpoditaVFhIenVXYXVFRUVZeDVJdldoQ0REV3RlT3NBVWUvTWJuYnBqWS9XR1M2anpycldxSGJPUFBoVUFvMWowY2RZMXRMak9qWk1zdGR1K0NDakhFSTM5RTE2NkhybHh1TmwrZ0cwWnF6R3QwYWdnTEdVZU15OTZOMVVsbXBVb2pNbXBuNXRWNlJJLzV1dHJodFgvTUh6ZDB6b2tuUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee4e20a3-d8a2-4ca8-86ed-7c9a30a8d778", "record_id": "flaws_cloudtrail:0000375:ee4e20a3-d8a2-4ca8-86ed-7c9a30a8d778", "row_index": 375, "timestamp": "2018-02-24T11:37:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee4e20a3-d8a2-4ca8-86ed-7c9a30a8d778", "eventTime": "2018-02-24T11:37:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4NG1Tb1d6cjRhR1J4bGpsOWI3Z1NZeEZyaTdoc3psU3d2dDRGOG90bXRvcWVHejFsaGloNjFtVnViVVhpN1U0TVpZTGIxZXlOcjFScDZybXErSzFPcmlhRWtXRk5TYzhHK21VNUJBbWZDai9MS2RhUnNjZ1hxS2lWRHJUQWtSTUNLNUtTRE0wSmliTUZHREp1RFZYU3N3cnExcDloUHFjVDBqckZxYlNNVWNzbkEzWkp4UmhYS3YyVXc9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e180a540-e21b-4428-bc9a-394c16a61751", "record_id": "flaws_cloudtrail:0000376:e180a540-e21b-4428-bc9a-394c16a61751", "row_index": 376, "timestamp": "2018-02-24T11:37:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e180a540-e21b-4428-bc9a-394c16a61751", "eventTime": "2018-02-24T11:37:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVUmFjMnZOUjVFdTlrT285bFhPcDlSL2I0MjFyaVFzc3krVXlTVVV2UXR1N1JCN0RUVTJGQ3R3RVg3MnRFMWY5SlcrNnYwalltdjNKNnQ5OVVIWFJIaWZSeG0rdGZzeXBDdy9SSXZGVWkzc2ZOWnp3R3NaelNHNGZaNFlXa2tBV1M5VmlXK2x5VExEV2tPcjdXREcvVDdFdkRON0E2bUFnZUl1WDR0QVYwbkdIK3F5VjEzWDVPbjc4MlE9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4fdf12b-4071-4f91-8bff-177788b18cdd", "record_id": "flaws_cloudtrail:0000377:f4fdf12b-4071-4f91-8bff-177788b18cdd", "row_index": 377, "timestamp": "2018-02-24T11:37:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4fdf12b-4071-4f91-8bff-177788b18cdd", "eventTime": "2018-02-24T11:37:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwdWgyY3RRdHNHckVacjRtS0FVUFNKdkFlN1UyY3V5aDhZM0VrZUVGeWc0RkRsa1FueG5wL1E1YWZrWjVQVmpFbmkybU5wblRHZ0lzRlZEcmhkL2pJUVh2QWpBN2drUERHaytRQWdiaUY1WEFEN2RSZ3psUWVrcVBOVjZncGNoZ1E0Z2RMbks3RmFyMzRXQTJPd2tvcVpJTDdLck5RZ2tTREkvSWVYYWdCQ3FYT25obUxBZjd4VnVkRTJXbnlkRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c3fb34b-5f3a-4ad7-83dd-d6aacc0b67f9", "record_id": "flaws_cloudtrail:0000378:0c3fb34b-5f3a-4ad7-83dd-d6aacc0b67f9", "row_index": 378, "timestamp": "2018-02-24T11:37:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c3fb34b-5f3a-4ad7-83dd-d6aacc0b67f9", "eventTime": "2018-02-24T11:37:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkYmRra1ZKTUk3RU8zS2pBaVRrZk5LWDJrRFBHZ1hZSXdWTzY0dGFINHo1UDFvd25lbVEreHV0NXJuNnJWL3VrbzA4R2wrR0J3MWVka3M0NjJJQmJyclVkOVJwU3pVdXYyYng4bC9pTlFvcDR6clM1Y3FpN0t6YkRCMzIrb05TbGhsWmg2emFnS3hRS1ovSzhKOTNpb2tLMkRNMG0rOTM5ZXRUYjdPcEhuU0FjNkI4SVZtdHpweE9NSGh4TyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaf03cfa-07a0-456f-8bdf-1740b99ec6c1", "record_id": "flaws_cloudtrail:0000379:eaf03cfa-07a0-456f-8bdf-1740b99ec6c1", "row_index": 379, "timestamp": "2018-02-24T11:37:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaf03cfa-07a0-456f-8bdf-1740b99ec6c1", "eventTime": "2018-02-24T11:37:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSWGRCdERGL3JBUEdNNmQ3dDN0cE5ObUNYL3VSc3BYZTRxRVNSa2tzcXpGRTUyNmlPNXo1Rkp5Znl4TVl5ZGNMaStvUjNOaHBUNElWK3FyM0E4cjZIU29WejkzdDFIYkkzVkUvVzl3SzUzbDdISHFvdFV2WGkvMkZwTitSOTdkWTZqUHZKMGcvdHdKTnIvdUJrY1RmUlZPWE1Xb1h6NDQwYnRhVTllYlB4a1F4aEJ3aEZYckJnVFBPcUlCZiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dabb647f-cf92-4e90-b4be-b45775cd9f7a", "record_id": "flaws_cloudtrail:0000380:dabb647f-cf92-4e90-b4be-b45775cd9f7a", "row_index": 380, "timestamp": "2018-02-24T11:37:40Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dabb647f-cf92-4e90-b4be-b45775cd9f7a", "eventTime": "2018-02-24T11:37:40Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "313627-6c90-4574-bf89-97fcbffb9ab6", "record_id": "flaws_cloudtrail:0000381:313627-6c90-4574-bf89-97fcbffb9ab6", "row_index": 381, "timestamp": "2018-02-24T11:37:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "313627-6c90-4574-bf89-97fcbffb9ab6", "eventTime": "2018-02-24T11:37:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrL0FCOHZBbGJIOEgxQTJITjUzbnU3MlZDb2pEZE5KZ0wrbkRvVmpmQ0Q4RWIwbGwzYWZzRnIrQnd1NVFDOFFhbzNqUGFRc1JEZnBhb05YWWNqNnhIaTdxOUZ4OEhVRUExSGkrYnI1SHBWWDhENksvcFhPelJvZ2RvR0FRT00wM0RkYTRuYmJpSUIwT3pCcUxieG9CeW9OcGdlSHVxVExPMVhTRUo2VytMb25KTzBEQU55TlVPY0dOWnNFPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d26ec83-f69b-4110-9fd8-399a9048b7e9", "record_id": "flaws_cloudtrail:0000382:0d26ec83-f69b-4110-9fd8-399a9048b7e9", "row_index": 382, "timestamp": "2018-02-24T11:37:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d26ec83-f69b-4110-9fd8-399a9048b7e9", "eventTime": "2018-02-24T11:37:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/17.4.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJra1FBdWExM2ZrNzFhRUZqTk5MZnorQzQ0KzV0eitpakExTHVSUVdTcTNFMjM5TWEwUDgxRnl1bVluVUZIUUthWWZ3NFJKODJEOEZmY1BKTkgvZkFWVlFTMmI5REkyNUFJb2VOT0F1SDBOTWREU200OHY0eUhSUTZabGZ2MG41RW8raGY2UjVHdGdtRjkvRXNOTXk0eVYyT0xhbnh1eFpxaXNzSXlZVURCTXRpVGlzPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef4ad381-28dd-4cb2-85d2-46fde0a09adf", "record_id": "flaws_cloudtrail:0000383:ef4ad381-28dd-4cb2-85d2-46fde0a09adf", "row_index": 383, "timestamp": "2018-02-24T11:38:47Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef4ad381-28dd-4cb2-85d2-46fde0a09adf", "eventTime": "2018-02-24T11:38:47Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac80626-a463-4f5b-b0c3-246ad98e3731", "record_id": "flaws_cloudtrail:0000384:ac80626-a463-4f5b-b0c3-246ad98e3731", "row_index": 384, "timestamp": "2018-02-24T11:39:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac80626-a463-4f5b-b0c3-246ad98e3731", "eventTime": "2018-02-24T11:39:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "383ae644-0db7-4e0d-adf2-ce15805fb3ac", "record_id": "flaws_cloudtrail:0000385:383ae644-0db7-4e0d-adf2-ce15805fb3ac", "row_index": 385, "timestamp": "2018-02-24T11:43:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "383ae644-0db7-4e0d-adf2-ce15805fb3ac", "eventTime": "2018-02-24T11:43:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b55e0a6c-c3da-4e8d-af4a-6db55bf37b10", "record_id": "flaws_cloudtrail:0000386:b55e0a6c-c3da-4e8d-af4a-6db55bf37b10", "row_index": 386, "timestamp": "2018-02-24T11:43:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b55e0a6c-c3da-4e8d-af4a-6db55bf37b10", "eventTime": "2018-02-24T11:43:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlYWV4VURoWm1lSFRWNk5UOWMwdGlJSlk5M2V1Z1c3ZjlXVHRmaVJHZFdkczFheFVWcWtIZGZsWVo5emdqK0Mrd0E0ejFIMEF2ejV3STFTVFIrVGg4VFNaenU0czJHWEJlQWJ5RVEraURQc2p3Rnh0czVneGVhWXFMMFc2YTZMZ2dBR3FldUtPc1FUNytmaEdjbXhtUGRSaGpsTXhDRS9MaEZhNTdSdDhJblRsOGxObmJTcVEvb00vc29LeWV3MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "335faf38-d866-49ba-8a34-cbc4c0a3fab5", "record_id": "flaws_cloudtrail:0000387:335faf38-d866-49ba-8a34-cbc4c0a3fab5", "row_index": 387, "timestamp": "2018-02-24T11:43:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "335faf38-d866-49ba-8a34-cbc4c0a3fab5", "eventTime": "2018-02-24T11:43:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJERFBMcXh6T21VZ0pDSTdYTXRUS2ZVV1VqMDVFMVhvK21qMkNUaXFpdjZDcURiUkhLY3lzL2FVaTZyaElDSGQzamNUUEhjZ0Y2RE10azJicm5kNzd0RmdzTjRmSDR0bnNEdW9JR2NxSXRlRW91TTdKRGZTbm9yMGlWRGFPZ3BOY3pCSVljQTB1bnVLOGJadDI0OTFKSksvbGhOWDhabjdKdWU4Mzd1cGk5ZU1vOWtIV3F1anFKS1p5STREbCt0dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f3c118c-0bba-4f81-b831-f242712fca", "record_id": "flaws_cloudtrail:0000388:7f3c118c-0bba-4f81-b831-f242712fca", "row_index": 388, "timestamp": "2018-02-24T11:43:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f3c118c-0bba-4f81-b831-f242712fca", "eventTime": "2018-02-24T11:43:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTYXR2Nit2UTFQdEVBdzRVZWUySkZMbERrM2w1dDFEbmZ3VXNieVYzMmpXRzhIdk9tcVVCOVN4KzV0cVdJVFZaT3RCcThvNUE3WkxPQnRMTFVNb24vNW5sdGRIRitTL0g2QWNKQUhtMllNdGN0UC9yM2V4enRLTHRrZ0dDTlVBcmNudC8zbW8rSGIyWDl6cnkxV0xVNnYzOG8rMldHanVHZUJSblhDNE03Q2s1K0diU0REdEhzeXZKeWZVc0VjND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19a328122-1c75-4d8f-9d1e-c876c5b6452f", "record_id": "flaws_cloudtrail:0000389:19a328122-1c75-4d8f-9d1e-c876c5b6452f", "row_index": 389, "timestamp": "2018-02-24T11:44:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19a328122-1c75-4d8f-9d1e-c876c5b6452f", "eventTime": "2018-02-24T11:44:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJicXJXMnovNjkxQlNrTG5sK3ZwdW8yTGlyaTcxSmlkank5RDhCY3BFTmE5cXRpQnlGM1lGK1FEOHdIaXJhUk5ySzhhZFhjZjZPdTNEQkwvUlBpNktrK1VOd2pyTlBNaS9qVUNsMmRyWEh6SUxVcG05YmJEWXBRSjkxSmk5ZzBSTlhCMWkvLzNGdTBIeHFzcW4yeHNCT1lVY1NtSTQ4L0tyelRZTkQ0WlUzVXdac2IwYVV0N3dtdTlid25xazBUMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92ae02f9-ce9f-4ec8-8d47-80955df4028", "record_id": "flaws_cloudtrail:0000390:92ae02f9-ce9f-4ec8-8d47-80955df4028", "row_index": 390, "timestamp": "2018-02-24T11:44:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92ae02f9-ce9f-4ec8-8d47-80955df4028", "eventTime": "2018-02-24T11:44:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvSGlmdHVnWEVqdE1BREszRlpwbGhQSGtwMkJWNlQ4WCtHczdvWVNUY08rdjZCSkRxWDZJT0NvVHpxMCtIdTF4ZlFPcVpEV0hlN3JmYVB5bk5wRTczYmIzUUZNdHBYRHRFakRHa2hBL3gvV2Ezam9PMGJLTnJ2RjJzd3BWcVB0VDZHTVprTU9zR2ZhQUJGYmxobXoyck0zUWxvVGZzanFuYTFRT3BPNWdjV3IrbGtSM2dMdnkxTXJOdzYwUyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "043a85ec-62b3-4e9a-af76-6cd1d861da1d", "record_id": "flaws_cloudtrail:0000391:043a85ec-62b3-4e9a-af76-6cd1d861da1d", "row_index": 391, "timestamp": "2018-02-24T11:44:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "043a85ec-62b3-4e9a-af76-6cd1d861da1d", "eventTime": "2018-02-24T11:44:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxR3Y4YWdtelVZSW5jWXFmTkUzRGVYSmtZT3NVUUhjUUhFS094VnFYOGNOYTRRTGdMVHhNbFlCK2hKMkpsK0tqR0FqM0l1aklEcUo5RnAxbkpUL2RWWFJwcFY5VG9mZU41Y2ZOY29CR1NFRzBFQXlMdmM5VFREWGdZb3dCZmo2OWIyaTF0blVQZ0pxYmFybzQ5RkUwL1BjTTJKRFM4MTBzRmFCQ0RDVVhlbGtaRXVRZmFqZGxDNm8zSXRHUmJkbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5690fde-a08e-4af1-83f5-9b0c6332f7d1", "record_id": "flaws_cloudtrail:0000392:a5690fde-a08e-4af1-83f5-9b0c6332f7d1", "row_index": 392, "timestamp": "2018-02-24T11:44:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5690fde-a08e-4af1-83f5-9b0c6332f7d1", "eventTime": "2018-02-24T11:44:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWR1gzM0hmNjdFZ3RrZThOT2VEUDUwRnZ6WDhQbzRIRGFrNjBvSFVpUHBPZXBEMktzSHZXUURMeU9wTHlRSjN4aWRvT0ZKM1BhUnptdFEraW9tUGZmRDFqQXkrODZSamgwOWx0cFdDMlVDQTRqWnlnaFN4U1ZmVWlwS1liWmlxa2ZPNmV0NlhOTktYUEFJQ0dJb0psYkkzTGxUa3N6b3piNTlVSk9rbHBQaW51Y0dFaEZ3cWZJQlNwSmJuWSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6f5d2b9-3040-4264-8974-96f62a0e5fc2", "record_id": "flaws_cloudtrail:0000393:e6f5d2b9-3040-4264-8974-96f62a0e5fc2", "row_index": 393, "timestamp": "2018-02-24T11:44:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6f5d2b9-3040-4264-8974-96f62a0e5fc2", "eventTime": "2018-02-24T11:44:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPL0tRSEpXVE9iWmRvYzgzU3U0T1dJbFlLWk5ueURuMTJ0R29RekEyRU5pOGxtcTdCZzArZUx5YlduMFlNT0M4ajVIQncrbU5SYXJCbSs1WlhYd2tWcFdaR01WUCtRT3V1aFN6bFl1SHRad3ErQ0hjZ3J2bjNEbGNhVWJlR1pBQVVhbWliTlhYdGlVSWRrV0ZRQTUvaDJmckFPZzNtd0dsT2JGNHlQWkxaRW1Dc2djT2VralNVTE1JSEttSjArND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "959f674b-13de-47ae-ab1b-72afa5b3396d", "record_id": "flaws_cloudtrail:0000394:959f674b-13de-47ae-ab1b-72afa5b3396d", "row_index": 394, "timestamp": "2018-02-24T11:44:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "959f674b-13de-47ae-ab1b-72afa5b3396d", "eventTime": "2018-02-24T11:44:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsYnY0OGdKZHpHamt0a2xGYlRQclBOMGRWQmYrVDdaV1JiS0tuQzRXTHhGcWhoayt4enl6UnBIZyt0dmhTTmZWRHJ4Zm5MRTVsdmZlb3VCSnRXVEZiN3Z5bmsxY1I1bTQyTWxZb2xVWll0NzBQY0RWYS9zaEZ2bmpqM1lkcTdUTlc4ZXJ2dDhIMzlsMUo2ZmVKZm4vakpiSmQvb090TGZQM3Z1MmJ0ckVSSVJUT2RxWDRzRkhPaXRaLyswMHdFRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91704c70-803e-47f0-829a-8f956564dac9", "record_id": "flaws_cloudtrail:0000395:91704c70-803e-47f0-829a-8f956564dac9", "row_index": 395, "timestamp": "2018-02-24T11:44:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91704c70-803e-47f0-829a-8f956564dac9", "eventTime": "2018-02-24T11:44:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2b2FLejhLYURiSk1LWkdkbGt3czVaL1l3aUdWRzJNdWt3M2dxdmJGMS90MUZ1eXhib1R4WVMwVDN0Yk45RkI3MDRiY2FGMVViZGxMbXJ0WWNEUDlaSjVZM2lZMGQ4c2M2TzlkQzViUk5Ub3BSbHJPT1MyQVBkenJXdFUzRm90aWQ5YmhOdkRkcG0yODNaSEo0MUNZRDQzOWRmOUJIeEUxdnE4MTBSbStiMTdPZWI4SzBlY1h1Y0h5WjBISlJkWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65d61172-ef28-4077-8d1a-06ee4db612d9", "record_id": "flaws_cloudtrail:0000396:65d61172-ef28-4077-8d1a-06ee4db612d9", "row_index": 396, "timestamp": "2018-02-24T11:44:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65d61172-ef28-4077-8d1a-06ee4db612d9", "eventTime": "2018-02-24T11:44:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYTG03eEF6cHl3NDZ1NXpqQ01YZDJ1TWxGNmRDVlN3dkRWaFl4VUZFL3UwZnk5SkpxYU1lRFNYY0s2UE1SV0h2enpyNmdRRVhtc05aNTB1eGZyOGVQN3AyaVpPRlVXVXl5dXZNRTUrY3UzZzhZb0k5VEF5aTNkTm40TzR5UDJETjN3UzJQQ0dXeWlacGlla3lFSlNrUjhRbXIxM1phb1VLTzBHWE0rSUFRc1VVdjVnV0k1ZG0yNUcybW1ubiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2f439a4-d92d-4d20-a1fc-fa404284b0df", "record_id": "flaws_cloudtrail:0000397:e2f439a4-d92d-4d20-a1fc-fa404284b0df", "row_index": 397, "timestamp": "2018-02-24T11:44:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2f439a4-d92d-4d20-a1fc-fa404284b0df", "eventTime": "2018-02-24T11:44:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxTUcrengrMkFiK3MrR0RjR2lLbzR2UE4xSHAyeE0reElXZ0xjYVg5ZVkxR0E5Yjh0MmlmRHdQOFhYWlpNNStzVjJHTGFnUzNpSGVyUUFZMW1KTjlrSnh6M2dpenVoU21IaG8vWDJ3MEN4Um5nLzVCSTlqWGc5TUIwL25wdG1ZSUJjdVlPR2dpbDNuSTdMK0I0U3BmeU1TWlJUN2pNd0tNd05pcENvTUhLaEtXY3lVK3pXeXJJOGpRZkgwPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2f4dd4d-a9b8-4256-b6fa-acc104738c9a", "record_id": "flaws_cloudtrail:0000398:e2f4dd4d-a9b8-4256-b6fa-acc104738c9a", "row_index": 398, "timestamp": "2018-02-24T11:44:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1044, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2f4dd4d-a9b8-4256-b6fa-acc104738c9a", "eventTime": "2018-02-24T11:44:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0Z3NlUTdLSXlGcWRVWklvV05Fd0JtWVZrU1d1WkFmVnJ4Z2F0Z1FpSCtxTkVKWTI4NHRKUG4vVXlxckdwZW9ZQllKRlJnMTR1TlpTaWRIcEFjQXh2TUs1dW4wbWdWVWJUQkZiNjZQdkdBN2ZyUmNDTGFNMlhTeStPSlNKbTVkY0E2M1JyaFhwa09XR2p4OHozVWJWOG40dTB0UGdzUTRQQlpXT1dwM0MwRHlwRk1vPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a3c9e54-be03-449d-b6de-c15816dc8887", "record_id": "flaws_cloudtrail:0000399:4a3c9e54-be03-449d-b6de-c15816dc8887", "row_index": 399, "timestamp": "2018-02-24T11:45:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1937, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a3c9e54-be03-449d-b6de-c15816dc8887", "eventTime": "2018-02-24T11:45:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0VDTOHEZ6U3XWJ99", "expiration": "Feb 24, 2018 12:45:04 PM", "sessionToken": "AgoGb3JpZ2luEI///////////wEaCXVzLXdlc3QtMiKAAjgqIqBP9udH76bpMRCdiLWLz84GsGk2lRB9+1U8SlV/mHG/OKCFUFGang/Hr2KoI/tcP+4UMQ42k+UOLBE8qPCkgWsXR8LqKmPRaI8L7uGEIXIJPJTIzjURgii/whsEhzyE4lo+NZT1dBTYFhfq/DoB5NBXf6CKfU4YHlJtSYzV8YmdEBYDXupoWCG6OK6nhSFm44RBrNQanFys1RrV8X6tlEHSEGSsjYjpDEbDoSx1ITSxAwm2d46fRcYulIvQJWXkwzCnXHDHsCAeFj0zN2TJZPy5oFgKfoFlgPwbit28Vf1+CWFOmVhkVhfqYdVDObE1n+5GSfeF39fDMRC1ze4q6AIIdRAAGgw5NzU0MjYyNjIwMjkiDKnjBnFKII3+RUiUfirFAmKeYieZIk3XiV2nyrvYS3MsjJVlecumMD6oMVM/OlJxPqYXwEzZHKCmQgsirPyJDMbDtesTLJ+8bAO41wP4I5EbSCjmtJpdqbKIrgoNIgYBkLyX+xd8TqvQZjTrUU1LiaZAxG313lFoSg8aL2jIQO6TXUF/w8Ll9xqmvmoKP8tcraiiyRkZEIpP6EA64eK+Xbp0Gln225nxNisu8/T/Fwy/L1HITIIi8IGPrAOMrlSHBNF6fJ+Th0gdkVmuSzQ9WCxwqenyiETcnJYY4SFl9YPAWFULxk8h44KalU4GDA529D5cwVcSLWAL5MrkTGVdCeO5W/IBOMVq0rYviPH1kaG+fwQbrsyYr0Xds+mjfAFBQAWp40YgYkYdWlv27g1y/VKV92yqrre5P8r5X9y67O3pTDACyX4pE7VoHXNZnBR18ouXTuIwwKDF1AU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0bfa78d4-8c50-48bb-9166-ad13853b2ff", "record_id": "flaws_cloudtrail:0000400:0bfa78d4-8c50-48bb-9166-ad13853b2ff", "row_index": 400, "timestamp": "2018-02-24T11:46:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0bfa78d4-8c50-48bb-9166-ad13853b2ff", "eventTime": "2018-02-24T11:46:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc2f0916-60ea-4bfd-b5d3-19bf7d3f77df", "record_id": "flaws_cloudtrail:0000401:cc2f0916-60ea-4bfd-b5d3-19bf7d3f77df", "row_index": 401, "timestamp": "2018-02-24T11:46:40Z", "event_type": "ModifySnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 924, "raw_record_depth": 6, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc2f0916-60ea-4bfd-b5d3-19bf7d3f77df", "eventTime": "2018-02-24T11:46:40Z", "eventName": "ModifySnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "createVolumePermission": {"add": {"items": [{"userId": "221698185189"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a6e4f74-59c2-4cc5-a7fb-7b482589c315", "record_id": "flaws_cloudtrail:0000402:3a6e4f74-59c2-4cc5-a7fb-7b482589c315", "row_index": 402, "timestamp": "2018-02-24T11:46:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a6e4f74-59c2-4cc5-a7fb-7b482589c315", "eventTime": "2018-02-24T11:46:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0TGJVTjRRWU51K3JjV2pwbmRsV0VQNi9USWZFNXM0dXlMUHhsdlVYMzl1RWE4cjB4Y0FUUUdJcG1RQXlsZ21iT24vZ01ZUG9hN3A0L2ZRNUR2YU9MbnlzQmljdXFoM2U5eDU2SXpwdTVXTzlzQ093bTFLWXM5Tjd6Y3Z6MW1vSGg3d3RPakVodzJ4ZFRoYVROVWQxNTJyQ25WTzZyc0JDM05idk1ZSklIK1hRNGZsUnBidm1kaUZGMnFOajZBbz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc237707-f3b3-41a1-ab0a-12bee63efc7d", "record_id": "flaws_cloudtrail:0000403:cc237707-f3b3-41a1-ab0a-12bee63efc7d", "row_index": 403, "timestamp": "2018-02-24T11:46:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc237707-f3b3-41a1-ab0a-12bee63efc7d", "eventTime": "2018-02-24T11:46:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOZXEvZzd3VnpETzNvd2tnaG51R3dzSWdmNlhRLy9ic2ZZTTZzQkxvdkhTUDZ0RHdTaGl3UTZ4SDBFYkNrWFpSQ00zamc5T3FvK2hUZ005K2h2RTVkR0MzRXdYQm5WS2ZkVmoreGM4bm55QU5GcEFYdUtEd1piL1VEY1pkb01ydWgvV3NselFMaVgvcXBid3Q2bWZsWGlad1FEdkdVSDhoRjBOTk8yZWIyaHVQNVVOczUxTkZrUDVZcmI3N210VT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94b1c8ff-e2fb-45f3-bef8-45382dc88", "record_id": "flaws_cloudtrail:0000404:94b1c8ff-e2fb-45f3-bef8-45382dc88", "row_index": 404, "timestamp": "2018-02-24T11:46:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94b1c8ff-e2fb-45f3-bef8-45382dc88", "eventTime": "2018-02-24T11:46:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwTTBxY0tYcDdKaWR5SkZlZnZhT2p1VzlPbmc0MzROZllXVUhTMlpsSDVRUzRrcEMybEdjRXhIczNyaHhxR056a1dPZGdwY2ZlTHlwb3NoUUxHNkltM2M0L3M4Wmo0SG1hTFlKZmIreWN6M2k0eDBUZEtVVER4dEx3cHR5Q3ZpcXpTV0pLbnFhYytJeVdkeW85TzFqVFNHUmVRa1grTHpIWTdCNXg0RVVtaG5yL1NoYTJXcVJFQ3B5eGNBNSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03c558896-b4d4-4690-8b0e-cdfcd6a26288", "record_id": "flaws_cloudtrail:0000405:03c558896-b4d4-4690-8b0e-cdfcd6a26288", "row_index": 405, "timestamp": "2018-02-24T11:46:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03c558896-b4d4-4690-8b0e-cdfcd6a26288", "eventTime": "2018-02-24T11:46:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyOVJKMEs5OTdZcFFMTDlhYlNJL2M5S3pFam5oWnpnbXJzSDNKNXRYT3paSzBkcldHZ0VmSDluUG1RUm9aVERXeDZFSUtIVkZXNkRBTG52TlJYbFB6Tmh1d2RVN09YRHQwU3RPeUZYSUxwRi90NHN3T2kwV1ZWTlB3SWhkSW5ITFlnM1FkNGRQY1FDc2NGeXdjTTZjOWl2cDZtLzh0ZmwyRHRRZmE2K1c0NTBhbSs2djc2ZWk5SFRPK29URGdiWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "082511d-f28b-4306-930d-125aa4d5056c", "record_id": "flaws_cloudtrail:0000406:082511d-f28b-4306-930d-125aa4d5056c", "row_index": 406, "timestamp": "2018-02-24T11:46:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "082511d-f28b-4306-930d-125aa4d5056c", "eventTime": "2018-02-24T11:46:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqeS9JRzB4Mk81NWpHbXV3SEszQjRqYzRPd0J0WDc3bEQ3OHdWR2dPVjR5dmNRTUxaYXNKdFFuaElxdG1Ua0xINXh6dkk0UXJxYWR2dDJzaUN0V3BnakptcWVGSXJsNlJobUYxZUJLN1lzVVE4L2VVNm9CZ29RVHo4aG8yeDNWVmhUTC85eUVLWG5HTWNDV1hjUUhZZVFVc3loZzg1Wit1ZVRrd0ZGRkFHVVNYY0pvZm12VDhLb00yd3lydmpWTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "281a7978-40fa-4d26-8dee-a6498403158e", "record_id": "flaws_cloudtrail:0000407:281a7978-40fa-4d26-8dee-a6498403158e", "row_index": 407, "timestamp": "2018-02-24T11:46:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "281a7978-40fa-4d26-8dee-a6498403158e", "eventTime": "2018-02-24T11:46:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiSUowY2s3L1N4R053UjIrM1pYYXJGMFB5bkdKQUZHd01haURzRm5PQ1Q0ZmRwVkJyZUlJdnBURXZlZUdOZTkzVGkrL0R2S0pFVGdUY2NqTW1iRlpwUEJLY2JENnlqYlFtSlZuNkJ5Z2s2bzlEVkVGNm54NFhlZGJSUlFlanJFaDNsTWdnK092Z0RkOFhJbm9FRWpyNnVVQTFSTm94NUJyNWZiOW5iNEJGTEI1aDFLNzVPWTltaksrWnROcCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd963e15-c19e-4eb6-a515-3c54a17f0035", "record_id": "flaws_cloudtrail:0000408:bd963e15-c19e-4eb6-a515-3c54a17f0035", "row_index": 408, "timestamp": "2018-02-24T11:47:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd963e15-c19e-4eb6-a515-3c54a17f0035", "eventTime": "2018-02-24T11:47:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5bExtV0twbjUyYmpBREhVYXNpdmlFbWpyMFdaVmJ4ejlscTFRR0tHRmh2MXQ3TmQ5bk9MVnVnbHNkWDEwUGVrRGl4a0NrNERiQWhNQkROdHNpbjV1cDBPL0c4dHRJZ3RKcm04WmNRUXNFZFhBWm00cGdKanZ2WnMzMDErVVdBN2QrN2gvSm5qaHRFUEVIMzdGa081MFR1ZERMMGcrbjhZOWNOSzlEYkdvUGFXYS9Ca1pBNTFDeG5NSSswVSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6293c1e4-d387-40f3-8fe4-df13ad23de2b", "record_id": "flaws_cloudtrail:0000409:6293c1e4-d387-40f3-8fe4-df13ad23de2b", "row_index": 409, "timestamp": "2018-02-24T11:47:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6293c1e4-d387-40f3-8fe4-df13ad23de2b", "eventTime": "2018-02-24T11:47:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJubXpVV0IxeTBVWDIzMnhtbTJBVWhTU212T1F0NzQ2ZkZnTFkwL1FIZ09YYmlWUmN4b1MrZ25mb0pmSXVKdHRNVC9tRXVVZG41M3I3SGdLd3hxZi9lTDlkMGVJSHd4WUFvcFZzVTRxbytyb1Y1eVVtaG5kWmQxUnRxTDY4SC9kaGwzejUyMnFqalpCNjBNY2xzdXMxeDgzVThacFNMWTJMYlMvT21RR3BtazZSL0tJdUpHZXhJY2tSVktsaG11cz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7145f78-f491-44e3-837c-953d3371f690", "record_id": "flaws_cloudtrail:0000410:e7145f78-f491-44e3-837c-953d3371f690", "row_index": 410, "timestamp": "2018-02-24T11:47:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1063, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7145f78-f491-44e3-837c-953d3371f690", "eventTime": "2018-02-24T11:47:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzUjErVmFKVXNQeURLcW9rdUFVRUhQMGkyWGNBYzVvV3lVT2xFckI4QlBVWWphVjArMUtuTk0yTU80U3RwUU43R0lvSVRqUnY3UGx2YlUxSThlR3VhZThlNmdPNGxHT24rK2UyZTUzem0wQ1ZRcTM2STZseXhFakIxemhrZzhKUWFuekcxZm1OY2U4enB6NnQrMjlUbGhyallzOHl3WVhYZ3hhdi8zcDNOT3dObjd6VEpYTXRHWXp0MGZvSjc0bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a52d118-2a2e-4ac5-97e8-cc38443a82", "record_id": "flaws_cloudtrail:0000411:8a52d118-2a2e-4ac5-97e8-cc38443a82", "row_index": 411, "timestamp": "2018-02-24T11:47:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a52d118-2a2e-4ac5-97e8-cc38443a82", "eventTime": "2018-02-24T11:47:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjbXluT05GaGhURE81RW9reTFjb2Jod1I5bm5LT2Z6MnliK3BnUTdLaHJ4RmtFV3AxaDh4WlRJZGNqcGl5bnhwUnVaZndFb09QUDhHcUtEM3o1RWE4TDBYM2kwMms0aG9HbkNOWUZZQk9ZZTc0bHV3SFVJQ2RtT0o3NitIQWZaNGwyaGE1RXNxMzlDR0ZyUjBONTF2U3JjcmgvOEptUDBhVmFERkdQTDB5UXN5YzlUTUlZMUdYZU5PNE4xSSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c77801-37a2-4585-95ba-79289062fd1b", "record_id": "flaws_cloudtrail:0000412:c77801-37a2-4585-95ba-79289062fd1b", "row_index": 412, "timestamp": "2018-02-24T11:47:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c77801-37a2-4585-95ba-79289062fd1b", "eventTime": "2018-02-24T11:47:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4cFhTdUFZdGo1UitCd1FNQm1ONmVnaS9SRG56ck95VXExMVZKTU1wNk1US2IwN1FicWI3YXJkNFJ4VEdHWWFhQ09hbjJ4UWxkS3hnRFV5djFXTTN2UEltMEZTNFQ5U2JYZ3ZheU1XS1RsVG4xeGh3RkREeGVOQjZReTFDMjlqamhuVnE1a0RtTXEzT0xwUHl4T1dTVWtuYnNmZHN3SGpCM0hhOGpLWnZlKy9tTEFrYlRlV2ExQTBidUVReCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1fb8dde-d14b-4f1e-8b60-89df33aad1fc", "record_id": "flaws_cloudtrail:0000413:e1fb8dde-d14b-4f1e-8b60-89df33aad1fc", "row_index": 413, "timestamp": "2018-02-24T11:47:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1fb8dde-d14b-4f1e-8b60-89df33aad1fc", "eventTime": "2018-02-24T11:47:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWTTh0WW1HT05reWVOWW9hR0NxdExaMW5laEdiYU03bDFaaGRFcXZobEFQSHBZbmZRSGVqOGh2azlQT3VaSHdIMFRSQXkxdnpKaktlaFNtN1RPZFBEWk5Zd0R4MzBsanI5bUZzSnVyRkR2Smc5TnVhRGt0Vzd6K1F6YmxqeDh6WWtXbzJBYmlSdnpuaDYxTHVxdVZmdFpjdjJRNG82V25sam1IVjB0V3FjTnMyQlFXUGJuRmFyU3JUOGJvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b29fc5d-2ea0-48a8-9aee-35022a815ead", "record_id": "flaws_cloudtrail:0000414:3b29fc5d-2ea0-48a8-9aee-35022a815ead", "row_index": 414, "timestamp": "2018-02-24T11:47:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b29fc5d-2ea0-48a8-9aee-35022a815ead", "eventTime": "2018-02-24T11:47:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMU2ZUTVZvd2x4UlI1VzV6SUhrOU9NS2pEZEpEQnRJeVVrQ3h0bmpoYWF1THBrWE1lRDFHRHZiY1ZsN2czSmF5NU0xOU5rRlhURVIyNVp5WFhXQm1hQlRFVW5zU0R5MVZHd1UyNzRyaUtVT2tsc3Z3UEgwcXIwL1J1SDM5MHFXd1pncTkzTFNIRHRYQTJodXBQM3RkbFh2K2NMeGl4d080LzR3OGJleDg5djR1a1BVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "743b7684-2e02-4728-be7b-a1c534fe7dc6", "record_id": "flaws_cloudtrail:0000415:743b7684-2e02-4728-be7b-a1c534fe7dc6", "row_index": 415, "timestamp": "2018-02-24T11:48:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "743b7684-2e02-4728-be7b-a1c534fe7dc6", "eventTime": "2018-02-24T11:48:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.8 Python/2.7.9 Windows/8 botocore/1.8.12", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4479f38-332a-4af2-8a1b-4004156099a1", "record_id": "flaws_cloudtrail:0000416:f4479f38-332a-4af2-8a1b-4004156099a1", "row_index": 416, "timestamp": "2018-02-24T11:48:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4479f38-332a-4af2-8a1b-4004156099a1", "eventTime": "2018-02-24T11:48:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30b7e72f-1ea0-44d4-b630-d823075b02738", "record_id": "flaws_cloudtrail:0000417:30b7e72f-1ea0-44d4-b630-d823075b02738", "row_index": 417, "timestamp": "2018-02-24T11:49:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 947, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30b7e72f-1ea0-44d4-b630-d823075b02738", "eventTime": "2018-02-24T11:49:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "errorCode": "Client.InvalidParameterValue", "errorMessage": "Value (snap-83d15d668fb2941db,) for parameter snapshotId is invalid. Expected: 'snap-...'.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-83d15d668fb2941db,"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ceb2829d-3be1-41e7-b5a4-204d25883", "record_id": "flaws_cloudtrail:0000418:ceb2829d-3be1-41e7-b5a4-204d25883", "row_index": 418, "timestamp": "2018-02-24T11:49:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ceb2829d-3be1-41e7-b5a4-204d25883", "eventTime": "2018-02-24T11:49:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "errorCode": "Client.InvalidSnapshot.NotFound", "errorMessage": "The snapshot 'snap-83d15d668fb2941db' does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-83d15d668fb2941db"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8043e0c2-af7a-45a9-85b8-c7a28aca3a8f", "record_id": "flaws_cloudtrail:0000419:8043e0c2-af7a-45a9-85b8-c7a28aca3a8f", "row_index": 419, "timestamp": "2018-02-24T11:49:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8043e0c2-af7a-45a9-85b8-c7a28aca3a8f", "eventTime": "2018-02-24T11:49:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "errorCode": "Client.InvalidSnapshot.NotFound", "errorMessage": "The snapshot 'snap-83d15d668fb2941db' does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-83d15d668fb2941db"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d161d3a-e7f9-4710-aa1e-ba50ef8845b8", "record_id": "flaws_cloudtrail:0000420:1d161d3a-e7f9-4710-aa1e-ba50ef8845b8", "row_index": 420, "timestamp": "2018-02-24T11:49:41Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 514, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d161d3a-e7f9-4710-aa1e-ba50ef8845b8", "eventTime": "2018-02-24T11:49:41Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62b6e0f6-2f4f-4321-9cc8-2bf5743a6b65", "record_id": "flaws_cloudtrail:0000421:62b6e0f6-2f4f-4321-9cc8-2bf5743a6b65", "row_index": 421, "timestamp": "2018-02-24T11:50:41Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 543, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62b6e0f6-2f4f-4321-9cc8-2bf5743a6b65", "eventTime": "2018-02-24T11:50:41Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63481c32-8a26-446a-b16a-c633149f56fc", "record_id": "flaws_cloudtrail:0000422:63481c32-8a26-446a-b16a-c633149f56fc", "row_index": 422, "timestamp": "2018-02-24T11:51:06Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 833, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63481c32-8a26-446a-b16a-c633149f56fc", "eventTime": "2018-02-24T11:51:06Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListAccountAliases on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2aac0b85-230e-4aa2-8dd5-7480dbf5b69c", "record_id": "flaws_cloudtrail:0000423:2aac0b85-230e-4aa2-8dd5-7480dbf5b69c", "row_index": 423, "timestamp": "2018-02-24T11:51:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2aac0b85-230e-4aa2-8dd5-7480dbf5b69c", "eventTime": "2018-02-24T11:51:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ce713be-632b-4b36-b025-4d1aa0284a46", "record_id": "flaws_cloudtrail:0000424:0ce713be-632b-4b36-b025-4d1aa0284a46", "row_index": 424, "timestamp": "2018-02-24T11:51:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ce713be-632b-4b36-b025-4d1aa0284a46", "eventTime": "2018-02-24T11:51:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15e050ab-9e14-4449-a2e1-e575fd2852ad", "record_id": "flaws_cloudtrail:0000425:15e050ab-9e14-4449-a2e1-e575fd2852ad", "row_index": 425, "timestamp": "2018-02-24T11:51:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15e050ab-9e14-4449-a2e1-e575fd2852ad", "eventTime": "2018-02-24T11:51:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3e7cfe8-6734-4314-bcff-bcc84ed767e5", "record_id": "flaws_cloudtrail:0000426:c3e7cfe8-6734-4314-bcff-bcc84ed767e5", "row_index": 426, "timestamp": "2018-02-24T11:51:42Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 543, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3e7cfe8-6734-4314-bcff-bcc84ed767e5", "eventTime": "2018-02-24T11:51:42Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39167cc6-15b0-46cc-85c3-2d1f9f44915", "record_id": "flaws_cloudtrail:0000427:39167cc6-15b0-46cc-85c3-2d1f9f44915", "row_index": 427, "timestamp": "2018-02-24T11:51:55Z", "event_type": "CreateKeyPair", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 791, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39167cc6-15b0-46cc-85c3-2d1f9f44915", "eventTime": "2018-02-24T11:51:55Z", "eventName": "CreateKeyPair", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"keyName": "MyKeyPair"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5dd0ee8-02cf-4410-a647-9aadbd1c5e8c", "record_id": "flaws_cloudtrail:0000428:e5dd0ee8-02cf-4410-a647-9aadbd1c5e8c", "row_index": 428, "timestamp": "2018-02-24T11:51:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5dd0ee8-02cf-4410-a647-9aadbd1c5e8c", "eventTime": "2018-02-24T11:51:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ec65df7-db5d-4c88-8f84-2dfbe952eaf5", "record_id": "flaws_cloudtrail:0000429:3ec65df7-db5d-4c88-8f84-2dfbe952eaf5", "row_index": 429, "timestamp": "2018-02-24T11:52:12Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ec65df7-db5d-4c88-8f84-2dfbe952eaf5", "eventTime": "2018-02-24T11:52:12Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdb052a5-a65e-4f91-b6c2-ada2b2338f62", "record_id": "flaws_cloudtrail:0000430:fdb052a5-a65e-4f91-b6c2-ada2b2338f62", "row_index": 430, "timestamp": "2018-02-24T11:52:30Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdb052a5-a65e-4f91-b6c2-ada2b2338f62", "eventTime": "2018-02-24T11:52:30Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83ad4839-891b-4b5c-81f5-16260ec5579", "record_id": "flaws_cloudtrail:0000431:83ad4839-891b-4b5c-81f5-16260ec5579", "row_index": 431, "timestamp": "2018-02-24T11:52:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83ad4839-891b-4b5c-81f5-16260ec5579", "eventTime": "2018-02-24T11:52:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fe6d421-a73b-4719-834e-7fbbef5816de", "record_id": "flaws_cloudtrail:0000432:7fe6d421-a73b-4719-834e-7fbbef5816de", "row_index": 432, "timestamp": "2018-02-24T11:52:58Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 546, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fe6d421-a73b-4719-834e-7fbbef5816de", "eventTime": "2018-02-24T11:52:58Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c507f5d-fff2-44f2-a153-11b5d3684f64", "record_id": "flaws_cloudtrail:0000433:1c507f5d-fff2-44f2-a153-11b5d3684f64", "row_index": 433, "timestamp": "2018-02-24T11:53:02Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.14 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1502, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c507f5d-fff2-44f2-a153-11b5d3684f64", "eventTime": "2018-02-24T11:53:02Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.14 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: bXly5k37Pkj02uhN1dgvRXP481S_ttEVA8p8pcs-pZ7z7o6seT-JqjmYOteK4t3rIW15NDlDbUoCQoNg2E1TLRKrCwcsOTEJU7xZmPaFJUN56mgWtacCYhUh6kg6MOASld1i8O3NhHkHAQ1WzZ2GuCGoBKZQSt1T_7ELBNjgrIGx2MKgV5Ysw0fTencTleGcF-SX1p-4ml9J8ArHuY1Nm8qzUFuQsuuhCtU3KeN1E-JC0vDhJxsODjuGxgZ8jotC3Lpd2kjyMAGUzyC4Lgx-wEsOr1pwROq6qmGDrUQ_X_9vxkWJykUnCMqg7EiyPFAYNOvaxRefD0epq2qM5yqKMuHOZv_MxtHuSKMPGKGKuQesphrTrkfc0nhrKGzbDnlLYCcUJld47QG3LmrrCiW_GdvEYsV-bPDFJ-ZigT2oiG9WUA5MY8TjGHCs6I1VFNGZMdYJJEcI3ayle6J_7YxmXx1HsbVO2FxQDV1ME8nVOVSgzJeJCzkvrWy2bLeL9KPhWNPQGJL_cMwQ0m3lIurk7nUlDfGgHzMSZTrXZR8Qs_aQZjGgwAsyWSQtH8LjNHvItwj7roReVXuYz9BBIbbQihbY5aK1LHf0XRcIrseyKPbVNCZ-pjY6MVXkrsuB", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-2f6b292187c2304c2", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de99ad32-82da-46a6-94ad-d7166a907ad2", "record_id": "flaws_cloudtrail:0000434:de99ad32-82da-46a6-94ad-d7166a907ad2", "row_index": 434, "timestamp": "2018-02-24T11:53:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de99ad32-82da-46a6-94ad-d7166a907ad2", "eventTime": "2018-02-24T11:53:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-aa2d3b42e5c6e801a"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e88a9de9-639a-457e-98a2-da3f0b3258a0", "record_id": "flaws_cloudtrail:0000435:e88a9de9-639a-457e-98a2-da3f0b3258a0", "row_index": 435, "timestamp": "2018-02-24T11:54:01Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 544, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e88a9de9-639a-457e-98a2-da3f0b3258a0", "eventTime": "2018-02-24T11:54:01Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5046a86-b16f-44d7-978d-af6f4d1390a9", "record_id": "flaws_cloudtrail:0000436:f5046a86-b16f-44d7-978d-af6f4d1390a9", "row_index": 436, "timestamp": "2018-02-24T11:54:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 514, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5046a86-b16f-44d7-978d-af6f4d1390a9", "eventTime": "2018-02-24T11:54:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f84c590-709f-4897-a5aa-29fa423a1fe0", "record_id": "flaws_cloudtrail:0000437:0f84c590-709f-4897-a5aa-29fa423a1fe0", "row_index": 437, "timestamp": "2018-02-24T11:55:20Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f84c590-709f-4897-a5aa-29fa423a1fe0", "eventTime": "2018-02-24T11:55:20Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c7ff6df8-4c21-47e0-b3d3-7f87333e30a6", "record_id": "flaws_cloudtrail:0000438:c7ff6df8-4c21-47e0-b3d3-7f87333e30a6", "row_index": 438, "timestamp": "2018-02-24T11:56:10Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 509, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c7ff6df8-4c21-47e0-b3d3-7f87333e30a6", "eventTime": "2018-02-24T11:56:10Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7d5b28d-5fc7-4797-97e1-e3f437a714af", "record_id": "flaws_cloudtrail:0000439:f7d5b28d-5fc7-4797-97e1-e3f437a714af", "row_index": 439, "timestamp": "2018-02-24T11:57:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7d5b28d-5fc7-4797-97e1-e3f437a714af", "eventTime": "2018-02-24T11:57:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "596d019f-9bc0-49a0-947a-ab074d8239a3", "record_id": "flaws_cloudtrail:0000440:596d019f-9bc0-49a0-947a-ab074d8239a3", "row_index": 440, "timestamp": "2018-02-24T11:57:49Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 519, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "596d019f-9bc0-49a0-947a-ab074d8239a3", "eventTime": "2018-02-24T11:57:49Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa2b2167-673b-4ca1-92df-66158db100b9", "record_id": "flaws_cloudtrail:0000441:aa2b2167-673b-4ca1-92df-66158db100b9", "row_index": 441, "timestamp": "2018-02-24T11:58:38Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 513, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa2b2167-673b-4ca1-92df-66158db100b9", "eventTime": "2018-02-24T11:58:38Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2448e84-e4fe-4a6b-94b0-5598af7742b8", "record_id": "flaws_cloudtrail:0000442:e2448e84-e4fe-4a6b-94b0-5598af7742b8", "row_index": 442, "timestamp": "2018-02-24T11:59:52Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 507, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2448e84-e4fe-4a6b-94b0-5598af7742b8", "eventTime": "2018-02-24T11:59:52Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "728aef5f-a8e6-496f-a3e3-b2e3ae209006e", "record_id": "flaws_cloudtrail:0000443:728aef5f-a8e6-496f-a3e3-b2e3ae209006e", "row_index": 443, "timestamp": "2018-02-24T12:00:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "728aef5f-a8e6-496f-a3e3-b2e3ae209006e", "eventTime": "2018-02-24T12:00:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "252992fd-4cdd-49f8-b929-64e72ec8892a", "record_id": "flaws_cloudtrail:0000444:252992fd-4cdd-49f8-b929-64e72ec8892a", "row_index": 444, "timestamp": "2018-02-24T12:00:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "252992fd-4cdd-49f8-b929-64e72ec8892a", "eventTime": "2018-02-24T12:00:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWeThFdmZ4SEd0dTFXdEc0bGcrT2FTeU9yWmFONkZjMkJxSWRTRTMrWGY5WUE0L094RWFPS1M5WEE3VUtmNENQZTIwVVFySlQ4bWVtc2YrTndpYjRINysvTVpGZmhVTFJLUGZYbW43Qkxia2kxelh6Ti96UlVyTm85Qk5pcW92c05nOU1nUU9ITlAxcGdIaUptdFd6aUhrRmpkWnpZNWRLanhHenp1LzMrcktSMXBOTEtNK3hwOEZzM2RPRTRidz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a939ed0-36fc-465c-a52d-c0300c2f88b4", "record_id": "flaws_cloudtrail:0000445:0a939ed0-36fc-465c-a52d-c0300c2f88b4", "row_index": 445, "timestamp": "2018-02-24T12:00:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a939ed0-36fc-465c-a52d-c0300c2f88b4", "eventTime": "2018-02-24T12:00:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxbUNRbWFIZDZKSkM2angxS3FyWmhVRVpuZWdkSXpxays0MEJWNUlJaGY5V2hCVld2SkUzMDZyajZzWWl2eXhOeVF5VHhFTm1uYkZnREkyL1AwZGVsZXFvNDRoZGNrRU43UytLeHdhVUcwVXdmQjBXdngxYjNJRWtpUDJ5bGJlV1d4cXQwUFhYWVpMeXRLUDRkQUt1YlgrSWQreXg3cDBtVlp3T204OGNwRHJySXBVTVJWZWdaSFNWem1uTVZJaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "014747dc-e1f7-4148-936c-dac80b975d7c", "record_id": "flaws_cloudtrail:0000446:014747dc-e1f7-4148-936c-dac80b975d7c", "row_index": 446, "timestamp": "2018-02-24T12:00:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "014747dc-e1f7-4148-936c-dac80b975d7c", "eventTime": "2018-02-24T12:00:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZS0tIZm0wVzZEMy9uK3kwRSthQzhTbVNoYkpVRFhPUmVmb3JEeWFHWWxJOGtOcWRKZC9pQVNraWtTMlZweVdhS1VjeS9PV2Jlb3Vud0E2NU1ZT3Rlc0hSZHhLWS9LYndGY1pTTU0zT2dwMWk3alNQQStaczFMTkN5WGlqdi92a1dnN3AzRW5qTEZ0M3hXMjhQbkh5OHhrMllack1lV0JCM0hCSWhXNWdndWVveU9YdHZqNDkwUWc5NWZiZDRUTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf2165d6-fab2-429e-8ab1-0b90a9c5f0e4", "record_id": "flaws_cloudtrail:0000447:cf2165d6-fab2-429e-8ab1-0b90a9c5f0e4", "row_index": 447, "timestamp": "2018-02-24T12:00:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf2165d6-fab2-429e-8ab1-0b90a9c5f0e4", "eventTime": "2018-02-24T12:00:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzWjN2WlVLeUlQaVg0QzZORjBpeUs4WEl5SXYwekpMeVlNVWJ3MnRCa2VNQ2lpb1owdTIwWW5uMVZQSnFsR1B1bmNwM2gwb0twYkdWaHBGR3VCS2FNQjlKLzlhZnhVNTZ4c1p6djhDeFM0ZzN1REFidGttemN2UzQwamZlSHNIcWVoUjdOZXlEQW4wTDVSSFZVVDhvZ1RFQXFxbWQ4UG55L1pNa3FPd0JBN0U2emhyR3p3MUQrNXJhTk1maWU2MD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7272a405-6c04-4399-896c-3b7044c5121f", "record_id": "flaws_cloudtrail:0000448:7272a405-6c04-4399-896c-3b7044c5121f", "row_index": 448, "timestamp": "2018-02-24T12:00:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7272a405-6c04-4399-896c-3b7044c5121f", "eventTime": "2018-02-24T12:00:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VlNkaFhCR1c1QXdObDJtMWRHZUJOV1Y0NldRMGZKQldQMm50ZTB3SHFFbmF5aTJKaWM1amFKaEsrM0hoeUE0S1ZNN3VJdXVqZWcyNG1WcDV2RC9Xbit1OWlNN0NHMDJ1Z1BOMHI2cWQvOSt0SXFwcUdrcmRYSmVreGlTV29WcVRjVlRWN2p0SGNJdXpMY1RFaDg5a1dlTlpnd25pZ2VHWGpycnpqRlRqNlQvRHhDeUZpSUpwWm52SS9MbSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "281071e5-ed8a-41dc-9217-f87a25417fbc", "record_id": "flaws_cloudtrail:0000449:281071e5-ed8a-41dc-9217-f87a25417fbc", "row_index": 449, "timestamp": "2018-02-24T12:00:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "281071e5-ed8a-41dc-9217-f87a25417fbc", "eventTime": "2018-02-24T12:00:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDeWJPbFkyWW02eDYybTJwQm5zV0ZqR0h4b01Ga0N6Skw1eGZ3c3gyVVJCLzl1Q0lTSW0zN2x0eGZiNWxFSFhCU3lJam44RytMK3BqMXdvWENqcXRYTVNrZjh5UUIyc1lPMnZEQmVlZStlaGM4RHFCYTJOR1lEaVZVYXhROEpxODNJMi9KMTBscnU2UE5lSml0Q0MwQ2pwNmZUMy80Sy9YRjlkdGFTWEw0UWVINU5vREJHcmJ2cjFGb29hTmZmST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1dcdf49-a3f4-4241-9192-e92fba5d0a83", "record_id": "flaws_cloudtrail:0000450:b1dcdf49-a3f4-4241-9192-e92fba5d0a83", "row_index": 450, "timestamp": "2018-02-24T12:00:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 817, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1dcdf49-a3f4-4241-9192-e92fba5d0a83", "eventTime": "2018-02-24T12:00:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "813c79b7-0731-4414-a654-d0600a900ac3", "record_id": "flaws_cloudtrail:0000451:813c79b7-0731-4414-a654-d0600a900ac3", "row_index": 451, "timestamp": "2018-02-24T12:00:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "813c79b7-0731-4414-a654-d0600a900ac3", "eventTime": "2018-02-24T12:00:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPQ2hzNUQwcHF1Mlc5WWJ6WGtaRFp3ckNDM3ptUEh3VHFCVjF4QmpqMHVlTC9oa1RXOU92TGZIS1BhUjBjbGRERW1XeWdRWG01aFpzbk4vUFdkV2RoWm5mK05EWEh3enBrOFh3S2JSNkhFVzVwdHBHdEE5T09TUUlQZk9wOGZKcmM2N1F5LzhxTW9vdjBITnBtZlJ4dEdlUXliVDhTK0pJSE5kd3Ava2FFQWFnbE5hTGxDOWtVN3BNdmc9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea30d459-64c9-4f4c-b159-b4782a5037ad", "record_id": "flaws_cloudtrail:0000452:ea30d459-64c9-4f4c-b159-b4782a5037ad", "row_index": 452, "timestamp": "2018-02-24T12:00:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea30d459-64c9-4f4c-b159-b4782a5037ad", "eventTime": "2018-02-24T12:00:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0bjdOU0hKdDlmSzc1bkhscng0alhrdXdTTWFnYlJmanhta2drQ3pOT3gxQkpjS040emhCbUNLajBlMzA0RWFLazZHU2h2RnlKdlNQWVFBejNMdkNNZVJmUGd5NmdJNEsyZmhGK0xIWTR5dWFWZzczZnp6Q3BTekpsL0llVWRWcXZYZ0o0RE42NTFFdy90bU1QSjQvSENHTDRWNVBGRkVQcDBGL0p3NWUwOGJoc2M0dCtsaUs5WGJZMmc9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2c8e408-b12c-4c2d-ac0c-ef73cde0e299", "record_id": "flaws_cloudtrail:0000453:e2c8e408-b12c-4c2d-ac0c-ef73cde0e299", "row_index": 453, "timestamp": "2018-02-24T12:00:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2c8e408-b12c-4c2d-ac0c-ef73cde0e299", "eventTime": "2018-02-24T12:00:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnQWpVajRtMGxWZDNpSm5lY3NGVlAvYTN6bWgxdkQyd1RtdVBKanJjMVJQVTNWSmtwY0NaUDBhSmR5SHVmdVo1RjdvY2FCejZBYVZTQVdLYWFSQm53T0xkeFJ3SEtXSnB6VUp6Qzhmd2d6MGtsS3o5WDA3Z0dHNUVqZHNYZGt0d0ZRd1owZWpIZmc1YXp2T1NUaWRVcXFxWGNocGVSSEg1NUQ0eUZrL2dXZEk2bStoK2t0K2FxNGxnM0d1OHQ4ND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34a404238-d2d8-4522-9cd2-d0852fbfac67", "record_id": "flaws_cloudtrail:0000454:34a404238-d2d8-4522-9cd2-d0852fbfac67", "row_index": 454, "timestamp": "2018-02-24T12:00:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34a404238-d2d8-4522-9cd2-d0852fbfac67", "eventTime": "2018-02-24T12:00:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtL1FCN25vaXB4cHArUDlmbElSemFldU96bCtTYVlKTWJSMTZhTnpnWDFRWGVFRVdEV2tpazFEZ05TaDcyTFUrWWdXQ2ovZUg4TlJtYndpeDhmZDNjSjJtZHpYVVVxRGk3cVRoWC95RDRnRmd1UjJKb2pkVTYvWklnS2ppWTRRSkxJTzEreEdvQVNSVTloWFBnWWJYUlRZZS9BeVh6NXB6U3MxbmgyK3hGZk9YMHBNNGN6bSt4dGl3QnVaZSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2db0e63c-43c5-44fc-8c8e-44b710790213", "record_id": "flaws_cloudtrail:0000455:2db0e63c-43c5-44fc-8c8e-44b710790213", "row_index": 455, "timestamp": "2018-02-24T12:00:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2db0e63c-43c5-44fc-8c8e-44b710790213", "eventTime": "2018-02-24T12:00:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2NmhNSmRTdjdwQlpsU2xoWk9xbEZrTjJtc2k3NHVZWWxsaVg3SFd3NzBjckhIRXNqVVBJbk9yOTJnMEozMU1TZGN6VVZtZmFOSVFObC9YcXB0b3crRVlKU20vR3d3UUE0ZXdmbUo5enROUm1iN2xoU1JxVm9aT0pjdDNqRzRpd3pTem1PTmcva0k2V1ZPdmdieWJVVHh1dThIL0tWbGlkeFVmWG9xTzF6eW1PVGl6cFBNcHZrZFhyY2hUeSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "890de5b0-578c-46bd-9ebc-68f807894a1c", "record_id": "flaws_cloudtrail:0000456:890de5b0-578c-46bd-9ebc-68f807894a1c", "row_index": 456, "timestamp": "2018-02-24T12:00:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "890de5b0-578c-46bd-9ebc-68f807894a1c", "eventTime": "2018-02-24T12:00:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTTnVRK3BmeE5vdGIyYnhzMWtSMER0ZW1kNGpKZEhFU0NBMTlFVnh1cmtFNXdPTXVteW91bXphU1ZQNVFWc0l0eCtIbFUrN2F1eEJFT3lFSi9PZWUyUEZnSGk1VEYySGhNZkVVazlrbEl6VURkbVkvWGgrNG93WEtLdm5yVWZ2WndLU3pYaERwZFhKclVLNzBsR1ZEM0wzMEkxYTdzS1NOTUNoY0JZZXY2d0pGMHF0SU9yWFA3c2xMM0NJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "099970c09-c11f-46a4-8278-220929b3ed149", "record_id": "flaws_cloudtrail:0000457:099970c09-c11f-46a4-8278-220929b3ed149", "row_index": 457, "timestamp": "2018-02-24T12:00:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "099970c09-c11f-46a4-8278-220929b3ed149", "eventTime": "2018-02-24T12:00:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJPNktNcmpiNHhpT2NJTlBGanhQVWRHRzM0MFFmNG5xZ0U3U0hUUmkzTUhpUERVdVkraUFIcHFIZG0xMGVCbHAvVEo5TnFGODZrLy82cWpJNDNhT2NxMGQ3amVqa0ZTNGpOdnpWY241V2ZOcWt5NFFmbTR2dkxtNWxXbFkrWmp1ejVNRnhZaGI3Ui91bXN6OUl1eFpRUEs3TnBhTzl0Mk42bHBNNW1HVTdpakowOVo0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25cd5213-9400-49da-ab05-df4a9c6574dc", "record_id": "flaws_cloudtrail:0000458:25cd5213-9400-49da-ab05-df4a9c6574dc", "row_index": 458, "timestamp": "2018-02-24T12:01:25Z", "event_type": "ListFunctions", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 513, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25cd5213-9400-49da-ab05-df4a9c6574dc", "eventTime": "2018-02-24T12:01:25Z", "eventName": "ListFunctions", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa67af36-2344-444b-8442-7a786e035a79", "record_id": "flaws_cloudtrail:0000459:fa67af36-2344-444b-8442-7a786e035a79", "row_index": 459, "timestamp": "2018-02-24T12:01:35Z", "event_type": "CreateGroup", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 844, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa67af36-2344-444b-8442-7a786e035a79", "eventTime": "2018-02-24T12:01:35Z", "eventName": "CreateGroup", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:CreateGroup on resource: arn:aws:iam::811596193553:group/Admins", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e38158-092c-4a73-bde8-0c5f6f5e15f9", "record_id": "flaws_cloudtrail:0000460:3e38158-092c-4a73-bde8-0c5f6f5e15f9", "row_index": 460, "timestamp": "2018-02-24T12:02:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e38158-092c-4a73-bde8-0c5f6f5e15f9", "eventTime": "2018-02-24T12:02:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abc22d84-d47e-4e20-8778-2b6ec7f20ea3", "record_id": "flaws_cloudtrail:0000461:abc22d84-d47e-4e20-8778-2b6ec7f20ea3", "row_index": 461, "timestamp": "2018-02-24T12:02:16Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA3PVCD4W9SC7WL1OW", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.218.112.97", "user_agent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 516, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abc22d84-d47e-4e20-8778-2b6ec7f20ea3", "eventTime": "2018-02-24T12:02:16Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.218.112.97", "userAgent": "aws-cli/2.1.24 Python/3.7.3 Linux/4.14.225 botocore/2.0.0dev45", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA3PVCD4W9SC7WL1OW", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94e893504-dd8c-494a-a484-8aaf6fc8583f", "record_id": "flaws_cloudtrail:0000462:94e893504-dd8c-494a-a484-8aaf6fc8583f", "row_index": 462, "timestamp": "2018-02-24T12:02:18Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94e893504-dd8c-494a-a484-8aaf6fc8583f", "eventTime": "2018-02-24T12:02:18Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListGroups on resource: arn:aws:iam::811596193553:group/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4c16c7f-8583-4728-a955-74f1892f2815", "record_id": "flaws_cloudtrail:0000463:f4c16c7f-8583-4728-a955-74f1892f2815", "row_index": 463, "timestamp": "2018-02-24T12:02:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4c16c7f-8583-4728-a955-74f1892f2815", "eventTime": "2018-02-24T12:02:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3d1f207-21e9-469b-ae16-121028bdf2", "record_id": "flaws_cloudtrail:0000464:f3d1f207-21e9-469b-ae16-121028bdf2", "row_index": 464, "timestamp": "2018-02-24T12:04:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3d1f207-21e9-469b-ae16-121028bdf2", "eventTime": "2018-02-24T12:04:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf644aec-d68e-4486-ae0a-3eb30230b356", "record_id": "flaws_cloudtrail:0000465:bf644aec-d68e-4486-ae0a-3eb30230b356", "row_index": 465, "timestamp": "2018-02-24T12:04:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf644aec-d68e-4486-ae0a-3eb30230b356", "eventTime": "2018-02-24T12:04:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuNUhlRFZhaUlLMEFFWVY0ZlhXQzZvanRzM29oM3VJc0JRVXl4TUtuYzlwRlVOVE9ER3BTaUsrdW5QblFZWjhrVEZUdVFGNHphdk5PT09xWGZhU3lPcmtJcWhqRjI5dzFJQXdMZmI1S0htZWZOaWQ0V1daYXVnNXR4M0FKVDZFWGJpT2Jtb2s2TlVNQ0Nyc2NQSElvTGFlQk9kdisyUjltNVB4VWxRUGtHckppYkdMbmRsUmg5aEJRNGhHUlhqYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "770b6341-9c08-4f45-aa12-d9ee23d4d9c0", "record_id": "flaws_cloudtrail:0000466:770b6341-9c08-4f45-aa12-d9ee23d4d9c0", "row_index": 466, "timestamp": "2018-02-24T12:04:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "770b6341-9c08-4f45-aa12-d9ee23d4d9c0", "eventTime": "2018-02-24T12:04:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2c1JBZ29nOVlyU0Zad1FveEZjbm9IWncvL0lFenVENFhkUTJJVEZwUDNVR3h0eXNuQnRyQTgzUENBOE1TRllWd3UrOEtKYWlpVHN4QlZtak56YmxLSXdScmE0TW43K0NCM0hRaTNnQkozTWYzNStCbXlDSzE0R2pwMjQvVXRWa2Nnd2szeXZkUkQveVRUZmVxTkhXU09uU0dGK2o2NFk4eXREQ3I3TTVhc0JqWXJ3NEtRS1RPZGVhaXpRcCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "131227c04-58b7-4eec-b872-e02db010f722", "record_id": "flaws_cloudtrail:0000467:131227c04-58b7-4eec-b872-e02db010f722", "row_index": 467, "timestamp": "2018-02-24T12:04:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "131227c04-58b7-4eec-b872-e02db010f722", "eventTime": "2018-02-24T12:04:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkZzZZRGZvalVpeUprTFI5L2daQVVXRUJYZ1FFeHlUZnRTUEc2dUVUc3pMbkJJQ1NOblRCMTc5R0NvVXVuYllEVGMxZmx0M3lxQWhFZXVvSkZ5SDVvY0ZBNE53cWFEelhvSTlJbDk0b05jQ1VJRkJsdFlidEJRejVKRWpsSVlDVTk1K2pUMmV6WWIvTklueTVlUy9zTURpTVFYUGFMa3lsT3A0SnY5TzZkREUvS3Q0Z2o2aGFwaXU1bHhMWWNKRT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "916a7ad3-6e17-4c16-ae91-4e3f0c41b087", "record_id": "flaws_cloudtrail:0000468:916a7ad3-6e17-4c16-ae91-4e3f0c41b087", "row_index": 468, "timestamp": "2018-02-24T12:04:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "916a7ad3-6e17-4c16-ae91-4e3f0c41b087", "eventTime": "2018-02-24T12:04:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHRU8vdFdNQ1JxU3hYdlE3ZEFRQ1lLMWFZc1h5TDhqYzZrR1gzNER5aVZ4SkdVUFNnd21mc3ZmeUJqQ096VGh4UnlvVW1Mc0RIOW1hWk1jSTFxdWNrNDBqKzBFQ3E5Um8vODI5ZS9sYVpUNXhjQyt5RCtpOUl2ZkpRRXZnS2dxNTNQdnMwSXdtRUtNQi9kakF0YlZKSHVQcExjV0hLMWN5Ynk3azZGYnNVYVdweUpKMU9MdGFPUkYyb2c9PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55b66e33-8ae5-4d0a-b3f7-38ed6e2dd5d5", "record_id": "flaws_cloudtrail:0000469:55b66e33-8ae5-4d0a-b3f7-38ed6e2dd5d5", "row_index": 469, "timestamp": "2018-02-24T12:04:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55b66e33-8ae5-4d0a-b3f7-38ed6e2dd5d5", "eventTime": "2018-02-24T12:04:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwT3YzV3VMUkxTbEJua1NVQXlzd0hpRTBkTFV1UElOM3pxQjZwOVhCMEZuQTdzL3NPVFFGcGlNZUMyODZSZFNZOW9uZ2xuQmpibDNWQmlRSitiMmJoS0loQzVhUzFxeGdUYk02bUpSc3ZoTjUvczgrWVlkeU13Qk1HTlI4UDBvU0tndVh1RmhnN1B4SEl2QXI5S2d1MVdRVWJ5L3RLQ2MyVm5teHgrMmRSUW82WEZSK1B5UzJtQktjTXVrPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "216af0a9-4a4f-48e1-9870-131f46d55704", "record_id": "flaws_cloudtrail:0000470:216af0a9-4a4f-48e1-9870-131f46d55704", "row_index": 470, "timestamp": "2018-02-24T12:04:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "216af0a9-4a4f-48e1-9870-131f46d55704", "eventTime": "2018-02-24T12:04:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMd3J0RFZ0eDk5Z2R3YWExbEFjRmV0VHNPQldJN282Rk1xaUVlNTRrYkZzT0F4VlMrem5PaFU4WWdyZUd2R0JCWTZiZHBJNEJiZEl3R3JPWHZHTlk4b3RRYXZUQ1oxMWVLdy8rZnBjVEZ5dllnTHdaQkZRVlVucnlGL2xYcWdoMFlYYk8xT1p6ZGtGTjNUdS9TbmFaS2pETlc1VWxyR0Jzdi9HNXdQVDAreFZiNlZVVHVDSWM0a2hEWldybzJaYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6e365790-fab1-4f6e-9b91-63db11606a7", "record_id": "flaws_cloudtrail:0000471:a6e365790-fab1-4f6e-9b91-63db11606a7", "row_index": 471, "timestamp": "2018-02-24T12:04:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6e365790-fab1-4f6e-9b91-63db11606a7", "eventTime": "2018-02-24T12:04:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBWmJtSE9uMEtMVzZJRUdRTkFoSVhUVUpqR2h4TXpTb1F5eXU2dUp0dExwUytvYjA3Yk5qV29CM3dKTHJ4RS9jTElQOGZtSGE3dWF5SmxRUjR4d0wrWDVDQlhzV1dGVld2RFFwVlp1S2tCZjVaUWc4NVA0L0lJZElGSURkS2NxQkhRQmtZUVpVOFZHS3hMZE1GQUFMYS9rZGdqUnp5a1V3REJWYytod3E3UHcvQ0VkY3RNNGN2MnRLcWN1aSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f0dcbaa-5c15-47f9-ac52-c32857af8c6e", "record_id": "flaws_cloudtrail:0000472:5f0dcbaa-5c15-47f9-ac52-c32857af8c6e", "row_index": 472, "timestamp": "2018-02-24T12:04:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f0dcbaa-5c15-47f9-ac52-c32857af8c6e", "eventTime": "2018-02-24T12:04:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3RWsxVkJ0VXFsT3ZLRFJPeVpuSVBoVTRDQ1JKVDBPNGJVSE4rU0dqN0g0VlBNYlJCQzYvcUovMitKM1haK1RuMEFJYis5UHFJdFB6eWNPcWM4Nys3cFRzMzRTZ1cxWmZWaG0vV2E0THgwck9LTkJLRDFQZGdrdUFFZGhFUU5EQkthdCtwR244eGNRQUVPYXlyMGR2c3JCaVZqd1I3SE13MXVHQlp5WFdGTzJwcnA5Y3FUYkwydEdZdUxBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e0a8b3e-2b5a-4063-a3d8-1a1d26b032f0", "record_id": "flaws_cloudtrail:0000473:7e0a8b3e-2b5a-4063-a3d8-1a1d26b032f0", "row_index": 473, "timestamp": "2018-02-24T12:04:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e0a8b3e-2b5a-4063-a3d8-1a1d26b032f0", "eventTime": "2018-02-24T12:04:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3RVJjTkdITXFzbXBuTGdCdTB2Rkw3TzdRNFN0KzZjQVZLajhMWE40dWFyUSs3K2FXeXZoQ0YrM2IvK3VPbEN1QTdlT3VvMUJJR0V1WWpuR0RSWjhWNS9BT0dOZVRhelJaMHJEeE1tTm13Y3hkN0dwRlFtUXM5am53R0VoS2JBRVJPM05MejlXNDZhZGZYcmdlTWJUTWNsNWtyVVFxdStnRTVmTExmOTVvUXh6NWdKdEdVR2s2alhKRUhOYUFtOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff28252-a0d0-44e3-bbaf-c7bdc5451ce8", "record_id": "flaws_cloudtrail:0000474:ff28252-a0d0-44e3-bbaf-c7bdc5451ce8", "row_index": 474, "timestamp": "2018-02-24T12:04:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff28252-a0d0-44e3-bbaf-c7bdc5451ce8", "eventTime": "2018-02-24T12:04:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUU2UvU3JzWEtrMXZZOTFkYWtvWjFtRnNkNmM4d2ZYVWZMZ0l0a0dIdjNhNTR6UE9WWmgxRUcrL3RBV09ZcmlWZTFWOUx1YmtYRTF1bmwzdnJmUS82MURhNDQzbVNtZGFWRGFabTN6bkYrbDg2ZEtVQm1kMXp6d3o5SDlaUDFqQXRLSE1Ib25MOHNXNWE3ZGJzOHhLN01waHgwWWttQmRnWFcyYVMxcU16bTltRnM0QUZocGEwWnlFd05zUTlIaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db52310-f674-459d-9676-63fbdc60220", "record_id": "flaws_cloudtrail:0000475:db52310-f674-459d-9676-63fbdc60220", "row_index": 475, "timestamp": "2018-02-24T12:04:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db52310-f674-459d-9676-63fbdc60220", "eventTime": "2018-02-24T12:04:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzL1BtRStycm04aUZQM3U1SU9lWGVIU2wraFU4UW9uSkRka1VHclo3N2ZRQ29JNEpFYkdOMmJsaUJqaUhOR0Q5bm1iVU9ReUo5UEJOY05adWNPdXI4UnVZLzhVbWFJT1lIT2RqWnR3OGpUb0RZMFFRQlFEbk15bFc4Z0t6QTZVSWI5YVRDZHBSb0VhZ0ZtaS9rUVV6clJPaWdCb0ltV01aWUYwcDJHTUN5bUxIYlVDaVVwKy9ncTd3amIwdXd1ND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39a463e6-1537-47c3-86d6-ed58d754a4f8", "record_id": "flaws_cloudtrail:0000476:39a463e6-1537-47c3-86d6-ed58d754a4f8", "row_index": 476, "timestamp": "2018-02-24T12:04:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39a463e6-1537-47c3-86d6-ed58d754a4f8", "eventTime": "2018-02-24T12:04:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLOXdnMFROSkRVQXRTb3hueU5EZjB5d0tmU3duUStUeCs0dFZFK0pKd0FTRU10UjJkaDlzbDVwYTRkdnlvT2E4T2pYRTlLUUJZajhzNktRMEtUUzUwVXIxOFJ2WWdvRG80em1TZTAvNjVCSEY2SGlOSzd2dHhEd0tEMVNYNXQwVGFHLzRjdkZZelh1OHo4YytFcXl3UVhxSlB4Yk5tVW9ib0FzY3g1U1Q1bW55aU44bFByU3FVNlRsTlFPcCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72c47e19-9601-49ab-b4c6-7253e7c1f45c", "record_id": "flaws_cloudtrail:0000477:72c47e19-9601-49ab-b4c6-7253e7c1f45c", "row_index": 477, "timestamp": "2018-02-24T12:04:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1035, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72c47e19-9601-49ab-b4c6-7253e7c1f45c", "eventTime": "2018-02-24T12:04:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4RVN0bGpXSmNWSisrWUxrYXhNRXNMZVg2TG9heDRMd2UrUCtPcjZhSHJhM0xVdkZwSFFFSjRlMndxZy9yOUMrWWVTeEIrUkEvWlZ4ZlcxMTVSSWV2MC9CNVpvK2Y3WW1RNGZjb2RRdWkrZzBLVlVQUnptY0x4M012M01xNUNxemIzQ1RnVmJGeEpEakJQeE5xOVNmN0lvUFdEelBpMkJSZWNXNyt1ZU1NSjV4TnNnPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57c8e66d-c01b-428e-b11f-1ca6463cb69f", "record_id": "flaws_cloudtrail:0000478:57c8e66d-c01b-428e-b11f-1ca6463cb69f", "row_index": 478, "timestamp": "2018-02-24T12:12:21Z", "event_type": "CreateRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 842, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57c8e66d-c01b-428e-b11f-1ca6463cb69f", "eventTime": "2018-02-24T12:12:21Z", "eventName": "CreateRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::811596193553:role/MarkHack", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "530ef5e5-0e91-4230-8b24-bf175fdc7aaa", "record_id": "flaws_cloudtrail:0000479:530ef5e5-0e91-4230-8b24-bf175fdc7aaa", "row_index": 479, "timestamp": "2018-02-24T12:13:08Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36]", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 656, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "530ef5e5-0e91-4230-8b24-bf175fdc7aaa", "eventTime": "2018-02-24T12:13:08Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36]", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75f6600c-b17e-4754-a688-2c9994ea181c", "record_id": "flaws_cloudtrail:0000480:75f6600c-b17e-4754-a688-2c9994ea181c", "row_index": 480, "timestamp": "2018-02-24T12:13:24Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75f6600c-b17e-4754-a688-2c9994ea181c", "eventTime": "2018-02-24T12:13:24Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1689f0bf-7658-4227-9987-bb7fff24ce6e", "record_id": "flaws_cloudtrail:0000481:1689f0bf-7658-4227-9987-bb7fff24ce6e", "row_index": 481, "timestamp": "2018-02-24T12:13:57Z", "event_type": "AttachUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 828, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1689f0bf-7658-4227-9987-bb7fff24ce6e", "eventTime": "2018-02-24T12:13:57Z", "eventName": "AttachUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:AttachUserPolicy on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bc2d6cf-16a4-4379-a957-2d4d9293c1d3", "record_id": "flaws_cloudtrail:0000482:6bc2d6cf-16a4-4379-a957-2d4d9293c1d3", "row_index": 482, "timestamp": "2018-02-24T12:15:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bc2d6cf-16a4-4379-a957-2d4d9293c1d3", "eventTime": "2018-02-24T12:15:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLaUl4R0JXci91dGM2TGZaN0ZabDN1SXF2cVpQUzJadTBoYzdqTG9yZTlaY1FIZlVBd0xwVThRM2l6UWJaNXAzeGVlMC85TFpLaEF4eTVrUzhoSmpsQUNpSXVibzhYcU1QcXU4QVlhNWhUVkpOdHgxcjJFQ0pib3lVYjR6QWd2NS9Cc2JhT0lrMGFjZ29vREVpSFhsSzNjdFJ5NG03SldabDFERmpSRlVsSW04a1FULzFqTk53NHNjb3B4TkcvYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "954a9452-fc55-4e58-a231-65e17b114cb8", "record_id": "flaws_cloudtrail:0000483:954a9452-fc55-4e58-a231-65e17b114cb8", "row_index": 483, "timestamp": "2018-02-24T12:15:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "954a9452-fc55-4e58-a231-65e17b114cb8", "eventTime": "2018-02-24T12:15:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c89b4e64-80b8-48a5-b9a3-cf609886ebe", "record_id": "flaws_cloudtrail:0000484:c89b4e64-80b8-48a5-b9a3-cf609886ebe", "row_index": 484, "timestamp": "2018-02-24T12:15:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c89b4e64-80b8-48a5-b9a3-cf609886ebe", "eventTime": "2018-02-24T12:15:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLbmNNTFY3cWxJTlErYXpSNW1JMysrWEhIWTF4Wkx2SGxjZXYvVGs0aTA0MTA5cHVIVWNyYVVOR0t5SzBFRTdxWjk5aDZHYjl6Tno3MmRhMnQ5UmpEQ0tUTG1EZmptNnhDT2NNNGl5RXV4TEs4QVdNMWs0VmpmTXA2TWhzK24yUG8rM0c3cmJmYnhpQ2FmZjFNQmQrbkpiK1JvRWp0WXBoSzM0Q051Z29SNENLWHFsM053S24yQlFPVUlzMVcwUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f571e30c-371c-45aa-81e5-9a4bdbb9386f", "record_id": "flaws_cloudtrail:0000485:f571e30c-371c-45aa-81e5-9a4bdbb9386f", "row_index": 485, "timestamp": "2018-02-24T12:15:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f571e30c-371c-45aa-81e5-9a4bdbb9386f", "eventTime": "2018-02-24T12:15:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHMnBDMzFodVhoNFhSQkNTWFJMbC9UT2YxWURRSFdJYSszNjhsYngvaU0xVzVYUm1kU3hLSE1iU1NvVG4zbGNNSHVhSERSdkFMM3NtZURuSW56UWdxV0QvTjdwTG54U1lXL0NhdWhxWmh0bEhZS1ZkQlhWckN5WnV0ODlydzUzakFYTlJmNlN0SnpaM1RHSW1UOVp5QzZkeE9OcjNJMDZlZ2lQWXVCb0xwVkx0cWpBQjlDNjIvSkNCd3Q4bGxnWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48241ce-07b8-4e71-b0fe-0b09ad400ccc", "record_id": "flaws_cloudtrail:0000486:48241ce-07b8-4e71-b0fe-0b09ad400ccc", "row_index": 486, "timestamp": "2018-02-24T12:15:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48241ce-07b8-4e71-b0fe-0b09ad400ccc", "eventTime": "2018-02-24T12:15:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxSUtiQzhwTndkZ1ErTWxRaFRRU2c3RkFzMmpyRGZybTl0T0crOE9WbWpzaVlmR2pmMXVkR2M2NnBmUUhidXNhdzVzcXcxbGxMYW5IWGllS0UwUlZ1UTMyT3dWWEgvOXBvK09UQWNQWUZ3RkZNc2RWR2cwVllsMnZiOCtMSUk2Y0lDR3p4S28wQ3JpUHN4Ri9uVGtRSXg2d1JYZVU4VVNPUzJJZncxWGRjalpIUzdPbk81OGZjR2pGL1hyWngxST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf5b4eef-afe7-4421-a43d-52d42c7b7cd1", "record_id": "flaws_cloudtrail:0000487:cf5b4eef-afe7-4421-a43d-52d42c7b7cd1", "row_index": 487, "timestamp": "2018-02-24T12:15:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf5b4eef-afe7-4421-a43d-52d42c7b7cd1", "eventTime": "2018-02-24T12:15:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmVy9sR2tBY0cvS3Zmckd6UWkwM2x2cElDMzNqVEhTVlJheTA0UkxobkNRVllpVGRWL0ZEMGpxSyt5NnVjaGZmeWtEalNEdEN6TldHNEVFYXYwTk5VcmxreEVFVFF3dEd2bEhWbE9PWEY4bUJ3VmlwTjM1YzVCMUF0NXBsL0ErdE5UeU5tWjlmdEZRQ0p3L2dFMk5xaGVtUUlJYm5TcVBSSUFyaDNCMWVMQ0cwbDNFY0xwOURsKzhwQkdhZTQzQT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebb3fcd7-097b-42c8-b5d8-07a98602", "record_id": "flaws_cloudtrail:0000488:ebb3fcd7-097b-42c8-b5d8-07a98602", "row_index": 488, "timestamp": "2018-02-24T12:15:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebb3fcd7-097b-42c8-b5d8-07a98602", "eventTime": "2018-02-24T12:15:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOb3k1Z0tDN1U0U3BqZlk1aDBHUTNLVDJMTjEzU3VocTArbzRRSEp6ZytmNENTT1ZqUnVVSzh3Wng0WDVCN1RsNnZGQjVtWnRYcUxnaldneEpRV2YrcCtJbVd4cHpXZjFTTXpZK2wrRHU5aWV4dEE2ME5lZ2RSUWpreitWNFdrVWYrRkU4THZTeE9GWHNPRC94NjNVUVRaN0g5MkxPMFhjbERJZGNFSzBJS2NxRXBoOXdWNkt5aHdvZXFZNFFIOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c99db477-11c8-482f-bdec-acbc1ac4e75f", "record_id": "flaws_cloudtrail:0000489:c99db477-11c8-482f-bdec-acbc1ac4e75f", "row_index": 489, "timestamp": "2018-02-24T12:15:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c99db477-11c8-482f-bdec-acbc1ac4e75f", "eventTime": "2018-02-24T12:15:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3bkx0VGxBamRKTHI1UEFXZXpKNVZkU3VMWUpMUlVnOFBsS3k3VnI3OXI1SDFSTHlEaDN0dkcxNyt0NHhNT0JXV3V0akNZV25zQVJ3ck1vNlpVY09Ib0JDbGdHUlFibVhJWXBFMU9jejMxZStJMm03aHR2TVBjWXZLN25URkRsNzJhc2hCeE5ROWV4QW1idTVoM25Ib042aXNyVUpvbWRZVDdFYTFhUjNyb2U5R1o3dm5SUmpTQ3BhT3gvUmxRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9da1798a-668c-4c93-8b9f-60db06f226c7", "record_id": "flaws_cloudtrail:0000490:9da1798a-668c-4c93-8b9f-60db06f226c7", "row_index": 490, "timestamp": "2018-02-24T12:15:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9da1798a-668c-4c93-8b9f-60db06f226c7", "eventTime": "2018-02-24T12:15:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvanVndzN4bjIxL2w1TXlZU1p3cXVFVkxJczJiVGZkOGtXUCtvOHZpZGpGWlBPNnpVVWswa0VEdTRneWttbUFPM1FKaXN2K0V2RzRNZmtQU1J4cXpaRGNTeWNGbXdMMjFXS2FpU3o0ZUhCVGxlNnNIZFcvYlRDdDFuZVNIN09ZWVIvTHJ5MmlRaWs2WTJuYnE0WGhSdm4zcFcxYWtkMnNKMm9LQ2RSOGZGR2ZMeHZIZSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af4e517f-d71a-45d4-ad23-5bb6a356f604", "record_id": "flaws_cloudtrail:0000491:af4e517f-d71a-45d4-ad23-5bb6a356f604", "row_index": 491, "timestamp": "2018-02-24T12:15:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af4e517f-d71a-45d4-ad23-5bb6a356f604", "eventTime": "2018-02-24T12:15:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIrSkpkb0ozdzZEZUd2TU1GM09KQWN5TnhRemc3VHhrQXdzMVlBL1JocHNmSGlldGcvc0hMSkNKV093TkFja3U4a1B5NUZYNXZaWTVzZFdNaXk4WDNJckg0VmRMdWU4WUk4bkJzVlVzUmJjbWx3N2lHTlhvV3VrMTJsckFKbW1wSDZDbDBxT05UMmxib2NIZi83SEVIbS9RbUVVOUljSHdiSlVSaEo0Qk91UUN5bVNSbEJVbXh1ZUxGMFhEWUkwaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de19a46a-365f-40a2-aa44-a160e36d9d24", "record_id": "flaws_cloudtrail:0000492:de19a46a-365f-40a2-aa44-a160e36d9d24", "row_index": 492, "timestamp": "2018-02-24T12:20:02Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de19a46a-365f-40a2-aa44-a160e36d9d24", "eventTime": "2018-02-24T12:20:02Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5e60c9a-6a59-475c-92e3-119002c462b0b", "record_id": "flaws_cloudtrail:0000493:d5e60c9a-6a59-475c-92e3-119002c462b0b", "row_index": 493, "timestamp": "2018-02-24T12:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5e60c9a-6a59-475c-92e3-119002c462b0b", "eventTime": "2018-02-24T12:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36ca755d-f274-4c21-894a-2c864f883db3", "record_id": "flaws_cloudtrail:0000494:36ca755d-f274-4c21-894a-2c864f883db3", "row_index": 494, "timestamp": "2018-02-24T12:21:15Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 639, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36ca755d-f274-4c21-894a-2c864f883db3", "eventTime": "2018-02-24T12:21:15Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.9.1 Python/2.7.13 Darwin/17.3.0 botocore/1.4.72]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08ba08ab-e122-430f-bfc6-34f85daa5dcd", "record_id": "flaws_cloudtrail:0000495:08ba08ab-e122-430f-bfc6-34f85daa5dcd", "row_index": 495, "timestamp": "2018-02-24T12:21:56Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08ba08ab-e122-430f-bfc6-34f85daa5dcd", "eventTime": "2018-02-24T12:21:56Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10b4f04a-ae85-4f73-8b5e-ce320b658284", "record_id": "flaws_cloudtrail:0000496:10b4f04a-ae85-4f73-8b5e-ce320b658284", "row_index": 496, "timestamp": "2018-02-24T12:22:43Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10b4f04a-ae85-4f73-8b5e-ce320b658284", "eventTime": "2018-02-24T12:22:43Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f1d870c-356c-4905-ae90-f4c6aa934abe", "record_id": "flaws_cloudtrail:0000497:3f1d870c-356c-4905-ae90-f4c6aa934abe", "row_index": 497, "timestamp": "2018-02-24T12:22:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f1d870c-356c-4905-ae90-f4c6aa934abe", "eventTime": "2018-02-24T12:22:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "314a6e64-c553-446d-bdc1-b30b8c57f42d", "record_id": "flaws_cloudtrail:0000498:314a6e64-c553-446d-bdc1-b30b8c57f42d", "row_index": 498, "timestamp": "2018-02-24T12:23:00Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 656, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "314a6e64-c553-446d-bdc1-b30b8c57f42d", "eventTime": "2018-02-24T12:23:00Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8fe8f6ec-ad36-418a-9e90-dad41b85ed79", "record_id": "flaws_cloudtrail:0000499:8fe8f6ec-ad36-418a-9e90-dad41b85ed79", "row_index": 499, "timestamp": "2018-02-24T12:23:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8fe8f6ec-ad36-418a-9e90-dad41b85ed79", "eventTime": "2018-02-24T12:23:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTUENQcmR0TU9Kd2RjdzFCSHFOLzVJQlpUamx3QWxvOHpwVWZHMzNRd0NqL1puNEVBOWRtNkloWkowWEhndWRuSFhhZ3NTekpwMU1Ld2dQdlErajhXRXJBSFdjeld2VzNqQVNtZDZsWW5sdkI4YTZVQmlRa1NrVzJsMXo0cVhLYU5IRlc5N2FxYm9xNXZ2cHlkcnNOR09sWlZxbmVnL2dlS2JHTFJzV0xweUxqWDFVYmc4aWRMRTRETjVRaldNWT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e71b558-81dc-4154-abb6-d488c525b797", "record_id": "flaws_cloudtrail:0000500:8e71b558-81dc-4154-abb6-d488c525b797", "row_index": 500, "timestamp": "2018-02-24T12:23:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1062, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e71b558-81dc-4154-abb6-d488c525b797", "eventTime": "2018-02-24T12:23:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUc2hMRytkai9ESVBTMWdaTlY3eGVlZ2JHUmt5M2wzMVFlNjY0RTNpSjVaNFhvTnY4dXNUR29LMTlJQVlWbFFqNFlXcGg5bzJmRWNPaUszeUx3UzJTaGtwN3BKWVRmOXRqVGdtcjFFZUhXejJ6TkhvZTZwZDJrWXFoQXZhN09aSG5OSlhKOEd3MThhYVRGSytiMzJ2SWN5RXRXKzgycmsrdTJ5VVJnVzNJUzhwT0xxVml6VjJ4c1RmQWh6NSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dcc153d-852d-4fa1-8101-db4b0ade9d66", "record_id": "flaws_cloudtrail:0000501:3dcc153d-852d-4fa1-8101-db4b0ade9d66", "row_index": 501, "timestamp": "2018-02-24T12:23:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dcc153d-852d-4fa1-8101-db4b0ade9d66", "eventTime": "2018-02-24T12:23:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQMEVOcGhndUFoOUQvbHZ3dnhncjlXOURMSEZGNmt4WmZ2aEVMbStPUEFRcFNZMjJnYjB5Y0kzeVNWWUN2dlJtN05zTjR0U1k2ejJmTkI5emtGbzlpOVZtbU1KQjVzUExLZWgzOG4rK01PaEpWVHRrWERXNlZDMWhOM2IrSlgxaWF3cFZVMFlXTDRzWUJJV1pMV2pqV0taOGJ5b0FNTUtWRy9zMUtrdkxlZTR3MlRuaUZTbXZkRHdoT1E4WEg0QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3fbd391-1608-4422-9dd3-486352660713", "record_id": "flaws_cloudtrail:0000502:d3fbd391-1608-4422-9dd3-486352660713", "row_index": 502, "timestamp": "2018-02-24T12:23:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3fbd391-1608-4422-9dd3-486352660713", "eventTime": "2018-02-24T12:23:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQZTl3N0FEY25MMGgvK0NnaFJHYjQyYkx4NE8yWG1RSHl5Qm14eUN6TGxUQXlsMEhuUEkvbGc0OExwVWhua252WXUxVTByVUQ0RnhJMDFpR0NYSncrejRmRkZpK29UYkFnY1JLV1ZOSGxTRE9DSElNbVYxbHFkS2RueDJ2WDc3Vmc3SXl5U1dJVERaamJuZW9BT2tTMElBbEQ5OUROaEZRV0tTOVBpTUVReHg1RzJXR3pGR091Wm90ZmVTUEtobz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0ad3d27-0159-425b-adbd-8bc814e11cc0", "record_id": "flaws_cloudtrail:0000503:b0ad3d27-0159-425b-adbd-8bc814e11cc0", "row_index": 503, "timestamp": "2018-02-24T12:23:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0ad3d27-0159-425b-adbd-8bc814e11cc0", "eventTime": "2018-02-24T12:23:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVR1VidUNOR0lGN1UxVWNDV1VpOU4zamNuUlVuTUorNVZYQUk1WEVBdzJoVVI2TjVaRHNkN2pJdDBnVHhVemkveDNDOU1BSGtIQkljUU1KdFMweUppZWFoR3R4VzdGdDJud1hSYTgxb3dBYlhaYjg4WTRKano1YWdNbFBNaytZWXN5SytqUzVFb1BEcFBZNVEwd3lGWUNhVnE3b005SWp1UnhmYTNlclFOSk5yMHlTNjRpd3lyN1lrN1hzdiIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5677d9c7-d9f8-465e-8599-d149688b6e168", "record_id": "flaws_cloudtrail:0000504:5677d9c7-d9f8-465e-8599-d149688b6e168", "row_index": 504, "timestamp": "2018-02-24T12:23:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5677d9c7-d9f8-465e-8599-d149688b6e168", "eventTime": "2018-02-24T12:23:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKZWhEUEkwd2JnTkpCL2x2WnhPaVBiSVJJb2lWL3ZLNlV6cENuckRaUGJnaEpDSHhDOXRlU0htOThSZndjV2ROcUVFYjhweVZZeXZoTmlhNnU1UkVqemxaOXZQaGhzSlhJVTczM0M0SjI2clBndzJiT1VLbTlScC9abHl4alkyUW5xMVZ1aUpTWFdKSzZLS3NmNGltRVVpdVI0b2pvWGY3V003di9IT1pIR1VhVWx4T2FhK0pMVm5EMHBZKzVWND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc2ec132-bb6d-4dce-9e86-d792ae158975", "record_id": "flaws_cloudtrail:0000505:bc2ec132-bb6d-4dce-9e86-d792ae158975", "row_index": 505, "timestamp": "2018-02-24T12:23:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc2ec132-bb6d-4dce-9e86-d792ae158975", "eventTime": "2018-02-24T12:23:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIdlJSanplTmVVejlvOFVCeHhaS2xnTmdrckducXRkTU5oY3pTcEx6ZGpMQVB6WE5sSFhueFIzM0gvWCs2ODhoVWdYdUcwTUYyd3l0N1RtbGxEVnBIMzFnbGdxM3VIUzl3dHM2OUJKQldGUEZQNVVyUW1ZbkhyMTRtdDdaQ2kydU5sdDVsSVMwSEovMzQzQm8ydWlnR0dhUFRUMXArNnArVXVQSldMN2N2SkFzeDQ5ODNJUmdhQ1dpWnluOSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b1874fe-83de-4439-a5f7-cacba9b326640", "record_id": "flaws_cloudtrail:0000506:5b1874fe-83de-4439-a5f7-cacba9b326640", "row_index": 506, "timestamp": "2018-02-24T12:23:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b1874fe-83de-4439-a5f7-cacba9b326640", "eventTime": "2018-02-24T12:23:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4UkFZSU1wL2xmTkVITWJpRURZZW54d2hHL2xJa1BnSVdYTDVyaFE4Rk5jeElvUHBlYjZwUG9SWVR6KzEzZEo3eE5TQmdjZDJvUEIrcWY5eDJOTjQ1SnJqM1BqNWFQSGNkS2FEQlo2UUl6T2VMNXIwN0w0blpWK2FXMjBXSWNjMGlMSUgycWlmMHhkRGp3UUx5b2tYc0Exa242MWllekRJenFIUyt4UGdlVlJyTDNZeDUwQS9ORHErLzg3UHJnYz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e91600c-9b70-4699-8191-d8edf816f266", "record_id": "flaws_cloudtrail:0000507:3e91600c-9b70-4699-8191-d8edf816f266", "row_index": 507, "timestamp": "2018-02-24T12:23:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e91600c-9b70-4699-8191-d8edf816f266", "eventTime": "2018-02-24T12:23:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmNDEwR3FrdHBLL1lRZmtLOTY2YU4zMVdBdGtBTi9JRmtqQ3BaK2pYMWx4U1pGOVgxdkJ3NDRhZFJBanhRS052cmYzSVFXUExDbk5qRXB5TDBxSVR3NGw4TEJVS0R0d3dNZXg0RndtcnR4R3RibGx4QmNrb3pzTnBoYzZWUGNBVWFzTXRyMHlSdkZLTlFDaDNlTWcvcDhjRHllMWJOd2V4MlRCZHNFVVhwOWpVYW9tRUFqVXhIWkJJNDVSQTNuOD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ee04e81-7879-4a67-8277-ad12c70e1f4a", "record_id": "flaws_cloudtrail:0000508:4ee04e81-7879-4a67-8277-ad12c70e1f4a", "row_index": 508, "timestamp": "2018-02-24T12:23:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ee04e81-7879-4a67-8277-ad12c70e1f4a", "eventTime": "2018-02-24T12:23:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCSEZsTE13TXh1b3BMQzQ3aHJiWU81TkYwYTJjNjRaMmhLalFscW5WZUNNRHQ5dUF3RElrSVUydUxFZmN3V0lZUlN3ZlVFc3FNc1Y4dEk3RHZld0VjRUNtYUxTZWFIMXZxV0Z3RFg3TUhXYWVLdi82R25VSVFYZjBXY3BMYlNxMWUyQ25uNC9BeG5IcXlocFdHL0RHNnAwQytjNlBHRVpmSEttVzRPVU9xTGcwMDBxN0V0VURQa2h4OWVZZUxwTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69b05c0d-2eec-4eca-b958-f9a4ee816265", "record_id": "flaws_cloudtrail:0000509:69b05c0d-2eec-4eca-b958-f9a4ee816265", "row_index": 509, "timestamp": "2018-02-24T12:23:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69b05c0d-2eec-4eca-b958-f9a4ee816265", "eventTime": "2018-02-24T12:23:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5T1djb29XUkVWbzZnN0xmRGRQUlIzTld6bXVmTTRmM0hyQVBQQkw4L1ZpQ1ZlUmlHck9uR3lpeFptenM1eGlRcGVmSS9ORStiU0FqY0xsWFNlcXlwR1J4U2tHeXdGazd1TVNJS0VNZVZIY3lBRXQxTjJUR0lZZGx3dmxVLzVsZEd2QVM4QWVxRW5MK2VmaGlyZGthUUFiYUFHR1dVT1VncW02UEVSV3M4MXh0eEZuZ0JTUjZwenF3aDBiSCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3431ad7a-ba2e-40e8-be31-68c86b4f3c61", "record_id": "flaws_cloudtrail:0000510:3431ad7a-ba2e-40e8-be31-68c86b4f3c61", "row_index": 510, "timestamp": "2018-02-24T12:23:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1064, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3431ad7a-ba2e-40e8-be31-68c86b4f3c61", "eventTime": "2018-02-24T12:23:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSR1hVRXNCUHovajNFcVhpbmxQelFUa014RFlvY3J3SFhkOFY2dTUvRStwTlo1YXJOSW9uV0hKUDMvYWhDeWpZK2czTU0yZTlERmR5MFFTZVpkTFpMS3Y3ZksycFdydEYrdTE2MStBaVJ4dmJhRnUwNGcwU3VodTh4bjc1TjlIK3ZOc2lxRHFMNWJLTEE4bkg2MExUWGorR0pZUHdsY0d4NzJFT2p5dEFLQzNLSXJid1RYRmVWRjhsUUlNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02148f58-5f0c-4ccd-94ae-787209a8f9c2", "record_id": "flaws_cloudtrail:0000511:02148f58-5f0c-4ccd-94ae-787209a8f9c2", "row_index": 511, "timestamp": "2018-02-24T12:23:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02148f58-5f0c-4ccd-94ae-787209a8f9c2", "eventTime": "2018-02-24T12:23:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2Yi9Ed0JOUmY0RHQ3R1dmVGxXOUptM2xIQUlvUnVVWEEzYmdlVmtjVGd4MU92WWJESGNzb3NBQjZjWElZT2pjQTJpaEs0YVRPam9sVjRHcnhHUkgxeSs1ODVmMVMwWjdkOU85dXI3U2RmY3F0cDM2RzVuQnB4QUVWTk9JRVUzS2tUUmlKOE9hQitPSStBbkZ3TWZuYXV3RWhBd043WWRzd0xtekVJalI0R0F6ZzYwPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ec307b8-872c-40c9-be85-dadefc9d4790", "record_id": "flaws_cloudtrail:0000512:7ec307b8-872c-40c9-be85-dadefc9d4790", "row_index": 512, "timestamp": "2018-02-24T12:23:45Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 672, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ec307b8-872c-40c9-be85-dadefc9d4790", "eventTime": "2018-02-24T12:23:45Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "116cbafb-736a-46a8-86f3-dbddae68060", "record_id": "flaws_cloudtrail:0000513:116cbafb-736a-46a8-86f3-dbddae68060", "row_index": 513, "timestamp": "2018-02-24T12:23:52Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "116cbafb-736a-46a8-86f3-dbddae68060", "eventTime": "2018-02-24T12:23:52Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "000aa6da-87ee-4509-8283-32fd30970d7", "record_id": "flaws_cloudtrail:0000514:000aa6da-87ee-4509-8283-32fd30970d7", "row_index": 514, "timestamp": "2018-02-24T12:24:06Z", "event_type": "GetCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 664, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "000aa6da-87ee-4509-8283-32fd30970d7", "eventTime": "2018-02-24T12:24:06Z", "eventName": "GetCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a011dd9-019f-4cac-8df5-e661c8f27d5e", "record_id": "flaws_cloudtrail:0000515:0a011dd9-019f-4cac-8df5-e661c8f27d5e", "row_index": 515, "timestamp": "2018-02-24T12:24:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a011dd9-019f-4cac-8df5-e661c8f27d5e", "eventTime": "2018-02-24T12:24:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b620dca7-a1ca-47cd-b03a-d5722c5b1fd5", "record_id": "flaws_cloudtrail:0000516:b620dca7-a1ca-47cd-b03a-d5722c5b1fd5", "row_index": 516, "timestamp": "2018-02-24T12:24:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b620dca7-a1ca-47cd-b03a-d5722c5b1fd5", "eventTime": "2018-02-24T12:24:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d8635d9-caef-4f9f-bf04-6342f9a251ea", "record_id": "flaws_cloudtrail:0000517:3d8635d9-caef-4f9f-bf04-6342f9a251ea", "row_index": 517, "timestamp": "2018-02-24T12:25:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d8635d9-caef-4f9f-bf04-6342f9a251ea", "eventTime": "2018-02-24T12:25:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "870349f5-bf00-4b2a-989c-ad55d797e924", "record_id": "flaws_cloudtrail:0000518:870349f5-bf00-4b2a-989c-ad55d797e924", "row_index": 518, "timestamp": "2018-02-24T12:25:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "870349f5-bf00-4b2a-989c-ad55d797e924", "eventTime": "2018-02-24T12:25:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fb48470-7e2e-4fa9-9e4d-c6b7b959f183", "record_id": "flaws_cloudtrail:0000519:2fb48470-7e2e-4fa9-9e4d-c6b7b959f183", "row_index": 519, "timestamp": "2018-02-24T12:25:43Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fb48470-7e2e-4fa9-9e4d-c6b7b959f183", "eventTime": "2018-02-24T12:25:43Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bdb238a-e5dd-44a6-bb6f-51609e53c219", "record_id": "flaws_cloudtrail:0000520:6bdb238a-e5dd-44a6-bb6f-51609e53c219", "row_index": 520, "timestamp": "2018-02-24T12:25:45Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 853, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bdb238a-e5dd-44a6-bb6f-51609e53c219", "eventTime": "2018-02-24T12:25:45Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.10 Darwin/15.6.0 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4126aa37-1d8b-4e9e-a887-dc2d71a47445", "record_id": "flaws_cloudtrail:0000521:4126aa37-1d8b-4e9e-a887-dc2d71a47445", "row_index": 521, "timestamp": "2018-02-24T12:26:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4126aa37-1d8b-4e9e-a887-dc2d71a47445", "eventTime": "2018-02-24T12:26:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5917d35b-7097-4fdd-85f5-342cdbe865185", "record_id": "flaws_cloudtrail:0000522:5917d35b-7097-4fdd-85f5-342cdbe865185", "row_index": 522, "timestamp": "2018-02-24T12:26:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5917d35b-7097-4fdd-85f5-342cdbe865185", "eventTime": "2018-02-24T12:26:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4238ba3-cee6-4dc1-9777-46b22ff198773", "record_id": "flaws_cloudtrail:0000523:f4238ba3-cee6-4dc1-9777-46b22ff198773", "row_index": 523, "timestamp": "2018-02-24T12:26:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4238ba3-cee6-4dc1-9777-46b22ff198773", "eventTime": "2018-02-24T12:26:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "363859a8-d394-4d0e-b6a4-9659b16e5886", "record_id": "flaws_cloudtrail:0000524:363859a8-d394-4d0e-b6a4-9659b16e5886", "row_index": 524, "timestamp": "2018-02-24T12:26:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "363859a8-d394-4d0e-b6a4-9659b16e5886", "eventTime": "2018-02-24T12:26:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "818813-52d5-426e-8633-65eac744a001", "record_id": "flaws_cloudtrail:0000525:818813-52d5-426e-8633-65eac744a001", "row_index": 525, "timestamp": "2018-02-24T12:26:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "818813-52d5-426e-8633-65eac744a001", "eventTime": "2018-02-24T12:26:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49a8f569-967a-4490-b37f-17dc00b47085", "record_id": "flaws_cloudtrail:0000526:49a8f569-967a-4490-b37f-17dc00b47085", "row_index": 526, "timestamp": "2018-02-24T12:27:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49a8f569-967a-4490-b37f-17dc00b47085", "eventTime": "2018-02-24T12:27:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.30 Python/2.7.14 Linux/4.13.0-32-generic botocore/1.8.34", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d275495d-4b39-4f5a-a055-dbe825c50440", "record_id": "flaws_cloudtrail:0000527:d275495d-4b39-4f5a-a055-dbe825c50440", "row_index": 527, "timestamp": "2018-02-24T12:27:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d275495d-4b39-4f5a-a055-dbe825c50440", "eventTime": "2018-02-24T12:27:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-6b045a4f"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25ae3dbe-c8af-4a55-95b2-79425fbc2f", "record_id": "flaws_cloudtrail:0000528:25ae3dbe-c8af-4a55-95b2-79425fbc2f", "row_index": 528, "timestamp": "2018-02-24T12:28:15Z", "event_type": "GetUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25ae3dbe-c8af-4a55-95b2-79425fbc2f", "eventTime": "2018-02-24T12:28:15Z", "eventName": "GetUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The user policy with name .+ cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": ".+", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9be786c2-7feb-44f0-a191-88745eb", "record_id": "flaws_cloudtrail:0000529:9be786c2-7feb-44f0-a191-88745eb", "row_index": 529, "timestamp": "2018-02-24T12:29:21Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9be786c2-7feb-44f0-a191-88745eb", "eventTime": "2018-02-24T12:29:21Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "367774b-1ddf-4d44-9f68-8c554c5482e9", "record_id": "flaws_cloudtrail:0000530:367774b-1ddf-4d44-9f68-8c554c5482e9", "row_index": 530, "timestamp": "2018-02-24T12:29:55Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "367774b-1ddf-4d44-9f68-8c554c5482e9", "eventTime": "2018-02-24T12:29:55Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09cc2475-b346-49fe-8656-25c1e5bdde5f", "record_id": "flaws_cloudtrail:0000531:09cc2475-b346-49fe-8656-25c1e5bdde5f", "row_index": 531, "timestamp": "2018-02-24T12:30:01Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09cc2475-b346-49fe-8656-25c1e5bdde5f", "eventTime": "2018-02-24T12:30:01Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/2.7.9 Windows/8 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "385ce957-20ca-4a96-94f8-c2087ceccd09", "record_id": "flaws_cloudtrail:0000532:385ce957-20ca-4a96-94f8-c2087ceccd09", "row_index": 532, "timestamp": "2018-02-24T12:30:12Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 682, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "385ce957-20ca-4a96-94f8-c2087ceccd09", "eventTime": "2018-02-24T12:30:12Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f14be9c-def5-4724-99fa-d5e98d8bd3e9", "record_id": "flaws_cloudtrail:0000533:2f14be9c-def5-4724-99fa-d5e98d8bd3e9", "row_index": 533, "timestamp": "2018-02-24T12:30:35Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f14be9c-def5-4724-99fa-d5e98d8bd3e9", "eventTime": "2018-02-24T12:30:35Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8b308c4-b660-44a1-b99d-033831963b39", "record_id": "flaws_cloudtrail:0000534:e8b308c4-b660-44a1-b99d-033831963b39", "row_index": 534, "timestamp": "2018-02-24T12:31:02Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8b308c4-b660-44a1-b99d-033831963b39", "eventTime": "2018-02-24T12:31:02Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c6639c1-6283-450f-a201-73e635f1be26", "record_id": "flaws_cloudtrail:0000535:2c6639c1-6283-450f-a201-73e635f1be26", "row_index": 535, "timestamp": "2018-02-24T12:31:15Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c6639c1-6283-450f-a201-73e635f1be26", "eventTime": "2018-02-24T12:31:15Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "errorCode": "Client.InvalidSnapshot.NotFound", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-6b045a4f", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61ca7a55-9e8c-4e68-a0ee-5e89a7f17ea5", "record_id": "flaws_cloudtrail:0000536:61ca7a55-9e8c-4e68-a0ee-5e89a7f17ea5", "row_index": 536, "timestamp": "2018-02-24T12:31:59Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61ca7a55-9e8c-4e68-a0ee-5e89a7f17ea5", "eventTime": "2018-02-24T12:31:59Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "errorCode": "Client.InvalidSnapshot.NotFound", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-b92ef983", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0246a70d-84a0-4397-825b-3475101748b9", "record_id": "flaws_cloudtrail:0000537:0246a70d-84a0-4397-825b-3475101748b9", "row_index": 537, "timestamp": "2018-02-24T12:32:02Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1004, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0246a70d-84a0-4397-825b-3475101748b9", "eventTime": "2018-02-24T12:32:02Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d9d098f9-1068-45e0-8fc9-5d6db41e3f5c", "record_id": "flaws_cloudtrail:0000538:d9d098f9-1068-45e0-8fc9-5d6db41e3f5c", "row_index": 538, "timestamp": "2018-02-24T12:32:04Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 672, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d9d098f9-1068-45e0-8fc9-5d6db41e3f5c", "eventTime": "2018-02-24T12:32:04Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "36b419a9-fcc1-43f0-97ac-55f581ccb9e4", "record_id": "flaws_cloudtrail:0000539:36b419a9-fcc1-43f0-97ac-55f581ccb9e4", "row_index": 539, "timestamp": "2018-02-24T12:32:15Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "36b419a9-fcc1-43f0-97ac-55f581ccb9e4", "eventTime": "2018-02-24T12:32:15Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "979609f0a-4708-4850-8948-920acf5cd5f4", "record_id": "flaws_cloudtrail:0000540:979609f0a-4708-4850-8948-920acf5cd5f4", "row_index": 540, "timestamp": "2018-02-24T12:32:35Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "979609f0a-4708-4850-8948-920acf5cd5f4", "eventTime": "2018-02-24T12:32:35Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b899790-334e-433d-946e-0b131f4ca65b", "record_id": "flaws_cloudtrail:0000541:4b899790-334e-433d-946e-0b131f4ca65b", "row_index": 541, "timestamp": "2018-02-24T12:33:06Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b899790-334e-433d-946e-0b131f4ca65b", "eventTime": "2018-02-24T12:33:06Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5a2f3d9-b389-4c36-8399-d42505f537", "record_id": "flaws_cloudtrail:0000542:f5a2f3d9-b389-4c36-8399-d42505f537", "row_index": 542, "timestamp": "2018-02-24T12:33:11Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 638, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5a2f3d9-b389-4c36-8399-d42505f537", "eventTime": "2018-02-24T12:33:11Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad4296c0-09a7-4eb9-939a-b699c7c58c1a", "record_id": "flaws_cloudtrail:0000543:ad4296c0-09a7-4eb9-939a-b699c7c58c1a", "row_index": 543, "timestamp": "2018-02-24T12:33:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad4296c0-09a7-4eb9-939a-b699c7c58c1a", "eventTime": "2018-02-24T12:33:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d43d9837-ed36-44ed-97bb-09948906a318", "record_id": "flaws_cloudtrail:0000544:d43d9837-ed36-44ed-97bb-09948906a318", "row_index": 544, "timestamp": "2018-02-24T12:34:22Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d43d9837-ed36-44ed-97bb-09948906a318", "eventTime": "2018-02-24T12:34:22Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79e572533-6d61-4bbf-b19b-a0c8a2f15310", "record_id": "flaws_cloudtrail:0000545:79e572533-6d61-4bbf-b19b-a0c8a2f15310", "row_index": 545, "timestamp": "2018-02-24T12:34:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79e572533-6d61-4bbf-b19b-a0c8a2f15310", "eventTime": "2018-02-24T12:34:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d84fa0d-c2c8-4d71-8344-1bc47a4f47b2", "record_id": "flaws_cloudtrail:0000546:9d84fa0d-c2c8-4d71-8344-1bc47a4f47b2", "row_index": 546, "timestamp": "2018-02-24T12:34:41Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d84fa0d-c2c8-4d71-8344-1bc47a4f47b2", "eventTime": "2018-02-24T12:34:41Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abcad4de-202a-4aff-949a-ccc942f94a3a", "record_id": "flaws_cloudtrail:0000547:abcad4de-202a-4aff-949a-ccc942f94a3a", "row_index": 547, "timestamp": "2018-02-24T12:34:48Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abcad4de-202a-4aff-949a-ccc942f94a3a", "eventTime": "2018-02-24T12:34:48Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84258c82-803e-4ec9-a1ad-634886ae25a8", "record_id": "flaws_cloudtrail:0000548:84258c82-803e-4ec9-a1ad-634886ae25a8", "row_index": 548, "timestamp": "2018-02-24T12:34:59Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84258c82-803e-4ec9-a1ad-634886ae25a8", "eventTime": "2018-02-24T12:34:59Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c6180a5-4da6-45c9-b3e2-ef3e86e1f326", "record_id": "flaws_cloudtrail:0000549:8c6180a5-4da6-45c9-b3e2-ef3e86e1f326", "row_index": 549, "timestamp": "2018-02-24T12:35:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1003, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c6180a5-4da6-45c9-b3e2-ef3e86e1f326", "eventTime": "2018-02-24T12:35:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fef6c6d3-0bf9-465e-a092-e829f642f3f0", "record_id": "flaws_cloudtrail:0000550:fef6c6d3-0bf9-465e-a092-e829f642f3f0", "row_index": 550, "timestamp": "2018-02-24T12:35:31Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fef6c6d3-0bf9-465e-a092-e829f642f3f0", "eventTime": "2018-02-24T12:35:31Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e453df6a-57fa-4c3d-8f3e-dd921bbc1c6f", "record_id": "flaws_cloudtrail:0000551:e453df6a-57fa-4c3d-8f3e-dd921bbc1c6f", "row_index": 551, "timestamp": "2018-02-24T12:35:56Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e453df6a-57fa-4c3d-8f3e-dd921bbc1c6f", "eventTime": "2018-02-24T12:35:56Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "045899e0-9263-4560-994e-0817c56a4593", "record_id": "flaws_cloudtrail:0000552:045899e0-9263-4560-994e-0817c56a4593", "row_index": 552, "timestamp": "2018-02-24T12:36:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1477, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "045899e0-9263-4560-994e-0817c56a4593", "eventTime": "2018-02-24T12:36:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5S1CU3T68LTSXE6V", "expiration": "Feb 24, 2018 6:47:37 PM", "sessionToken": "FQoDYXdzEHYaDKV7n45Rz/ZCvZgzLyK3A66qe6sm2ksDPg8KpbMiGXUiDgX9zCMyIFXaRp/f2czc/3UgRThdUxD+W+UY+PtfELsWN7mWHM89lAIrRc0sJ1r4taGTsVB3rebP2ySiNZjw7+kboT9s97LzX68xgh7sVaKuxAHk46YFnQ8rclwr1f2q+LAZsCp13IvyES1GsHKoDBSt6URON8dfbpPbZgZM70+t6u/Hccy6ZUHOWQNOwPXiOL9Ib44ZEGKRLKmoEjfahT7r4iWIY3/d0zl0duNeHDfKWcs8BDr7xfWR0zLCw5e7doAhrvVvTn8XWCsMeAP58yiLEZbeyauVhGcavu7InX7hAfeEoNPp+n51tQkACr7d0qESQKhlCnXmh/RVGXte3lqIrgcpgwWaQcQoFJLAgZqoFEu5Bj96CUbyIuCL6n2Y/qnHfMqHJ9GLzrgjXRpks7Yw2vHo41WVDcvz625/sFNWdUXklfvKDj6JjK6k4KkTarHP4/Cry6AbeCgAAn//0gzCLh3pADhOxUOVJZ8oAb0vf3wbNuLRowIGAyFRpJeLSotAp+1L3+yqaCOskUhXOWe61zuffDsGVkOcieJTFOfnAYI/dDMovbjF1AU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82f4d1ca-b14b-4d54-b8a9-129e1cb2afb0", "record_id": "flaws_cloudtrail:0000553:82f4d1ca-b14b-4d54-b8a9-129e1cb2afb0", "row_index": 553, "timestamp": "2018-02-24T12:38:10Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 653, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82f4d1ca-b14b-4d54-b8a9-129e1cb2afb0", "eventTime": "2018-02-24T12:38:10Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cca81b42-0781-41f4-8769-0bd9d5aea729", "record_id": "flaws_cloudtrail:0000554:cca81b42-0781-41f4-8769-0bd9d5aea729", "row_index": 554, "timestamp": "2018-02-24T12:38:21Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA5S1CU3T68LTSXE6V", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 995, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cca81b42-0781-41f4-8769-0bd9d5aea729", "eventTime": "2018-02-24T12:38:21Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA5S1CU3T68LTSXE6V", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T12:36:13Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85176f6-25ca-4f14-9201-2a5b133389", "record_id": "flaws_cloudtrail:0000555:85176f6-25ca-4f14-9201-2a5b133389", "row_index": 555, "timestamp": "2018-02-24T12:38:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85176f6-25ca-4f14-9201-2a5b133389", "eventTime": "2018-02-24T12:38:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d2df7b2-95a4-4649-865f-8c96988161f8", "record_id": "flaws_cloudtrail:0000556:7d2df7b2-95a4-4649-865f-8c96988161f8", "row_index": 556, "timestamp": "2018-02-24T12:38:33Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 852, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d2df7b2-95a4-4649-865f-8c96988161f8", "eventTime": "2018-02-24T12:38:33Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61356b-309b-4206-8b83-965d172d26c6", "record_id": "flaws_cloudtrail:0000557:61356b-309b-4206-8b83-965d172d26c6", "row_index": 557, "timestamp": "2018-02-24T12:38:43Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "254.4.35.246", "user_agent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1508, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61356b-309b-4206-8b83-965d172d26c6", "eventTime": "2018-02-24T12:38:43Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.4.35.246", "userAgent": "aws-cli/1.14.9 Python/2.7.12 Linux/4.9.76-3.78.amzn1.x86_64 botocore/1.8.13", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: IhpSZumyedhXRbWFjpAQO_3sWvwKG2ljf2oks-dn52ipSDK7loNZv_EuKVtgQwYqPdTKDjQ_V2RDDk9vD4i22Sxa_xTDzj-ibv_cga7OrMfBNqfeisf3B_9Kd8_cHk0D2Rh4NG2Ga__YQRafmY9gIMkGHDTHckUM92MUaHZIi5KlwnsYwIXNL-e_850A82xuZ9IxAn1-xe1ApTHuhwmApZKE5gaV7R9co-1uVgC0fYpVClNPtpTsjlAdLLnnD3CPVpwT-Yp-SWfJwD6upulDqQ0NVoRLfNpQ2lyXzY1VkvaxxUAg19_lABUUhTBGpSFunk9IV2MSN9a5h6rbc_32Fl5bw0Vkc6nk0bKMY9QKV15q8W6RTEonxwr_dCNDK8AJy0beX4vggpN9IjEuCqFH87ekfEZl-QkKdNni0O28Cy2t5hmCLPk1PGdO1YCXZWznlEV78YbeyxyjV5lFFDRpxdppck6k7wwpZFyCTZYJ2blo_cEg_bd9pAtYwkonqU1rnEXa_j0U5-JTebo46NOiVQCkwO5vu-gfnUgJ8ip3_t1SUzw3ayJmDdupjs9AwbtEkhPUzr0i_YSF_81hU5YowSssAJrKFaTTtO-lrkx8LChCIYleMk4ZImbt0hnh", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75a3c075-10af-406d-ad62-0c9240a36dc4", "record_id": "flaws_cloudtrail:0000558:75a3c075-10af-406d-ad62-0c9240a36dc4", "row_index": 558, "timestamp": "2018-02-24T12:39:02Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 662, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75a3c075-10af-406d-ad62-0c9240a36dc4", "eventTime": "2018-02-24T12:39:02Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5705bd3b-20d3-4db3-a0c5-e60e7af8003b", "record_id": "flaws_cloudtrail:0000559:5705bd3b-20d3-4db3-a0c5-e60e7af8003b", "row_index": 559, "timestamp": "2018-02-24T12:39:14Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 659, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5705bd3b-20d3-4db3-a0c5-e60e7af8003b", "eventTime": "2018-02-24T12:39:14Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5fea0c5c-a59c-4794-a728-2c4e0d462c28", "record_id": "flaws_cloudtrail:0000560:5fea0c5c-a59c-4794-a728-2c4e0d462c28", "row_index": 560, "timestamp": "2018-02-24T12:39:27Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5fea0c5c-a59c-4794-a728-2c4e0d462c28", "eventTime": "2018-02-24T12:39:27Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AB818vrIEwdWMqbjvWxeZog4BetnlQ5V1lAC0ebbhuU5kyqIyetFrnul4KrX+/pgent4R4q5OB8AWb2QEIG+1Rx+Kj8dAjdFyPRrPYbRpdZWHA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ebee54f7-b7b9-405e-a640-f6311a0cc1f6", "record_id": "flaws_cloudtrail:0000561:ebee54f7-b7b9-405e-a640-f6311a0cc1f6", "row_index": 561, "timestamp": "2018-02-24T12:39:27Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ebee54f7-b7b9-405e-a640-f6311a0cc1f6", "eventTime": "2018-02-24T12:39:27Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAuZuyrDwl0Awin9zVOZDPO+3M1iDWu1sMBRw1uqCsHi19bypkjtop3oSrptjvvAeIWzJ5n4hE5bqzoqDwckgPsdV3jIRZDS6byM02q7EJQcpw==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d90264a-b3f9-4f58-aa36-d37e58a8a192", "record_id": "flaws_cloudtrail:0000562:2d90264a-b3f9-4f58-aa36-d37e58a8a192", "row_index": 562, "timestamp": "2018-02-24T12:39:27Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 677, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d90264a-b3f9-4f58-aa36-d37e58a8a192", "eventTime": "2018-02-24T12:39:27Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "810c0c7a-8217-4275-b4b0-d3aeed94fdc1", "record_id": "flaws_cloudtrail:0000563:810c0c7a-8217-4275-b4b0-d3aeed94fdc1", "row_index": 563, "timestamp": "2018-02-24T12:39:27Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "810c0c7a-8217-4275-b4b0-d3aeed94fdc1", "eventTime": "2018-02-24T12:39:27Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABfu6OCxEQV5SqQrFIry+77AZn3oENqMPE+0I7FydMrZKs+RQohPLhXo9fQguXecYPMCaai4SS5Zy98tv22S8t5H+K5jt7IuUbQAVQ1xw+ZwYQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "884b2f5c-239b-415b-a40e-0f52fafdd355", "record_id": "flaws_cloudtrail:0000564:884b2f5c-239b-415b-a40e-0f52fafdd355", "row_index": 564, "timestamp": "2018-02-24T12:40:39Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "87.178.2.60", "user_agent": "[aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 989, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "884b2f5c-239b-415b-a40e-0f52fafdd355", "eventTime": "2018-02-24T12:40:39Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "[aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d50fb256-cd24-4f1a-a5be-d9759360af51", "record_id": "flaws_cloudtrail:0000565:d50fb256-cd24-4f1a-a5be-d9759360af51", "row_index": 565, "timestamp": "2018-02-24T12:40:40Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d50fb256-cd24-4f1a-a5be-d9759360af51", "eventTime": "2018-02-24T12:40:40Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6011d3e8-fecd-4671-b379-a043414f644aa", "record_id": "flaws_cloudtrail:0000566:6011d3e8-fecd-4671-b379-a043414f644aa", "row_index": 566, "timestamp": "2018-02-24T12:40:41Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6011d3e8-fecd-4671-b379-a043414f644aa", "eventTime": "2018-02-24T12:40:41Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABUJs/ZHjLfbNHSSAUOV9lVqE0AL7mZzBrNhR+NCogMt7iccQD6o8sTRrnjCcCohjeJiNhvvq7FQIy+sHL1Vl4pY8hmZZEcotrkfIZ6b2DqJPA==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d9d7206-e328-4ead-bc0f-ef820d44c35e", "record_id": "flaws_cloudtrail:0000567:8d9d7206-e328-4ead-bc0f-ef820d44c35e", "row_index": 567, "timestamp": "2018-02-24T12:40:41Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d9d7206-e328-4ead-bc0f-ef820d44c35e", "eventTime": "2018-02-24T12:40:41Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABQcKg05fCQt1eEdRcswEXdmrYEKR8FN+KYPwLSQEc3OvkztI/fg5X1PAEAQkZvbI5ui1Dw6g8JNyUilvEkBIpyNeZGFr+HkNPxxIw+PXGBYTQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e7c3401-95fb-4abf-b254-c670b36f07ce", "record_id": "flaws_cloudtrail:0000568:3e7c3401-95fb-4abf-b254-c670b36f07ce", "row_index": 568, "timestamp": "2018-02-24T12:40:41Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e7c3401-95fb-4abf-b254-c670b36f07ce", "eventTime": "2018-02-24T12:40:41Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AAZZEG7hzpR87TDchJqx93Gb6mZz81UjnQ//mhFyQrYIjVfoY3/mDnWilf6sw0j9lcSnLJCLr32zSyifmZR5qfSsf7DImJkLmE7s5aHmuFU4bQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e291e2f-3892-4a8e-b180-083db7b809fd", "record_id": "flaws_cloudtrail:0000569:8e291e2f-3892-4a8e-b180-083db7b809fd", "row_index": 569, "timestamp": "2018-02-24T12:40:41Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 852, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e291e2f-3892-4a8e-b180-083db7b809fd", "eventTime": "2018-02-24T12:40:41Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa11abf5-5db3-4582-827b-b7c0d04f6cec", "record_id": "flaws_cloudtrail:0000570:aa11abf5-5db3-4582-827b-b7c0d04f6cec", "row_index": 570, "timestamp": "2018-02-24T12:41:37Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 852, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa11abf5-5db3-4582-827b-b7c0d04f6cec", "eventTime": "2018-02-24T12:41:37Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "148b0e82-09cf-4a61-a72e-223c48d576a6", "record_id": "flaws_cloudtrail:0000571:148b0e82-09cf-4a61-a72e-223c48d576a6", "row_index": 571, "timestamp": "2018-02-24T12:42:04Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 654, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "148b0e82-09cf-4a61-a72e-223c48d576a6", "eventTime": "2018-02-24T12:42:04Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "041dac8f-ff4c-4a22-86d1-84943ff5b0", "record_id": "flaws_cloudtrail:0000572:041dac8f-ff4c-4a22-86d1-84943ff5b0", "row_index": 572, "timestamp": "2018-02-24T12:42:30Z", "event_type": "AttachUserPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "041dac8f-ff4c-4a22-86d1-84943ff5b0", "eventTime": "2018-02-24T12:42:30Z", "eventName": "AttachUserPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: iam:AttachUserPolicy on resource: user Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d73fef89-7d6d-4fcb-896d-23e91db9cc89", "record_id": "flaws_cloudtrail:0000573:d73fef89-7d6d-4fcb-896d-23e91db9cc89", "row_index": 573, "timestamp": "2018-02-24T12:42:41Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 851, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d73fef89-7d6d-4fcb-896d-23e91db9cc89", "eventTime": "2018-02-24T12:42:41Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "397c6112-ffde-4bae-9e7b-0d2c090699ac", "record_id": "flaws_cloudtrail:0000574:397c6112-ffde-4bae-9e7b-0d2c090699ac", "row_index": 574, "timestamp": "2018-02-24T12:42:57Z", "event_type": "CreateUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "397c6112-ffde-4bae-9e7b-0d2c090699ac", "eventTime": "2018-02-24T12:42:57Z", "eventName": "CreateUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: iam:CreateUser on resource: arn:aws:iam::811596193553:user/jerchen", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63f73666-e1fb-48bc-a294-a7f2a000d208", "record_id": "flaws_cloudtrail:0000575:63f73666-e1fb-48bc-a294-a7f2a000d208", "row_index": 575, "timestamp": "2018-02-24T12:43:36Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63f73666-e1fb-48bc-a294-a7f2a000d208", "eventTime": "2018-02-24T12:43:36Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "792435b35-2def-4e48-aec4-e1d10d896feb", "record_id": "flaws_cloudtrail:0000576:792435b35-2def-4e48-aec4-e1d10d896feb", "row_index": 576, "timestamp": "2018-02-24T12:43:53Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA6DSAQZZBN39NI9RT", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "87.178.2.60", "user_agent": "[aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 990, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "792435b35-2def-4e48-aec4-e1d10d896feb", "eventTime": "2018-02-24T12:43:53Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "87.178.2.60", "userAgent": "[aws-cli/1.14.30 Python/3.6.4 Darwin/17.4.0 botocore/1.8.34]", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA6DSAQZZBN39NI9RT", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-02-24T11:35:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3847c75-7a2e-43e2-86c6-156829a7e6558", "record_id": "flaws_cloudtrail:0000577:c3847c75-7a2e-43e2-86c6-156829a7e6558", "row_index": 577, "timestamp": "2018-02-24T12:44:13Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 658, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3847c75-7a2e-43e2-86c6-156829a7e6558", "eventTime": "2018-02-24T12:44:13Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d08955-98b1-44b1-ba66-a712e2c671c4", "record_id": "flaws_cloudtrail:0000578:d08955-98b1-44b1-ba66-a712e2c671c4", "row_index": 578, "timestamp": "2018-02-24T12:44:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d08955-98b1-44b1-ba66-a712e2c671c4", "eventTime": "2018-02-24T12:44:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e701edb-cb98-4cad-afa9-63898aa1aab", "record_id": "flaws_cloudtrail:0000579:8e701edb-cb98-4cad-afa9-63898aa1aab", "row_index": 579, "timestamp": "2018-02-24T12:45:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e701edb-cb98-4cad-afa9-63898aa1aab", "eventTime": "2018-02-24T12:45:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b00e16ee-63f6-472a-9d80-efbe70a3661f", "record_id": "flaws_cloudtrail:0000580:b00e16ee-63f6-472a-9d80-efbe70a3661f", "row_index": 580, "timestamp": "2018-02-24T12:45:30Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b00e16ee-63f6-472a-9d80-efbe70a3661f", "eventTime": "2018-02-24T12:45:30Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c10c86e7-7bc4-4ca1-a4e3-5d159ec47f9c", "record_id": "flaws_cloudtrail:0000581:c10c86e7-7bc4-4ca1-a4e3-5d159ec47f9c", "row_index": 581, "timestamp": "2018-02-24T12:46:03Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 640, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c10c86e7-7bc4-4ca1-a4e3-5d159ec47f9c", "eventTime": "2018-02-24T12:46:03Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aabb684e-e2d6-4569-a9e6-cfaffafeed97", "record_id": "flaws_cloudtrail:0000582:aabb684e-e2d6-4569-a9e6-cfaffafeed97", "row_index": 582, "timestamp": "2018-02-24T12:46:12Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 851, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aabb684e-e2d6-4569-a9e6-cfaffafeed97", "eventTime": "2018-02-24T12:46:12Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91bc9de6-3bea-4b39-a8d5-d4518d7c1b67", "record_id": "flaws_cloudtrail:0000583:91bc9de6-3bea-4b39-a8d5-d4518d7c1b67", "row_index": 583, "timestamp": "2018-02-24T12:46:14Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 660, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91bc9de6-3bea-4b39-a8d5-d4518d7c1b67", "eventTime": "2018-02-24T12:46:14Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "88ab5c25-ad4e-4afa-bf9a-13371c3744f6", "record_id": "flaws_cloudtrail:0000584:88ab5c25-ad4e-4afa-bf9a-13371c3744f6", "row_index": 584, "timestamp": "2018-02-24T12:46:24Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "88ab5c25-ad4e-4afa-bf9a-13371c3744f6", "eventTime": "2018-02-24T12:46:24Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "522ced78-fdcc-420e-8e49-c3438a48bce1", "record_id": "flaws_cloudtrail:0000585:522ced78-fdcc-420e-8e49-c3438a48bce1", "row_index": 585, "timestamp": "2018-02-24T12:46:28Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.11.170 Python/2.7.10 Darwin/17.4.0 botocore/1.7.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "522ced78-fdcc-420e-8e49-c3438a48bce1", "eventTime": "2018-02-24T12:46:28Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.11.170 Python/2.7.10 Darwin/17.4.0 botocore/1.7.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c85827-9fe1-433f-a463-267eccd8a335", "record_id": "flaws_cloudtrail:0000586:c85827-9fe1-433f-a463-267eccd8a335", "row_index": 586, "timestamp": "2018-02-24T12:46:37Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 668, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c85827-9fe1-433f-a463-267eccd8a335", "eventTime": "2018-02-24T12:46:37Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5dbfd6e0-9d2f-4bac-91ed-5747192a5d79", "record_id": "flaws_cloudtrail:0000587:5dbfd6e0-9d2f-4bac-91ed-5747192a5d79", "row_index": 587, "timestamp": "2018-02-24T12:46:42Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5dbfd6e0-9d2f-4bac-91ed-5747192a5d79", "eventTime": "2018-02-24T12:46:42Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41f3781e-3001-4a5f-ac40-a953382e81", "record_id": "flaws_cloudtrail:0000588:41f3781e-3001-4a5f-ac40-a953382e81", "row_index": 588, "timestamp": "2018-02-24T12:46:55Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "[aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 644, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41f3781e-3001-4a5f-ac40-a953382e81", "eventTime": "2018-02-24T12:46:55Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "[aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b333233-b3cc-4e8b-ba59-d66bf3764b1a", "record_id": "flaws_cloudtrail:0000589:5b333233-b3cc-4e8b-ba59-d66bf3764b1a", "row_index": 589, "timestamp": "2018-02-24T12:47:01Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b333233-b3cc-4e8b-ba59-d66bf3764b1a", "eventTime": "2018-02-24T12:47:01Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "053958da-5e88-489f-932d-0ff546a44d3d", "record_id": "flaws_cloudtrail:0000590:053958da-5e88-489f-932d-0ff546a44d3d", "row_index": 590, "timestamp": "2018-02-24T12:47:04Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "053958da-5e88-489f-932d-0ff546a44d3d", "eventTime": "2018-02-24T12:47:04Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "User Level5 does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level5"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30b6eba7-8681-4a2c-951c-4eb3225a6ec3", "record_id": "flaws_cloudtrail:0000591:30b6eba7-8681-4a2c-951c-4eb3225a6ec3", "row_index": 591, "timestamp": "2018-02-24T12:47:07Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30b6eba7-8681-4a2c-951c-4eb3225a6ec3", "eventTime": "2018-02-24T12:47:07Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47ea50d0-b522-4eca-bd84-8108a529680", "record_id": "flaws_cloudtrail:0000592:47ea50d0-b522-4eca-bd84-8108a529680", "row_index": 592, "timestamp": "2018-02-24T12:47:50Z", "event_type": "GetFunction202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 873, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47ea50d0-b522-4eca-bd84-8108a529680", "eventTime": "2018-02-24T12:47:50Z", "eventName": "GetFunction202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunction on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aaad01a3-80ca-4f48-91e8-9d86e690180", "record_id": "flaws_cloudtrail:0000593:aaad01a3-80ca-4f48-91e8-9d86e690180", "row_index": 593, "timestamp": "2018-02-24T12:47:57Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aaad01a3-80ca-4f48-91e8-9d86e690180", "eventTime": "2018-02-24T12:47:57Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b042e67-33f2-41cd-8c1d-801f08444117", "record_id": "flaws_cloudtrail:0000594:9b042e67-33f2-41cd-8c1d-801f08444117", "row_index": 594, "timestamp": "2018-02-24T12:48:10Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b042e67-33f2-41cd-8c1d-801f08444117", "eventTime": "2018-02-24T12:48:10Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4059ca92-1046-4b7e-889d-a15ec8e7d0fa", "record_id": "flaws_cloudtrail:0000595:4059ca92-1046-4b7e-889d-a15ec8e7d0fa", "row_index": 595, "timestamp": "2018-02-24T12:48:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 654, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4059ca92-1046-4b7e-889d-a15ec8e7d0fa", "eventTime": "2018-02-24T12:48:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "[aws-cli/1.14.38 Python/3.6.4 Linux/4.12.14-1-MANJARO botocore/1.8.42]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "252cdfa3-0eb7-4571-ab2f-58c8039548ab", "record_id": "flaws_cloudtrail:0000596:252cdfa3-0eb7-4571-ab2f-58c8039548ab", "row_index": 596, "timestamp": "2018-02-24T12:48:31Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "252cdfa3-0eb7-4571-ab2f-58c8039548ab", "eventTime": "2018-02-24T12:48:31Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4fd3c63-64ac-4680-967b-1a4fcbe78fbf", "record_id": "flaws_cloudtrail:0000597:f4fd3c63-64ac-4680-967b-1a4fcbe78fbf", "row_index": 597, "timestamp": "2018-02-24T12:48:41Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4fd3c63-64ac-4680-967b-1a4fcbe78fbf", "eventTime": "2018-02-24T12:48:41Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f0335d6-9fe4-4010-9b43-c2a82f167c4a", "record_id": "flaws_cloudtrail:0000598:5f0335d6-9fe4-4010-9b43-c2a82f167c4a", "row_index": 598, "timestamp": "2018-02-24T12:49:08Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f0335d6-9fe4-4010-9b43-c2a82f167c4a", "eventTime": "2018-02-24T12:49:08Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ff23c6e-625d-40cb-9033-c8f9e0b96f72", "record_id": "flaws_cloudtrail:0000599:7ff23c6e-625d-40cb-9033-c8f9e0b96f72", "row_index": 599, "timestamp": "2018-02-24T12:49:42Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 852, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ff23c6e-625d-40cb-9033-c8f9e0b96f72", "eventTime": "2018-02-24T12:49:42Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: apigateway:GET on resource: arn:aws:apigateway:us-west-2::/restapis", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5359b086-f55d-4346-8102-c7858b86a12d", "record_id": "flaws_cloudtrail:0000600:5359b086-f55d-4346-8102-c7858b86a12d", "row_index": 600, "timestamp": "2018-02-24T12:49:47Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5359b086-f55d-4346-8102-c7858b86a12d", "eventTime": "2018-02-24T12:49:47Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.44 Python/3.6.4 Linux/4.15.3-2-zen botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e028ad2-f77f-46b1-9f25-f1ecddd0f8ed", "record_id": "flaws_cloudtrail:0000601:3e028ad2-f77f-46b1-9f25-f1ecddd0f8ed", "row_index": 601, "timestamp": "2018-02-24T12:49:49Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e028ad2-f77f-46b1-9f25-f1ecddd0f8ed", "eventTime": "2018-02-24T12:49:49Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "189d081c-16f2-452f-9cc7-67af84ba6a54", "record_id": "flaws_cloudtrail:0000602:189d081c-16f2-452f-9cc7-67af84ba6a54", "row_index": 602, "timestamp": "2018-02-24T12:49:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 855, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "189d081c-16f2-452f-9cc7-67af84ba6a54", "eventTime": "2018-02-24T12:49:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/service-role/Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03354-d2e0-437b-b7a0-137a0bcf51af", "record_id": "flaws_cloudtrail:0000603:03354-d2e0-437b-b7a0-137a0bcf51af", "row_index": 603, "timestamp": "2018-02-24T12:50:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03354-d2e0-437b-b7a0-137a0bcf51af", "eventTime": "2018-02-24T12:50:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Linux/4.15.5-1-ARCH botocore/1.8.50", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd6a04d2-0073-419e-aa88-fd9f5c14eb03", "record_id": "flaws_cloudtrail:0000604:dd6a04d2-0073-419e-aa88-fd9f5c14eb03", "row_index": 604, "timestamp": "2018-02-24T12:50:23Z", "event_type": "GetFunctionConfiguration202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 900, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd6a04d2-0073-419e-aa88-fd9f5c14eb03", "eventTime": "2018-02-24T12:50:23Z", "eventName": "GetFunctionConfiguration202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: lambda:GetFunctionConfiguration on resource: arn:aws:lambda:us-west-2:811596193553:function:Level6", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94ca326e-daec-458d-924b-757a6632d980", "record_id": "flaws_cloudtrail:0000605:94ca326e-daec-458d-924b-757a6632d980", "row_index": 605, "timestamp": "2018-02-24T12:50:40Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94ca326e-daec-458d-924b-757a6632d980", "eventTime": "2018-02-24T12:50:40Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79f137d3-c586-4eb0-a695-4f9b32dc1436", "record_id": "flaws_cloudtrail:0000606:79f137d3-c586-4eb0-a695-4f9b32dc1436", "row_index": 606, "timestamp": "2018-02-24T12:50:45Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79f137d3-c586-4eb0-a695-4f9b32dc1436", "eventTime": "2018-02-24T12:50:45Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b94f23d7-46d3-4077-a95a-f1d4b2cccb69", "record_id": "flaws_cloudtrail:0000607:b94f23d7-46d3-4077-a95a-f1d4b2cccb69", "row_index": 607, "timestamp": "2018-02-24T12:51:05Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b94f23d7-46d3-4077-a95a-f1d4b2cccb69", "eventTime": "2018-02-24T12:51:05Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d0ff56f-c465-400b-8513-b96d92b078434", "record_id": "flaws_cloudtrail:0000608:8d0ff56f-c465-400b-8513-b96d92b078434", "row_index": 608, "timestamp": "2018-02-24T12:51:13Z", "event_type": "GetRestApi", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d0ff56f-c465-400b-8513-b96d92b078434", "eventTime": "2018-02-24T12:51:13Z", "eventName": "GetRestApi", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.24 Python/3.6.4 Darwin/17.4.0 botocore/1.8.28", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9d825ec-952f-4f3b-a2a3-fd8e1a5d253d", "record_id": "flaws_cloudtrail:0000609:a9d825ec-952f-4f3b-a2a3-fd8e1a5d253d", "row_index": 609, "timestamp": "2018-02-24T12:51:15Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "79.43.2.31", "user_agent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9d825ec-952f-4f3b-a2a3-fd8e1a5d253d", "eventTime": "2018-02-24T12:51:15Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "79.43.2.31", "userAgent": "aws-cli/1.14.40 Python/3.6.4 Darwin/16.7.0 botocore/1.8.44", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "917411a16-552e-4009-a718-9e40e460effc", "record_id": "flaws_cloudtrail:0000610:917411a16-552e-4009-a718-9e40e460effc", "row_index": 610, "timestamp": "2018-02-24T12:51:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "245.181.7.4", "user_agent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 851, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "917411a16-552e-4009-a718-9e40e460effc", "eventTime": "2018-02-24T12:51:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "245.181.7.4", "userAgent": "aws-cli/1.14.46 Python/3.6.4 Darwin/17.4.0 botocore/1.8.50", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/Level6 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::811596193553:role/SecurityMonkey", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc016e86-85fd-4dc3-aecf-0121f13cdfc9", "record_id": "flaws_cloudtrail:0000611:bc016e86-85fd-4dc3-aecf-0121f13cdfc9", "row_index": 611, "timestamp": "2018-02-24T12:52:02Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "191.253.250.239", "user_agent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 670, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc016e86-85fd-4dc3-aecf-0121f13cdfc9", "eventTime": "2018-02-24T12:52:02Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "191.253.250.239", "userAgent": "aws-cli/1.14.32 Python/3.6.4 Linux/4.9.79-1-MANJARO botocore/1.8.36", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}