Task: attack_reconstruction (flaws_cloudtrail)
Prompt: An IAM credential appears to have been reused from an unfamiliar client, with a brief identity check followed by broad account discovery and a privileged change. Identify the responsible principal, the MITRE ATT&CK technique that best fits the activity, the supporting CloudTrail record_ids for each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21914a-970c-41f8-b932-32bbefa2c86b", "record_id": "flaws_cloudtrail:0000000:21914a-970c-41f8-b932-32bbefa2c86b", "row_index": 0, "timestamp": "2019-02-28T21:18:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21914a-970c-41f8-b932-32bbefa2c86b", "eventTime": "2019-02-28T21:18:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwUkwrTkxxVzNQNGlRWWFQVnRMdldGTnhiVFRJRjJJWmtrNkNPRFgybkl5YXNyVVFnaHg4Y3dlSy9WcTBwTXdaYk4vWTF1bkFMSSsrN0FVbVFIanZmYmlxay84SVVPQlB4ZDFxV0ZNQ1ptL29LYjF0MW1nM2xXKzgwZm93cDBSU0ZoWHVLcm8vbVpvb25HTGR3UTN2dEJQdFdCODgzdVpEVzhISUVuVGg2aHFrVHNEcmtOdUJ2Um5DMmt0SGliTEdaWmNYRkdGWlcwaDFQQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f112ec3f-d82d-40c9-871f-bc8312564e52", "record_id": "flaws_cloudtrail:0000001:f112ec3f-d82d-40c9-871f-bc8312564e52", "row_index": 1, "timestamp": "2019-02-28T21:18:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f112ec3f-d82d-40c9-871f-bc8312564e52", "eventTime": "2019-02-28T21:18:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnTWF4K0tCMVozamNTRTcxMHRaa1cvVS9Yb3ZjRVRCWHUwNzlMQXdOTlppNVc2bmYxWFFzRkxsZ2ErbHRHR3AvSENxcG5PNTdZMWxBZEp5aFMvSDB1UGNNeHM2V1h1UTE4ZmNuRjZaaFVWZEtJdDNRWmsrNzdWNXhqSmF0WkI5TzRGdUxJeDA2aElJR0NkNk9KZ1FLRHc2bnBqN2VHdzQreFpua3BGK2xHZ1JQbWJDaVU5SCs5UzlPYjVSeVloWkJFdVAyT2sveFBaVGZDZit1ZUgzcHB4T1VrTVVsRnFNPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9c22f4b-7c93-44c0-b8ae-111c39547118", "record_id": "flaws_cloudtrail:0000002:a9c22f4b-7c93-44c0-b8ae-111c39547118", "row_index": 2, "timestamp": "2019-02-28T21:18:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9c22f4b-7c93-44c0-b8ae-111c39547118", "eventTime": "2019-02-28T21:18:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYUkVsNzA4RTIvSDhpNHJ6QjM2ZmFNdmxSeWFOdzNnL253RDFGdUs4WGRDZE9NN09sTWZKNmlmRFNsU1MrbHJzbDZtOWNFbzNZQnFrUXlNMVZaVjNrTExTRm9ia29LNHNlV1FpNXdaMEJLd0tjNWgydEVjVjVZVkg1WUhUbEJPS09NRWdKYy95ZURxa1pIMUZpNWpwSGpGVWs0dGZnUzhoeWZwSmdaenBvR2pDdmF0ZU90Ni9BM2FPd0F6MUR1enZkUldMT2FKN3U3MG9vdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a4f6557-ef02-4473-835e-73e35d1bd7da", "record_id": "flaws_cloudtrail:0000003:7a4f6557-ef02-4473-835e-73e35d1bd7da", "row_index": 3, "timestamp": "2019-02-28T21:18:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a4f6557-ef02-4473-835e-73e35d1bd7da", "eventTime": "2019-02-28T21:18:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWUmVMcFRSK1M5RlZlSWhCcG1hVkdKTXRSRkJVY1NVV3doL2hMM3RhNW9FRmpwRG9yOWtmQTVtd3g2SjMvVFFrbEVOQ3NPYmlYRGpMbiswSUxZc3NZaFRyN1NPSjloVzZveXZidnVXb1FVSXlnODVIbkJFVkVGUlJ1WUZOQVJRcXpDQkZiS1BrUUFSc1hoQVVWZTNBV3BZZ25VWm9sUElFRW1NaVRPMUhJTytqNDY0VllFc3Z6aFp1bTJ6d0kzTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "record_id": "flaws_cloudtrail:0000004:690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "row_index": 4, "timestamp": "2019-02-28T21:18:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1101, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "eventTime": "2019-02-28T21:18:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVZFZOUHFLVXEraVB3UXQ1UnJxb2NUVGYzRThuSFdsd0t5UUQzQnR2VUtpUGtia3E4U2lUTFpYRDd3bmx4MDduTkxORGxuekRPWjQ5NXJpUWxsU0RLR1ZLVUVFdzFoM3RXZk0weTFJTzdBS2F0ZXpTKy9QQ0Q1Si8zVEdYc1VmRmVjbm1jVmt5azFScGVnNmo5dnYraEZmb2NGbmRtV3VKdktEaG9kMHY2Q1ZEREJzTjBFMXZNc1gwSUI5dkdpTC9iV3UzWDlFZWNJaDNNZzhUcUxNd0RENWh1a2pJM0ZvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a4f6557-ef02-4473-835e-73e35d1bd7da", "record_id": "flaws_cloudtrail:0000005:7a4f6557-ef02-4473-835e-73e35d1bd7da", "row_index": 5, "timestamp": "2019-02-28T21:18:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a4f6557-ef02-4473-835e-73e35d1bd7da", "eventTime": "2019-02-28T21:18:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWUmVMcFRSK1M5RlZlSWhCcG1hVkdKTXRSRkJVY1NVV3doL2hMM3RhNW9FRmpwRG9yOWtmQTVtd3g2SjMvVFFrbEVOQ3NPYmlYRGpMbiswSUxZc3NZaFRyN1NPSjloVzZveXZidnVXb1FVSXlnODVIbkJFVkVGUlJ1WUZOQVJRcXpDQkZiS1BrUUFSc1hoQVVWZTNBV3BZZ25VWm9sUElFRW1NaVRPMUhJTytqNDY0VllFc3Z6aFp1bTJ6d0kzTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "record_id": "flaws_cloudtrail:0000006:690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "row_index": 6, "timestamp": "2019-02-28T21:18:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1101, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "690cad70-b96d-4b94-ab9d-2d4f4a68f4b0", "eventTime": "2019-02-28T21:18:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVZFZOUHFLVXEraVB3UXQ1UnJxb2NUVGYzRThuSFdsd0t5UUQzQnR2VUtpUGtia3E4U2lUTFpYRDd3bmx4MDduTkxORGxuekRPWjQ5NXJpUWxsU0RLR1ZLVUVFdzFoM3RXZk0weTFJTzdBS2F0ZXpTKy9QQ0Q1Si8zVEdYc1VmRmVjbm1jVmt5azFScGVnNmo5dnYraEZmb2NGbmRtV3VKdktEaG9kMHY2Q1ZEREJzTjBFMXZNc1gwSUI5dkdpTC9iV3UzWDlFZWNJaDNNZzhUcUxNd0RENWh1a2pJM0ZvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a01c6c28-2652-49cf-9b53-e923db313145", "record_id": "flaws_cloudtrail:0000007:a01c6c28-2652-49cf-9b53-e923db313145", "row_index": 7, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a01c6c28-2652-49cf-9b53-e923db313145", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4MU1lMk9JeUZrUDJYTU4xNXFUQ0todTNQS2JTbW1NQy9jVmJULzdPR0RhRzdBSEVlNGVNQ3h1WE5YNDhtNy9admpMNEVQNEpPdENNV2V4ZHpoRnVxVWhFZUJNWW5jOHd6NUFQdCtuN2M0U29FOGphYkFTdDJGNCtJVnZkVTRvdWRsSHp0Z3BoNmJ3ZmRTL1pKRlZzK1Z6OHJqVlZvM25McXlDSGs5WmlGZEpESDVOQ3Rvb200WWFnREd1cWF0YmxnWDN2QTJ4OE53Qy91ZXIyZVcyMWczaTdncWxKMk5ZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "record_id": "flaws_cloudtrail:0000008:d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "row_index": 8, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRQWJOVFo0WC9IWlFOTkl5SW0rNGV1eFpPbU9MVFVYVGRzdUV6UEMxU3JQV1NmdW5Pdi82RnJpRHdNelZqaWcwUW43ZnQ5TnBiemthMFlXRjU3VU9aNzRLbzB1ck5BWVdGZWRIL1kzeThPdysyWFpmNjZPN0JZZlFHb1NycjZIMEI2amYyQXcyZHFkYk4wbEp6Y2xHNXBzc1NrKzh4VzJGUHZMbjl1clk1ZFNRYjZQWnptWGl1SGwvcmk3Z2VIUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14527e1-f713-43d8-98a7-d6a069e9bf65", "record_id": "flaws_cloudtrail:0000009:14527e1-f713-43d8-98a7-d6a069e9bf65", "row_index": 9, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14527e1-f713-43d8-98a7-d6a069e9bf65", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjYXZoSkZtOWh3S2F1QWlwZFNyWXBSdjBrUUE2bSs5cEEydmM1TmZaTHV6T29tckR3Y3ZjVWtqMy9DaUNiMklwRWwyYjh0Wkx1ejNnNlRIVjM0bWFXNDRrZjFsdzFVY1pLYjk1ZkszNWJBbUs0WjZDeFBqQmkzaHVNVUMvR1JqSm4wbGpJaWRwb1czaENpbmxxemxHN1JnUFZyUlU3anY2T3VyVkFVaERWVFlUamlnand6aEZpRGlTOVpwV1lINUp4ekZ2UFByYXh0cmg1bnFOdWhNZloxdVJSSTVxQzI0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a01c6c28-2652-49cf-9b53-e923db313145", "record_id": "flaws_cloudtrail:0000010:a01c6c28-2652-49cf-9b53-e923db313145", "row_index": 10, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1096, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a01c6c28-2652-49cf-9b53-e923db313145", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4MU1lMk9JeUZrUDJYTU4xNXFUQ0todTNQS2JTbW1NQy9jVmJULzdPR0RhRzdBSEVlNGVNQ3h1WE5YNDhtNy9admpMNEVQNEpPdENNV2V4ZHpoRnVxVWhFZUJNWW5jOHd6NUFQdCtuN2M0U29FOGphYkFTdDJGNCtJVnZkVTRvdWRsSHp0Z3BoNmJ3ZmRTL1pKRlZzK1Z6OHJqVlZvM25McXlDSGs5WmlGZEpESDVOQ3Rvb200WWFnREd1cWF0YmxnWDN2QTJ4OE53Qy91ZXIyZVcyMWczaTdncWxKMk5ZPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "record_id": "flaws_cloudtrail:0000011:d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "row_index": 11, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3f0f3e3-b383-4ab5-80d8-b9d4121e0901", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRQWJOVFo0WC9IWlFOTkl5SW0rNGV1eFpPbU9MVFVYVGRzdUV6UEMxU3JQV1NmdW5Pdi82RnJpRHdNelZqaWcwUW43ZnQ5TnBiemthMFlXRjU3VU9aNzRLbzB1ck5BWVdGZWRIL1kzeThPdysyWFpmNjZPN0JZZlFHb1NycjZIMEI2amYyQXcyZHFkYk4wbEp6Y2xHNXBzc1NrKzh4VzJGUHZMbjl1clk1ZFNRYjZQWnptWGl1SGwvcmk3Z2VIUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14527e1-f713-43d8-98a7-d6a069e9bf65", "record_id": "flaws_cloudtrail:0000012:14527e1-f713-43d8-98a7-d6a069e9bf65", "row_index": 12, "timestamp": "2019-02-28T21:18:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14527e1-f713-43d8-98a7-d6a069e9bf65", "eventTime": "2019-02-28T21:18:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjYXZoSkZtOWh3S2F1QWlwZFNyWXBSdjBrUUE2bSs5cEEydmM1TmZaTHV6T29tckR3Y3ZjVWtqMy9DaUNiMklwRWwyYjh0Wkx1ejNnNlRIVjM0bWFXNDRrZjFsdzFVY1pLYjk1ZkszNWJBbUs0WjZDeFBqQmkzaHVNVUMvR1JqSm4wbGpJaWRwb1czaENpbmxxemxHN1JnUFZyUlU3anY2T3VyVkFVaERWVFlUamlnand6aEZpRGlTOVpwV1lINUp4ekZ2UFByYXh0cmg1bnFOdWhNZloxdVJSSTVxQzI0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "record_id": "flaws_cloudtrail:0000013:2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "row_index": 13, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrWS9FQWU5TWkvMjQ2VzVDd3BYWW5xWjA1SXlIS09vWHpSckJldStpQm9VS1d3OTgyVWxFYit3dWo4S0o5RUxvbExhdlM4ZGFYQStHOW5CZXpQNXhadHR1SE12b0NMM1NSd3FiS0VtanRiTVQ5c0hFWkpPRVRvNXR2THZTRHNmVVB1bEpQL05sZjhYd1ZpRkV5aDNRV2Q5ZkV1dENSL0p6QWFMTkZqK2VKZWRnOEEwcmwxM2lOUENSTXFPTXY4bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42b81de4-03b0-42a3-bf01-d9ade50e7215", "record_id": "flaws_cloudtrail:0000014:42b81de4-03b0-42a3-bf01-d9ade50e7215", "row_index": 14, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42b81de4-03b0-42a3-bf01-d9ade50e7215", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiWXhPVTB2ci96UEJaa1JpYkxzY0RtN0VIVzE5MVE0eDJwdm9LUXZTaVliN1JNWld4c2FSRWdBSXY1S1N4VFJkaEpIcEI5Z0gzeUZyNUUzYWlsTDhlMzJDQmlmL3ZPMWQzN1dOMVppdVlyVGwwR2dMVTJGVzJEMTh3di9Fa3paTUIxVWlMNU5XTkdTZTg2em1HN2gycUErRUwzS0IwUDlya0JVdWR1eXFMek93ZnA1ZkxSZDlLcmFsaVNnVWtzRVgrL3ZMM3JJWWRpeE9SYjd5c1grc1A1ZmlvVUtmZU9BPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ff354dd-9091-4370-9bf1-c20644f472", "record_id": "flaws_cloudtrail:0000015:3ff354dd-9091-4370-9bf1-c20644f472", "row_index": 15, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ff354dd-9091-4370-9bf1-c20644f472", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4ek5GcXRFWDhnc21xd3RTdnlTWUV6SExmdGx3V0lrYWwyZVNtNWZVNFFIYUtUUFJFRW9tUHdsc1R4b1NKbi9UMzVjZUNlMmpXQ1c0cVNTYS9SWWZRNm1EUFdpd0NwQnEraUM3Zy8za1FHOHQ4U1c1VTU3V3ptOGR5Y2R4SG1aQkgxNDNuYlcwN2tNWFNtckVTZlVxVjQ4ZEFwR1VWK0U0R2Fyc010clVkaEcwbnQwWVV4bXlpNWxqL2lZZmRkdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "record_id": "flaws_cloudtrail:0000016:2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "row_index": 16, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bf179823-fe2d-4a42-ab2f-87d4ee6eebea", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrWS9FQWU5TWkvMjQ2VzVDd3BYWW5xWjA1SXlIS09vWHpSckJldStpQm9VS1d3OTgyVWxFYit3dWo4S0o5RUxvbExhdlM4ZGFYQStHOW5CZXpQNXhadHR1SE12b0NMM1NSd3FiS0VtanRiTVQ5c0hFWkpPRVRvNXR2THZTRHNmVVB1bEpQL05sZjhYd1ZpRkV5aDNRV2Q5ZkV1dENSL0p6QWFMTkZqK2VKZWRnOEEwcmwxM2lOUENSTXFPTXY4bz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42b81de4-03b0-42a3-bf01-d9ade50e7215", "record_id": "flaws_cloudtrail:0000017:42b81de4-03b0-42a3-bf01-d9ade50e7215", "row_index": 17, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42b81de4-03b0-42a3-bf01-d9ade50e7215", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiWXhPVTB2ci96UEJaa1JpYkxzY0RtN0VIVzE5MVE0eDJwdm9LUXZTaVliN1JNWld4c2FSRWdBSXY1S1N4VFJkaEpIcEI5Z0gzeUZyNUUzYWlsTDhlMzJDQmlmL3ZPMWQzN1dOMVppdVlyVGwwR2dMVTJGVzJEMTh3di9Fa3paTUIxVWlMNU5XTkdTZTg2em1HN2gycUErRUwzS0IwUDlya0JVdWR1eXFMek93ZnA1ZkxSZDlLcmFsaVNnVWtzRVgrL3ZMM3JJWWRpeE9SYjd5c1grc1A1ZmlvVUtmZU9BPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ff354dd-9091-4370-9bf1-c20644f472", "record_id": "flaws_cloudtrail:0000018:3ff354dd-9091-4370-9bf1-c20644f472", "row_index": 18, "timestamp": "2019-02-28T21:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ff354dd-9091-4370-9bf1-c20644f472", "eventTime": "2019-02-28T21:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4ek5GcXRFWDhnc21xd3RTdnlTWUV6SExmdGx3V0lrYWwyZVNtNWZVNFFIYUtUUFJFRW9tUHdsc1R4b1NKbi9UMzVjZUNlMmpXQ1c0cVNTYS9SWWZRNm1EUFdpd0NwQnEraUM3Zy8za1FHOHQ4U1c1VTU3V3ptOGR5Y2R4SG1aQkgxNDNuYlcwN2tNWFNtckVTZlVxVjQ4ZEFwR1VWK0U0R2Fyc010clVkaEcwbnQwWVV4bXlpNWxqL2lZZmRkdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "record_id": "flaws_cloudtrail:0000019:f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "row_index": 19, "timestamp": "2019-02-28T21:20:27Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "eventTime": "2019-02-28T21:20:27Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "record_id": "flaws_cloudtrail:0000020:f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "row_index": 20, "timestamp": "2019-02-28T21:20:27Z", "event_type": "GetRestApis", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6e4841a-6fea-4eda-8fe6-6650a4c533eb", "eventTime": "2019-02-28T21:20:27Z", "eventName": "GetRestApis", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73a0526c-f283-42d8-968d-a11823dffbf9", "record_id": "flaws_cloudtrail:0000021:73a0526c-f283-42d8-968d-a11823dffbf9", "row_index": 21, "timestamp": "2019-02-28T21:21:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73a0526c-f283-42d8-968d-a11823dffbf9", "eventTime": "2019-02-28T21:21:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73a0526c-f283-42d8-968d-a11823dffbf9", "record_id": "flaws_cloudtrail:0000022:73a0526c-f283-42d8-968d-a11823dffbf9", "row_index": 22, "timestamp": "2019-02-28T21:21:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73a0526c-f283-42d8-968d-a11823dffbf9", "eventTime": "2019-02-28T21:21:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "record_id": "flaws_cloudtrail:0000023:a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "row_index": 23, "timestamp": "2019-02-28T21:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "eventTime": "2019-02-28T21:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIANWN7NHZ9B1QY7WQH", "expiration": "Mar 1, 2019 3:39:52 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDP2QPNY5YrBxLqVrRSK3A3BhwtDg3/WRvm9Bw/xOedM+P4BgB5vvgwXO5oBVzAazqPZOA2NTE5i2bjckL/NBIRO++ENg3a1xFvBsajCRwE+2wvkjgWQKbppc6sTfR2cjGrmDCFfBrB/VTN+UfCB/7Gn9oiED9y47zH1SYpeDwl9ESJ/hDgESbgbL8FJUkaE3Vi5zikKFeu2UeX9JrjeIo0r8qmm+3LT1Y48BqOtJTMqZCbggOdwZQXYfYP92XOCZvG/EiMDgkqqJT69Gy8lYSHFypJufnj/oecRuuecZRTwY9JZIzDdW0T0eUTti8fn58SfXBFMPhRZN1IiWHXzDUJvmeTb/r32yhX8+AzGy/E4kp9150oQ5Acuctj0nMtTGo+QmXwAEyP1KNlAGl4D9zOEr21ryEfN2fDTmf2E/SzgGq63yK2qZmTn11zpGA/+ZAHUCp6GALqLGW5swKzkSpD28t2XanrbW+qK6ji0eLi6ElqKDbKvWwFBqN61Us1TSH3cKK3lw01BuAMCFYQ5ozcSSqzEFTfdy7yevAD/6rSiek+Q+i+W8ey0VYkzBOykK5+zE/0rF6Ywl16bfYPga39ZNOjHOgtsojqLh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "record_id": "flaws_cloudtrail:0000024:a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "row_index": 24, "timestamp": "2019-02-28T21:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a26f48de-58f4-48d9-ae12-d8f8fd558bb2", "eventTime": "2019-02-28T21:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIANWN7NHZ9B1QY7WQH", "expiration": "Mar 1, 2019 3:39:52 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDP2QPNY5YrBxLqVrRSK3A3BhwtDg3/WRvm9Bw/xOedM+P4BgB5vvgwXO5oBVzAazqPZOA2NTE5i2bjckL/NBIRO++ENg3a1xFvBsajCRwE+2wvkjgWQKbppc6sTfR2cjGrmDCFfBrB/VTN+UfCB/7Gn9oiED9y47zH1SYpeDwl9ESJ/hDgESbgbL8FJUkaE3Vi5zikKFeu2UeX9JrjeIo0r8qmm+3LT1Y48BqOtJTMqZCbggOdwZQXYfYP92XOCZvG/EiMDgkqqJT69Gy8lYSHFypJufnj/oecRuuecZRTwY9JZIzDdW0T0eUTti8fn58SfXBFMPhRZN1IiWHXzDUJvmeTb/r32yhX8+AzGy/E4kp9150oQ5Acuctj0nMtTGo+QmXwAEyP1KNlAGl4D9zOEr21ryEfN2fDTmf2E/SzgGq63yK2qZmTn11zpGA/+ZAHUCp6GALqLGW5swKzkSpD28t2XanrbW+qK6ji0eLi6ElqKDbKvWwFBqN61Us1TSH3cKK3lw01BuAMCFYQ5ozcSSqzEFTfdy7yevAD/6rSiek+Q+i+W8ey0VYkzBOykK5+zE/0rF6Ywl16bfYPga39ZNOjHOgtsojqLh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7be7e99-9e1f-4711-aa76-2feec51bd58f", "record_id": "flaws_cloudtrail:0000025:b7be7e99-9e1f-4711-aa76-2feec51bd58f", "row_index": 25, "timestamp": "2019-02-28T21:22:25Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1507, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7be7e99-9e1f-4711-aa76-2feec51bd58f", "eventTime": "2019-02-28T21:22:25Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: s4uar3yhgi5Sy5QbK5HzMA728uYLNK46Th4-gQLCTBc58fyB3HEd18ybSJYfDgLA0YtNKjML8H1ojz7Ma4FRNqpRf_5m8kffLaTVRliOm0S8rxp0cI6Q7ruiHDOuM5tJupnQuqaYA9nvzxRCgYbGmCPm3uifU249-SsilSdsRznLUyAmavDPulLrztMyCs1bmPXHb5LmoY9gOIwD3H4AQ3-GBCioLUUl8-Lay0r4BCBe4OPm8UbEykmLlHUWIRVwX5XyOenMrjqI43h0t3GdEgrW2QM1_sCwq3RkWZfJr8ew6Gzt8tXfBCGh9tf7n649H8M6mx4pnNm3BFOudRe8HrX9mWwkq_TbBUHX0PNTXUNXSKRugQ65zLXKPXQfva3e63eGBsB3-iz33_voBacE8DtTaibvzfp1uoJK545xxtg4xLkKWroR4AKbuEjqnfZj9ZMMwrGLDai8A2qpQVlpLW4XggkPxchMuAWYcH1X8j519UtKbe5xg7DSvQAI8bQnQ0lV1dznRjT4sRI2v_-htx8eUq8xOmZrXfWJz48VVpm-W2gMJ-a34QLQNvVKkvugDANQf18k1uv-qcvDn3-XNO3bfv0e3yXqr_kix3T9awO5XG0ZC_H8LPcu3eHi", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7be7e99-9e1f-4711-aa76-2feec51bd58f", "record_id": "flaws_cloudtrail:0000026:b7be7e99-9e1f-4711-aa76-2feec51bd58f", "row_index": 26, "timestamp": "2019-02-28T21:22:25Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "238.89.99.157", "user_agent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1507, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7be7e99-9e1f-4711-aa76-2feec51bd58f", "eventTime": "2019-02-28T21:22:25Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "238.89.99.157", "userAgent": "aws-cli/1.16.114 Python/2.7.15 Darwin/18.2.0 botocore/1.12.104", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: s4uar3yhgi5Sy5QbK5HzMA728uYLNK46Th4-gQLCTBc58fyB3HEd18ybSJYfDgLA0YtNKjML8H1ojz7Ma4FRNqpRf_5m8kffLaTVRliOm0S8rxp0cI6Q7ruiHDOuM5tJupnQuqaYA9nvzxRCgYbGmCPm3uifU249-SsilSdsRznLUyAmavDPulLrztMyCs1bmPXHb5LmoY9gOIwD3H4AQ3-GBCioLUUl8-Lay0r4BCBe4OPm8UbEykmLlHUWIRVwX5XyOenMrjqI43h0t3GdEgrW2QM1_sCwq3RkWZfJr8ew6Gzt8tXfBCGh9tf7n649H8M6mx4pnNm3BFOudRe8HrX9mWwkq_TbBUHX0PNTXUNXSKRugQ65zLXKPXQfva3e63eGBsB3-iz33_voBacE8DtTaibvzfp1uoJK545xxtg4xLkKWroR4AKbuEjqnfZj9ZMMwrGLDai8A2qpQVlpLW4XggkPxchMuAWYcH1X8j519UtKbe5xg7DSvQAI8bQnQ0lV1dznRjT4sRI2v_-htx8eUq8xOmZrXfWJz48VVpm-W2gMJ-a34QLQNvVKkvugDANQf18k1uv-qcvDn3-XNO3bfv0e3yXqr_kix3T9awO5XG0ZC_H8LPcu3eHi", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "072e0e0f-2dfc-4665-adf1-3108ad223fb4", "record_id": "flaws_cloudtrail:0000027:072e0e0f-2dfc-4665-adf1-3108ad223fb4", "row_index": 27, "timestamp": "2019-02-28T21:23:00Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "072e0e0f-2dfc-4665-adf1-3108ad223fb4", "eventTime": "2019-02-28T21:23:00Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "072e0e0f-2dfc-4665-adf1-3108ad223fb4", "record_id": "flaws_cloudtrail:0000028:072e0e0f-2dfc-4665-adf1-3108ad223fb4", "row_index": 28, "timestamp": "2019-02-28T21:23:00Z", "event_type": "GetResources", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "072e0e0f-2dfc-4665-adf1-3108ad223fb4", "eventTime": "2019-02-28T21:23:00Z", "eventName": "GetResources", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "record_id": "flaws_cloudtrail:0000029:59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "row_index": 29, "timestamp": "2019-02-28T21:26:34Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "eventTime": "2019-02-28T21:26:34Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "record_id": "flaws_cloudtrail:0000030:59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "row_index": 30, "timestamp": "2019-02-28T21:26:34Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59b7f0cc-31c2-4a0d-ac37-6795c2d65a22", "eventTime": "2019-02-28T21:26:34Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed4abe59-526b-4b78-a331-789d8120a6a9", "record_id": "flaws_cloudtrail:0000031:ed4abe59-526b-4b78-a331-789d8120a6a9", "row_index": 31, "timestamp": "2019-02-28T21:28:02Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed4abe59-526b-4b78-a331-789d8120a6a9", "eventTime": "2019-02-28T21:28:02Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed4abe59-526b-4b78-a331-789d8120a6a9", "record_id": "flaws_cloudtrail:0000032:ed4abe59-526b-4b78-a331-789d8120a6a9", "row_index": 32, "timestamp": "2019-02-28T21:28:02Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed4abe59-526b-4b78-a331-789d8120a6a9", "eventTime": "2019-02-28T21:28:02Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "record_id": "flaws_cloudtrail:0000033:bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "row_index": 33, "timestamp": "2019-02-28T21:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1228, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "eventTime": "2019-02-28T21:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2NL31SJFXOL6UNX5", "expiration": "Mar 1, 2019 9:29:12 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDOH2kKJ/OIp+skNpyiLfAZPs7UVjHKNVB2aIMegS/e7kOBRvfvZ6Uoi94zVXdsQvtCoTLZ1NiHwXqcGUt0xoO00z/GtZVt/zfoCkb8KOeox6vwJS8iy3CJXkZ71cRWikIoUA5cbMX+tatS8+9AhFEs56IeUzrh3cu9ncsIXPQ7TNW0GVQBIY/Gqas+AxTZhMzhWThldXTyauVOFad1BAPc4zbPUSxPUi3cThJ5IreX7wWnqCI5LRHNctOkYs8qMcxtY7w3Bcr+smY9d4h+3ythJnuPri/GcKT9Dzo1VJJLQ6JC4ZyyGH+sOsvU+wh6UoqKXh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90539a32-8f08-4f99-a667-1249f769005d", "record_id": "flaws_cloudtrail:0000034:90539a32-8f08-4f99-a667-1249f769005d", "row_index": 34, "timestamp": "2019-02-28T21:29:12Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIA2NL31SJFXOL6UNX5", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "251.22.7.253", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90539a32-8f08-4f99-a667-1249f769005d", "eventTime": "2019-02-28T21:29:12Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.22.7.253", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIA2NL31SJFXOL6UNX5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-02-28T21:29:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/02/28/[$LATEST]200bbf9a003fd9ea0a54b3620e17999c"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40e17420-96c8-4153-b8f1-0b028b3596a6", "record_id": "flaws_cloudtrail:0000035:40e17420-96c8-4153-b8f1-0b028b3596a6", "row_index": 35, "timestamp": "2019-02-28T21:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1229, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40e17420-96c8-4153-b8f1-0b028b3596a6", "eventTime": "2019-02-28T21:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGVX7ANYD7ASUPXIR", "expiration": "Mar 1, 2019 9:29:12 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDP/HDQBZnQWTo1d1uSLfARmJUmgVhIckfHN/PVdA4wzts/AP3XNIbCrn5RQW/zO3tVEQgxnJWsX0/WtS1942Rg83KgrHMj8ideGV11/93oxJPxLWdzY4FNDDWF9bJ4jsJPbT2eSFXNCj27+Q2cn6xXrcttHzEnx5gHT0zHBTvQ7OOCMb4Jr13agQNPZBjYB4I7cyhb+E95qQ1OFqMINV4fkCY4wt4kbcS4uQR0NHiwLWaTDwFmnmCo/XvCpvn+ZLOVZALY5gHG3Hj1CJatCjxfcxwW93ZaUQgt5LB8sTMNviXbRF4f+wU4TDNAGGHiIoqKXh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "record_id": "flaws_cloudtrail:0000036:bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "row_index": 36, "timestamp": "2019-02-28T21:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1228, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf3ea359-e0d4-4729-a94d-a98a7d0a9ce5", "eventTime": "2019-02-28T21:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA2NL31SJFXOL6UNX5", "expiration": "Mar 1, 2019 9:29:12 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDOH2kKJ/OIp+skNpyiLfAZPs7UVjHKNVB2aIMegS/e7kOBRvfvZ6Uoi94zVXdsQvtCoTLZ1NiHwXqcGUt0xoO00z/GtZVt/zfoCkb8KOeox6vwJS8iy3CJXkZ71cRWikIoUA5cbMX+tatS8+9AhFEs56IeUzrh3cu9ncsIXPQ7TNW0GVQBIY/Gqas+AxTZhMzhWThldXTyauVOFad1BAPc4zbPUSxPUi3cThJ5IreX7wWnqCI5LRHNctOkYs8qMcxtY7w3Bcr+smY9d4h+3ythJnuPri/GcKT9Dzo1VJJLQ6JC4ZyyGH+sOsvU+wh6UoqKXh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90539a32-8f08-4f99-a667-1249f769005d", "record_id": "flaws_cloudtrail:0000037:90539a32-8f08-4f99-a667-1249f769005d", "row_index": 37, "timestamp": "2019-02-28T21:29:12Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIA2NL31SJFXOL6UNX5", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "251.22.7.253", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90539a32-8f08-4f99-a667-1249f769005d", "eventTime": "2019-02-28T21:29:12Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.22.7.253", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIA2NL31SJFXOL6UNX5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2019-02-28T21:29:12Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2019/02/28/[$LATEST]200bbf9a003fd9ea0a54b3620e17999c"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40e17420-96c8-4153-b8f1-0b028b3596a6", "record_id": "flaws_cloudtrail:0000038:40e17420-96c8-4153-b8f1-0b028b3596a6", "row_index": 38, "timestamp": "2019-02-28T21:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1229, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40e17420-96c8-4153-b8f1-0b028b3596a6", "eventTime": "2019-02-28T21:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGVX7ANYD7ASUPXIR", "expiration": "Mar 1, 2019 9:29:12 AM", "sessionToken": "FQoGZXIvYXdzEO///////////wEaDP/HDQBZnQWTo1d1uSLfARmJUmgVhIckfHN/PVdA4wzts/AP3XNIbCrn5RQW/zO3tVEQgxnJWsX0/WtS1942Rg83KgrHMj8ideGV11/93oxJPxLWdzY4FNDDWF9bJ4jsJPbT2eSFXNCj27+Q2cn6xXrcttHzEnx5gHT0zHBTvQ7OOCMb4Jr13agQNPZBjYB4I7cyhb+E95qQ1OFqMINV4fkCY4wt4kbcS4uQR0NHiwLWaTDwFmnmCo/XvCpvn+ZLOVZALY5gHG3Hj1CJatCjxfcxwW93ZaUQgt5LB8sTMNviXbRF4f+wU4TDNAGGHiIoqKXh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b459d2b-2e1d-4c92-a546-7825ff515e06", "record_id": "flaws_cloudtrail:0000039:0b459d2b-2e1d-4c92-a546-7825ff515e06", "row_index": 39, "timestamp": "2019-02-28T21:29:51Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b459d2b-2e1d-4c92-a546-7825ff515e06", "eventTime": "2019-02-28T21:29:51Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b459d2b-2e1d-4c92-a546-7825ff515e06", "record_id": "flaws_cloudtrail:0000040:0b459d2b-2e1d-4c92-a546-7825ff515e06", "row_index": 40, "timestamp": "2019-02-28T21:29:51Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.74.90.84", "user_agent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b459d2b-2e1d-4c92-a546-7825ff515e06", "eventTime": "2019-02-28T21:29:51Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.74.90.84", "userAgent": "aws-cli/1.16.113 Python/2.7.15+ Linux/4.19.0-kali3-amd64 botocore/1.12.103", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a038f93-5fce-4ef7-922f-03e3746dc798", "record_id": "flaws_cloudtrail:0000041:0a038f93-5fce-4ef7-922f-03e3746dc798", "row_index": 41, "timestamp": "2019-02-28T22:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a038f93-5fce-4ef7-922f-03e3746dc798", "eventTime": "2019-02-28T22:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5EHDSH03IXE0V6BI", "expiration": "Mar 1, 2019 4:56:20 AM", "sessionToken": "FQoGZXIvYXdzEPD//////////wEaDHKFAaYfxF0Y3pwahiK3AwjrR9iHLyuJ8yPJ/XHkeYXGxLdY0CNCmqYr8wyI1vikISJVqZNzKaPDRKdOWZc7cbajGmYhatNUcsM76r2IMWa7xR+wsn6CCC7h2osygVIn8hE/L6IHSUOnVOIWG19odQJuOTdvFOTBhgOy1+wsLHQUxMpoaXRdVO6Kr69PcBHUIsjM6bPZ0AcpH/DLce97d+oyYc8BQy2eW4+PU1mPZAn6LEWU9eq9hYkN7RLmVAfHoX7mIP4Mge4ZxPyKEzK0gvUAmtaMsueoUAZxRwUa6GsPnbpACQ3kI0jZVSzZKj8Brd2lnCP6ctZ36gpGTt11YR0acoGqo+xry7BXlDmSfFhNj9A3rMLwTx9sYdm74/Z2Tbjo3XUrGbhcZpjklWo9/rjzDGbpxbZvO6q7TbwZKiyVeXc78coqN3bXe8xMrUzPAvmj0/bthHhlRzJh6ZffHpLe6hk1NRd6zFh/ZiY/5zTfYF4Zedxbcv+dP9MXOaIMlM2Zzr7prCC58PL1Xp40ZWidAQBueyx7FVtng5VloB9EXuq45gnQ00NF+3FG5c27+VBAWhDCpQbEQ5lqLn+QNHn6ZYR1w+oonr7h4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a038f93-5fce-4ef7-922f-03e3746dc798", "record_id": "flaws_cloudtrail:0000042:0a038f93-5fce-4ef7-922f-03e3746dc798", "row_index": 42, "timestamp": "2019-02-28T22:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a038f93-5fce-4ef7-922f-03e3746dc798", "eventTime": "2019-02-28T22:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5EHDSH03IXE0V6BI", "expiration": "Mar 1, 2019 4:56:20 AM", "sessionToken": "FQoGZXIvYXdzEPD//////////wEaDHKFAaYfxF0Y3pwahiK3AwjrR9iHLyuJ8yPJ/XHkeYXGxLdY0CNCmqYr8wyI1vikISJVqZNzKaPDRKdOWZc7cbajGmYhatNUcsM76r2IMWa7xR+wsn6CCC7h2osygVIn8hE/L6IHSUOnVOIWG19odQJuOTdvFOTBhgOy1+wsLHQUxMpoaXRdVO6Kr69PcBHUIsjM6bPZ0AcpH/DLce97d+oyYc8BQy2eW4+PU1mPZAn6LEWU9eq9hYkN7RLmVAfHoX7mIP4Mge4ZxPyKEzK0gvUAmtaMsueoUAZxRwUa6GsPnbpACQ3kI0jZVSzZKj8Brd2lnCP6ctZ36gpGTt11YR0acoGqo+xry7BXlDmSfFhNj9A3rMLwTx9sYdm74/Z2Tbjo3XUrGbhcZpjklWo9/rjzDGbpxbZvO6q7TbwZKiyVeXc78coqN3bXe8xMrUzPAvmj0/bthHhlRzJh6ZffHpLe6hk1NRd6zFh/ZiY/5zTfYF4Zedxbcv+dP9MXOaIMlM2Zzr7prCC58PL1Xp40ZWidAQBueyx7FVtng5VloB9EXuq45gnQ00NF+3FG5c27+VBAWhDCpQbEQ5lqLn+QNHn6ZYR1w+oonr7h4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27cbc9bb-d953-4677-b4cf-c8845535d5da", "record_id": "flaws_cloudtrail:0000043:27cbc9bb-d953-4677-b4cf-c8845535d5da", "row_index": 43, "timestamp": "2019-02-28T22:33:30Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "[aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27cbc9bb-d953-4677-b4cf-c8845535d5da", "eventTime": "2019-02-28T22:33:30Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "[aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27cbc9bb-d953-4677-b4cf-c8845535d5da", "record_id": "flaws_cloudtrail:0000044:27cbc9bb-d953-4677-b4cf-c8845535d5da", "row_index": 44, "timestamp": "2019-02-28T22:33:30Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "[aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27cbc9bb-d953-4677-b4cf-c8845535d5da", "eventTime": "2019-02-28T22:33:30Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "[aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37c91da3-50fc-4529-87aa-33365cf71d86", "record_id": "flaws_cloudtrail:0000045:37c91da3-50fc-4529-87aa-33365cf71d86", "row_index": 45, "timestamp": "2019-02-28T22:47:59Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 511, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37c91da3-50fc-4529-87aa-33365cf71d86", "eventTime": "2019-02-28T22:47:59Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a8bb852-927b-42d9-bf2b-ae8a9d715ab1", "record_id": "flaws_cloudtrail:0000046:4a8bb852-927b-42d9-bf2b-ae8a9d715ab1", "row_index": 46, "timestamp": "2019-02-28T22:48:19Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 540, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a8bb852-927b-42d9-bf2b-ae8a9d715ab1", "eventTime": "2019-02-28T22:48:19Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2792b65-68b3-4bfd-b481-180a5c1e1770", "record_id": "flaws_cloudtrail:0000047:e2792b65-68b3-4bfd-b481-180a5c1e1770", "row_index": 47, "timestamp": "2019-02-28T22:49:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2792b65-68b3-4bfd-b481-180a5c1e1770", "eventTime": "2019-02-28T22:49:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2792b65-68b3-4bfd-b481-180a5c1e1770", "record_id": "flaws_cloudtrail:0000048:e2792b65-68b3-4bfd-b481-180a5c1e1770", "row_index": 48, "timestamp": "2019-02-28T22:49:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2792b65-68b3-4bfd-b481-180a5c1e1770", "eventTime": "2019-02-28T22:49:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86cdf803-8cdf-412f-bd51-8fc9d2190882", "record_id": "flaws_cloudtrail:0000049:86cdf803-8cdf-412f-bd51-8fc9d2190882", "row_index": 49, "timestamp": "2019-02-28T22:50:17Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 560, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86cdf803-8cdf-412f-bd51-8fc9d2190882", "eventTime": "2019-02-28T22:50:17Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}, "requestParameters": {"userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55f04db2-af88-4190-a8e3-d0f11b34352f", "record_id": "flaws_cloudtrail:0000050:55f04db2-af88-4190-a8e3-d0f11b34352f", "row_index": 50, "timestamp": "2019-02-28T22:51:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55f04db2-af88-4190-a8e3-d0f11b34352f", "eventTime": "2019-02-28T22:51:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55f04db2-af88-4190-a8e3-d0f11b34352f", "record_id": "flaws_cloudtrail:0000051:55f04db2-af88-4190-a8e3-d0f11b34352f", "row_index": 51, "timestamp": "2019-02-28T22:51:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 752, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55f04db2-af88-4190-a8e3-d0f11b34352f", "eventTime": "2019-02-28T22:51:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0dc9156-fe7e-4fb2-8b06-7509be121da4", "record_id": "flaws_cloudtrail:0000052:f0dc9156-fe7e-4fb2-8b06-7509be121da4", "row_index": 52, "timestamp": "2019-02-28T22:51:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0dc9156-fe7e-4fb2-8b06-7509be121da4", "eventTime": "2019-02-28T22:51:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEOXo0Sy94TTgvakphSjlCU3NreGlvL3J0WmlqbEZqaU02VVQxc1RHRjlHb1FXWmh6UEY2a2pJb0k5OEpsTXcyd1Zjb3FNVkRYbnptRTNvSmNDTlVUbEc2Q1lxVUQyMmhEUXlPM2gxcVFSck0zUlhvanZ0L01VaXBGSVIzMm1mSzBmc09HKzYyMUhZYzMybU1raDNwSVZPZjlDalZGYlV0RmlUM1grTVBKMGYwWGtiRXNRTnZ2TCt3L0dITDJSQU03dVNoc0JiVG9CSHRaUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0dc9156-fe7e-4fb2-8b06-7509be121da4", "record_id": "flaws_cloudtrail:0000053:f0dc9156-fe7e-4fb2-8b06-7509be121da4", "row_index": 53, "timestamp": "2019-02-28T22:51:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0dc9156-fe7e-4fb2-8b06-7509be121da4", "eventTime": "2019-02-28T22:51:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEOXo0Sy94TTgvakphSjlCU3NreGlvL3J0WmlqbEZqaU02VVQxc1RHRjlHb1FXWmh6UEY2a2pJb0k5OEpsTXcyd1Zjb3FNVkRYbnptRTNvSmNDTlVUbEc2Q1lxVUQyMmhEUXlPM2gxcVFSck0zUlhvanZ0L01VaXBGSVIzMm1mSzBmc09HKzYyMUhZYzMybU1raDNwSVZPZjlDalZGYlV0RmlUM1grTVBKMGYwWGtiRXNRTnZ2TCt3L0dITDJSQU03dVNoc0JiVG9CSHRaUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "record_id": "flaws_cloudtrail:0000054:93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "row_index": 54, "timestamp": "2019-02-28T22:51:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "eventTime": "2019-02-28T22:51:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnZjc4dFp6T0xPNzZnUlM4T3ZRRHBrVU5rT3FveGQ1d3pHOTFBS05aUDI0OEVhWEVSdUpOa2x4Tm1HN3llZjVybTFzbEhxdnVUSmp3a2dyN1E0UUt4WkpmUk1GSnVjNDJpNjNxTThER2FvTnRUc2dPYldBMDQvM0Q4Qzc1aTJydDdJcXBSRndHaTV6QUcxYkliOXVjdDVZVzRWclFhRi9KTnFhTnhQZk13Zm8wSzNrZ0lkMFhKc1o5c1lqWk1lNE9DVVAwMGhVdkQ0QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "record_id": "flaws_cloudtrail:0000055:93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "row_index": 55, "timestamp": "2019-02-28T22:51:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93993dbf-a3ed-400e-94f9-d3cdbbaaa1e3", "eventTime": "2019-02-28T22:51:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnZjc4dFp6T0xPNzZnUlM4T3ZRRHBrVU5rT3FveGQ1d3pHOTFBS05aUDI0OEVhWEVSdUpOa2x4Tm1HN3llZjVybTFzbEhxdnVUSmp3a2dyN1E0UUt4WkpmUk1GSnVjNDJpNjNxTThER2FvTnRUc2dPYldBMDQvM0Q4Qzc1aTJydDdJcXBSRndHaTV6QUcxYkliOXVjdDVZVzRWclFhRi9KTnFhTnhQZk13Zm8wSzNrZ0lkMFhKc1o5c1lqWk1lNE9DVVAwMGhVdkQ0QT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a24a7297-90c2-46e7-95c2-3c297805ea871", "record_id": "flaws_cloudtrail:0000056:a24a7297-90c2-46e7-95c2-3c297805ea871", "row_index": 56, "timestamp": "2019-02-28T22:51:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a24a7297-90c2-46e7-95c2-3c297805ea871", "eventTime": "2019-02-28T22:51:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0b2tGSXZFQWdwY1FKR2NuTzEvaGRMelhmM01tS00zZ2pLMWpjZjZJaWc5MlpjSnpQRHJ0VkYwYml6UnBhRmtieXFnNmhGT0xvZDZnSENram14eXFtWW5hUHo2bHdiVWIrRkV4MVVFT0p3bnYwL1JId1BmQ0ZNcHRsSGVYa0RCdVlMZXhjN0VzOW52UWM4NDVWbGhOd1JoQXRieERKKzhXSXVHRkFsNEdaeEczcHV6dENzWllUbXBmeFF5UlgvMDhhOVdhM2NWUERBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a24a7297-90c2-46e7-95c2-3c297805ea871", "record_id": "flaws_cloudtrail:0000057:a24a7297-90c2-46e7-95c2-3c297805ea871", "row_index": 57, "timestamp": "2019-02-28T22:51:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a24a7297-90c2-46e7-95c2-3c297805ea871", "eventTime": "2019-02-28T22:51:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0b2tGSXZFQWdwY1FKR2NuTzEvaGRMelhmM01tS00zZ2pLMWpjZjZJaWc5MlpjSnpQRHJ0VkYwYml6UnBhRmtieXFnNmhGT0xvZDZnSENram14eXFtWW5hUHo2bHdiVWIrRkV4MVVFT0p3bnYwL1JId1BmQ0ZNcHRsSGVYa0RCdVlMZXhjN0VzOW52UWM4NDVWbGhOd1JoQXRieERKKzhXSXVHRkFsNEdaeEczcHV6dENzWllUbXBmeFF5UlgvMDhhOVdhM2NWUERBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8925a96a-7eea-477f-a43b-eb4b982bac7e", "record_id": "flaws_cloudtrail:0000058:8925a96a-7eea-477f-a43b-eb4b982bac7e", "row_index": 58, "timestamp": "2019-02-28T22:51:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8925a96a-7eea-477f-a43b-eb4b982bac7e", "eventTime": "2019-02-28T22:51:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGR2t5VzZaOUtCRHhnTmplaWE3UnVFNkpxdnpmNERxZGRRa2gvQlFqeHNmVDBKK3ZZZG1jb2NpbWlVTjRsanhZanVSQ3RYQUlHaGw1OGNBdFRuKytMWFlGVmF0WEs1TEhQSGZtOWpzZCszemlkcFoycGp0b2h0dnlCaHFwVDBtSnB6OGV6bUczY2w5RkM1MXdCb3VtYk5TVjVDaUQ4MWVodVZLOHFYTkFNRVh4MUFLU1VLRDNiTGxnb0lDVk1OSjJNTWdWc1paRXVMVmN4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8925a96a-7eea-477f-a43b-eb4b982bac7e", "record_id": "flaws_cloudtrail:0000059:8925a96a-7eea-477f-a43b-eb4b982bac7e", "row_index": 59, "timestamp": "2019-02-28T22:51:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8925a96a-7eea-477f-a43b-eb4b982bac7e", "eventTime": "2019-02-28T22:51:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGR2t5VzZaOUtCRHhnTmplaWE3UnVFNkpxdnpmNERxZGRRa2gvQlFqeHNmVDBKK3ZZZG1jb2NpbWlVTjRsanhZanVSQ3RYQUlHaGw1OGNBdFRuKytMWFlGVmF0WEs1TEhQSGZtOWpzZCszemlkcFoycGp0b2h0dnlCaHFwVDBtSnB6OGV6bUczY2w5RkM1MXdCb3VtYk5TVjVDaUQ4MWVodVZLOHFYTkFNRVh4MUFLU1VLRDNiTGxnb0lDVk1OSjJNTWdWc1paRXVMVmN4QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "record_id": "flaws_cloudtrail:0000060:b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "row_index": 60, "timestamp": "2019-02-28T22:51:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "eventTime": "2019-02-28T22:51:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZdlFWTllRakR4WW14Z0tFRHJ0UEYyNk4yQUVLZUttei9HNWhGSGc1WnRkd0tOMURGdDR2Sk9uQkx2eWpFQnA1a3JrL05GYnk0d3FFbTQ3ZWF3dkU4ajdvZEpVRGVJZnMzUktjUHlCNVRYN2pjNlBWUEdIOWNqWUw2VTA2YU9kcVV2SHVOWDkvbDQvckJNVFRhei8wMjFpZTlITFc5eVVWM0I3M0pUckgvQUNJanJCMGlTaEdWcnRkMS91Qjg5TzBSbFhjOTZ2VytSaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "record_id": "flaws_cloudtrail:0000061:b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "row_index": 61, "timestamp": "2019-02-28T22:51:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1071, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b35a259a-c9bc-409b-bbe7-421e0cafd2ea", "eventTime": "2019-02-28T22:51:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZdlFWTllRakR4WW14Z0tFRHJ0UEYyNk4yQUVLZUttei9HNWhGSGc1WnRkd0tOMURGdDR2Sk9uQkx2eWpFQnA1a3JrL05GYnk0d3FFbTQ3ZWF3dkU4ajdvZEpVRGVJZnMzUktjUHlCNVRYN2pjNlBWUEdIOWNqWUw2VTA2YU9kcVV2SHVOWDkvbDQvckJNVFRhei8wMjFpZTlITFc5eVVWM0I3M0pUckgvQUNJanJCMGlTaEdWcnRkMS91Qjg5TzBSbFhjOTZ2VytSaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "145ca94e-5ee5-4257-a396-6f5a2bc7077d", "record_id": "flaws_cloudtrail:0000062:145ca94e-5ee5-4257-a396-6f5a2bc7077d", "row_index": 62, "timestamp": "2019-02-28T22:51:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "145ca94e-5ee5-4257-a396-6f5a2bc7077d", "eventTime": "2019-02-28T22:51:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2SGVxVXM1YnZrMmNVOVVBRmM1cGhLY09tNElDTnk5NVJYOWY0N3ZoOG5iVGd4aDZKTFJNZk1mZXI5RVY1SGRxSXUxbnI3ZGNFdi9ZRjFCT2xRSGNjZTRiVmJKaXZHYlEvSkpHd0FSczdZYjVMWENubUdWZUdlaGN0OEl2Mk13WHM3YnU2TlFORXUyby9ham1IaFQ4ZGl2eGtmd0tqRjk5UWh5TTZHM3U0ajBYd2lFQy8vVUxxWWVHUnAvSEFQZzBVMGh6eGtQOWdkY0VxUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "145ca94e-5ee5-4257-a396-6f5a2bc7077d", "record_id": "flaws_cloudtrail:0000063:145ca94e-5ee5-4257-a396-6f5a2bc7077d", "row_index": 63, "timestamp": "2019-02-28T22:51:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "145ca94e-5ee5-4257-a396-6f5a2bc7077d", "eventTime": "2019-02-28T22:51:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2SGVxVXM1YnZrMmNVOVVBRmM1cGhLY09tNElDTnk5NVJYOWY0N3ZoOG5iVGd4aDZKTFJNZk1mZXI5RVY1SGRxSXUxbnI3ZGNFdi9ZRjFCT2xRSGNjZTRiVmJKaXZHYlEvSkpHd0FSczdZYjVMWENubUdWZUdlaGN0OEl2Mk13WHM3YnU2TlFORXUyby9ham1IaFQ4ZGl2eGtmd0tqRjk5UWh5TTZHM3U0ajBYd2lFQy8vVUxxWWVHUnAvSEFQZzBVMGh6eGtQOWdkY0VxUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec99af40-90b2-483b-8d98-75c78e8b114e", "record_id": "flaws_cloudtrail:0000064:ec99af40-90b2-483b-8d98-75c78e8b114e", "row_index": 64, "timestamp": "2019-02-28T22:51:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec99af40-90b2-483b-8d98-75c78e8b114e", "eventTime": "2019-02-28T22:51:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3Z214OHVQVjFGOG1CMW9zQWlEVEJWSlpWL2FKODFOYXFubk91SVpsMUhKSkxxWDRKeVJOT1o0Zkd2enlZOTVuZm12Qkp2dVRMNUlHUnh3aGZYSUk0K2dtalFxTlY1cG9CaENaN09SZ3NKUjhiVnYzb3ZDVUlWVUJTOEdUYnYvMUptKzdEZ2Fydis3Smx3emNvQTlKZ0lrYnpGOXR4U0xnbnNNZjdkT0FqcXo1cnNya2Vha3hnTkVKak1MU05OMTNiTEZHODdoSExpbU81QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec99af40-90b2-483b-8d98-75c78e8b114e", "record_id": "flaws_cloudtrail:0000065:ec99af40-90b2-483b-8d98-75c78e8b114e", "row_index": 65, "timestamp": "2019-02-28T22:51:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1077, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec99af40-90b2-483b-8d98-75c78e8b114e", "eventTime": "2019-02-28T22:51:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3Z214OHVQVjFGOG1CMW9zQWlEVEJWSlpWL2FKODFOYXFubk91SVpsMUhKSkxxWDRKeVJOT1o0Zkd2enlZOTVuZm12Qkp2dVRMNUlHUnh3aGZYSUk0K2dtalFxTlY1cG9CaENaN09SZ3NKUjhiVnYzb3ZDVUlWVUJTOEdUYnYvMUptKzdEZ2Fydis3Smx3emNvQTlKZ0lrYnpGOXR4U0xnbnNNZjdkT0FqcXo1cnNya2Vha3hnTkVKak1MU05OMTNiTEZHODdoSExpbU81QT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfb46a9b-6a0b-4516-a733-812bd673725", "record_id": "flaws_cloudtrail:0000066:dfb46a9b-6a0b-4516-a733-812bd673725", "row_index": 66, "timestamp": "2019-02-28T22:51:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfb46a9b-6a0b-4516-a733-812bd673725", "eventTime": "2019-02-28T22:51:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFRUE3NHdLQnZZb0NwTDBlUUZ2YkVWQi9xOVV1bW95YWc3MmJGNzMxcFZmN0ZSMlhZazJ4S0ZmZXJLMEpVUVVueFhFczMvWmtHU3lBZm9Rajhyd053ZUk3cXVObDFIUHBvZHkxSHV5VGw4YVpUdnVZVXRSYUh5NWVBL0lEbW5IaU1XY1hxOElTZXdkdEhwUDF2MlFseFBaMGllK2NXcDczaFBBYURvSnBEUDFBMm5IQlZKdnBzbGZobTA0T2JIMWlxaHNjK1M3bkVnaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dfb46a9b-6a0b-4516-a733-812bd673725", "record_id": "flaws_cloudtrail:0000067:dfb46a9b-6a0b-4516-a733-812bd673725", "row_index": 67, "timestamp": "2019-02-28T22:51:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dfb46a9b-6a0b-4516-a733-812bd673725", "eventTime": "2019-02-28T22:51:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFRUE3NHdLQnZZb0NwTDBlUUZ2YkVWQi9xOVV1bW95YWc3MmJGNzMxcFZmN0ZSMlhZazJ4S0ZmZXJLMEpVUVVueFhFczMvWmtHU3lBZm9Rajhyd053ZUk3cXVObDFIUHBvZHkxSHV5VGw4YVpUdnVZVXRSYUh5NWVBL0lEbW5IaU1XY1hxOElTZXdkdEhwUDF2MlFseFBaMGllK2NXcDczaFBBYURvSnBEUDFBMm5IQlZKdnBzbGZobTA0T2JIMWlxaHNjK1M3bkVnaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d51757b-1a24-44fc-b45e-ee037b10c62d", "record_id": "flaws_cloudtrail:0000068:9d51757b-1a24-44fc-b45e-ee037b10c62d", "row_index": 68, "timestamp": "2019-02-28T22:51:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d51757b-1a24-44fc-b45e-ee037b10c62d", "eventTime": "2019-02-28T22:51:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4enhZa2ZEVkVaekJZTUxEaFBGcFdHS0NNcnJsOFdZbDFNalJMM3U0SHhZUENSYklIUUIvWUZoWjA4QldHZlROZi84eStCYUVEd3UybHRaOFNhOTcyT3d0K0hpWmh5Yk4yWUI1T3dpOWpsWTcxUEwrei9KZGJvVFBEUWZmRkJBUFVRVU9ZSjhlSnAxbmdhZDZhZ2EyMmZDY2lYQVpqRWpsNWV5WGtKMGM5OFBpQzJpenhKeXlTWkVDQTBsNWVVaXcyMkFrUE1mRnhGaTVrUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d51757b-1a24-44fc-b45e-ee037b10c62d", "record_id": "flaws_cloudtrail:0000069:9d51757b-1a24-44fc-b45e-ee037b10c62d", "row_index": 69, "timestamp": "2019-02-28T22:51:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d51757b-1a24-44fc-b45e-ee037b10c62d", "eventTime": "2019-02-28T22:51:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4enhZa2ZEVkVaekJZTUxEaFBGcFdHS0NNcnJsOFdZbDFNalJMM3U0SHhZUENSYklIUUIvWUZoWjA4QldHZlROZi84eStCYUVEd3UybHRaOFNhOTcyT3d0K0hpWmh5Yk4yWUI1T3dpOWpsWTcxUEwrei9KZGJvVFBEUWZmRkJBUFVRVU9ZSjhlSnAxbmdhZDZhZ2EyMmZDY2lYQVpqRWpsNWV5WGtKMGM5OFBpQzJpenhKeXlTWkVDQTBsNWVVaXcyMkFrUE1mRnhGaTVrUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d912500-271d-4f06-af71-afd48676e2f7", "record_id": "flaws_cloudtrail:0000070:4d912500-271d-4f06-af71-afd48676e2f7", "row_index": 70, "timestamp": "2019-02-28T22:51:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d912500-271d-4f06-af71-afd48676e2f7", "eventTime": "2019-02-28T22:51:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzWS9TK0VPblpJc2MyMWhGS0pLaUFmVHJIckViTU1YOTEydWJyblpUL0RDSnpTaTEvRWZSMW5yVDdFRmVXRXZudmJpZk12c25vR1lWV2wzdXI0dVJ1ajdSL2Jxd3NCTy9uUFh3SmV6RnFIM2F5TjhvR3pzTWZwT3FzVVhlSUZGZlNTQnIreGtxWmg5SHROdlJBeFhwQTZhZENVTEJxQ3Q2blhMdGlmWkl1NkZRaXlyOHdGVnV2T0daWTAvcFNWYjdzUnBCYkVxSWRTTXBVZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d912500-271d-4f06-af71-afd48676e2f7", "record_id": "flaws_cloudtrail:0000071:4d912500-271d-4f06-af71-afd48676e2f7", "row_index": 71, "timestamp": "2019-02-28T22:51:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d912500-271d-4f06-af71-afd48676e2f7", "eventTime": "2019-02-28T22:51:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzWS9TK0VPblpJc2MyMWhGS0pLaUFmVHJIckViTU1YOTEydWJyblpUL0RDSnpTaTEvRWZSMW5yVDdFRmVXRXZudmJpZk12c25vR1lWV2wzdXI0dVJ1ajdSL2Jxd3NCTy9uUFh3SmV6RnFIM2F5TjhvR3pzTWZwT3FzVVhlSUZGZlNTQnIreGtxWmg5SHROdlJBeFhwQTZhZENVTEJxQ3Q2blhMdGlmWkl1NkZRaXlyOHdGVnV2T0daWTAvcFNWYjdzUnBCYkVxSWRTTXBVZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "856279cd-1b55-467c-be80-3d857095c", "record_id": "flaws_cloudtrail:0000072:856279cd-1b55-467c-be80-3d857095c", "row_index": 72, "timestamp": "2019-02-28T22:51:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "856279cd-1b55-467c-be80-3d857095c", "eventTime": "2019-02-28T22:51:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnQVB1bzFEVmhPTE1LK0srbE9rbkRVVzB3bEhvZ3czWnJhRTQwVmhCaHd4dGthUDJva255c3dMNWI4WGRxdzFPS3lQUVIvTHZQZEpkS1ZRMGV0RUliZitLYTF3d3BXSjF4aGJOYVBNd0pQR0l4M0VEMVF3Z1h1THFXdGVCbjE2T2s5aDcvTmJNalhxWVBNbVhBWXhSdVJIbWhhMjRPN3Bsa1hZQXcwMGI0U1Q1cFd3S1JxQmZNWFFTaXNkelJuTFNxckVMRFNiRHpPTXFEZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "856279cd-1b55-467c-be80-3d857095c", "record_id": "flaws_cloudtrail:0000073:856279cd-1b55-467c-be80-3d857095c", "row_index": 73, "timestamp": "2019-02-28T22:51:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "856279cd-1b55-467c-be80-3d857095c", "eventTime": "2019-02-28T22:51:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnQVB1bzFEVmhPTE1LK0srbE9rbkRVVzB3bEhvZ3czWnJhRTQwVmhCaHd4dGthUDJva255c3dMNWI4WGRxdzFPS3lQUVIvTHZQZEpkS1ZRMGV0RUliZitLYTF3d3BXSjF4aGJOYVBNd0pQR0l4M0VEMVF3Z1h1THFXdGVCbjE2T2s5aDcvTmJNalhxWVBNbVhBWXhSdVJIbWhhMjRPN3Bsa1hZQXcwMGI0U1Q1cFd3S1JxQmZNWFFTaXNkelJuTFNxckVMRFNiRHpPTXFEZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "466989c-9c97-4a9b-8fa8-d5305f97a1f2", "record_id": "flaws_cloudtrail:0000074:466989c-9c97-4a9b-8fa8-d5305f97a1f2", "row_index": 74, "timestamp": "2019-02-28T22:51:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "466989c-9c97-4a9b-8fa8-d5305f97a1f2", "eventTime": "2019-02-28T22:51:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VHByQUJ2YWwrbGlrK2IxUmJmdExPSE5aL0ZUOG5WdWpQL1BPZzJmUTg4MmIzYTJvNTZYY2lzL0JmWkkyc0NDdUwxcjY2aHBzRmk5RE5EV0Q0SC80NXNqSmJOdFIyWHVaNGhUNzJvbWdGQ1dFbHJTemJzQmFKNm05aFFHOGJoQ1dMNVgva2RSSGNHMHVwaU9aK2wwbUQ2OEk1NGpsRWdHZldiYUpSeDJZdzVSK2tESmZFSVNuMGZxMWVTUjRXSG1BQUpzbkVpWUFTL21MUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "466989c-9c97-4a9b-8fa8-d5305f97a1f2", "record_id": "flaws_cloudtrail:0000075:466989c-9c97-4a9b-8fa8-d5305f97a1f2", "row_index": 75, "timestamp": "2019-02-28T22:51:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "466989c-9c97-4a9b-8fa8-d5305f97a1f2", "eventTime": "2019-02-28T22:51:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2VHByQUJ2YWwrbGlrK2IxUmJmdExPSE5aL0ZUOG5WdWpQL1BPZzJmUTg4MmIzYTJvNTZYY2lzL0JmWkkyc0NDdUwxcjY2aHBzRmk5RE5EV0Q0SC80NXNqSmJOdFIyWHVaNGhUNzJvbWdGQ1dFbHJTemJzQmFKNm05aFFHOGJoQ1dMNVgva2RSSGNHMHVwaU9aK2wwbUQ2OEk1NGpsRWdHZldiYUpSeDJZdzVSK2tESmZFSVNuMGZxMWVTUjRXSG1BQUpzbkVpWUFTL21MUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d38ed35-732f-4a78-b516-cddda3986d55", "record_id": "flaws_cloudtrail:0000076:7d38ed35-732f-4a78-b516-cddda3986d55", "row_index": 76, "timestamp": "2019-02-28T22:51:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d38ed35-732f-4a78-b516-cddda3986d55", "eventTime": "2019-02-28T22:51:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYVGZ3N0VBanpCRjFWWDVacFJ5L091cUdCSTF3YUtRNWs1bUo4L2JHZUw1OUMvU0w2Y05UckVCL0RBdEljdUg3YlpvYkM1WTB2Y3IxRnBhT3Z6RDZ1WVdUeitKQW5TR0xzQWZlMElFQUVkaXg2RlZldGZqcHJkUVNzdXF1c2FrdFB1OGFxbkM1TldLbFA4a2FhdG51MnY0dXpMVjZ1S0p6QldKMVI3SlNBY0w1SWFxa3ZOZi9HWlRCVkpybkk3QmNCTlIwb1F0R1Z6cThnZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d38ed35-732f-4a78-b516-cddda3986d55", "record_id": "flaws_cloudtrail:0000077:7d38ed35-732f-4a78-b516-cddda3986d55", "row_index": 77, "timestamp": "2019-02-28T22:51:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d38ed35-732f-4a78-b516-cddda3986d55", "eventTime": "2019-02-28T22:51:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYVGZ3N0VBanpCRjFWWDVacFJ5L091cUdCSTF3YUtRNWs1bUo4L2JHZUw1OUMvU0w2Y05UckVCL0RBdEljdUg3YlpvYkM1WTB2Y3IxRnBhT3Z6RDZ1WVdUeitKQW5TR0xzQWZlMElFQUVkaXg2RlZldGZqcHJkUVNzdXF1c2FrdFB1OGFxbkM1TldLbFA4a2FhdG51MnY0dXpMVjZ1S0p6QldKMVI3SlNBY0w1SWFxa3ZOZi9HWlRCVkpybkk3QmNCTlIwb1F0R1Z6cThnZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "record_id": "flaws_cloudtrail:0000078:9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "row_index": 78, "timestamp": "2019-02-28T22:51:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "eventTime": "2019-02-28T22:51:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlbGwrbjkzRElNV2RDejJuTEM4UWJtOEsrbmJQNUFBQXExSXphcDN1RlVxMXhtYjlYN2NrRG9Oc0t3cCtKdkdCQmFZTlBtR3ppRTJpa1FieCtzc3VWdnpSVmc2cnk2cHJpenUyY3dzZisyWkNicE9Za2RvQUtMOFJUdmZmdXBVQ1RuVGR5MEtDQmFyWHJQbkxFN0RDNEUwaHIrVWJTK2VWUC9kT3o5M0NZR1ZtVDlyb2FDcGxwNEtWSTdNWWZQcXQ1NzFVdXpnK1pvaXZkdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "record_id": "flaws_cloudtrail:0000079:9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "row_index": 79, "timestamp": "2019-02-28T22:51:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f07d894-1d3f-4f3a-8fe4-58e2aaf9c08c", "eventTime": "2019-02-28T22:51:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlbGwrbjkzRElNV2RDejJuTEM4UWJtOEsrbmJQNUFBQXExSXphcDN1RlVxMXhtYjlYN2NrRG9Oc0t3cCtKdkdCQmFZTlBtR3ppRTJpa1FieCtzc3VWdnpSVmc2cnk2cHJpenUyY3dzZisyWkNicE9Za2RvQUtMOFJUdmZmdXBVQ1RuVGR5MEtDQmFyWHJQbkxFN0RDNEUwaHIrVWJTK2VWUC9kT3o5M0NZR1ZtVDlyb2FDcGxwNEtWSTdNWWZQcXQ1NzFVdXpnK1pvaXZkdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "record_id": "flaws_cloudtrail:0000080:33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "row_index": 80, "timestamp": "2019-02-28T22:51:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "eventTime": "2019-02-28T22:51:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4U1VKbzZzY1NkWmxjajdpdlB5TlBLbEo4RjFibXIzYTVwcXVlRjVjZ1dvYU1xREo5MVFqNmJJY1ZNNmVyZnpPd21DV1VkWkQ2WURsWGx1aDF0dURUSURuanJBaVc3N0ZYT3cxelp5bjFISHk1dEUwa0V6NWVEVW1nV2swdER6RjNBY2x2bDVJZFkrdVAxNDh0azRONm4wK2hHSFAvS0tjSXVUSWJRdUNaSjFJeHpLL2lCU09oNzRMeGgxcVk0ST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "record_id": "flaws_cloudtrail:0000081:e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "row_index": 81, "timestamp": "2019-02-28T22:51:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "eventTime": "2019-02-28T22:51:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCY1c3NDFRbWl0OHlmc0JwZFpQY3BKZHhXSXdxdVQzTlBXTWhMZ2dxMjFZbkxzMW45WC9GaWh6NWU0a1kvZ3pobjYwTHRvenlac25CbDlvcW5Hc29wbHA0UGpXYkliN0NTWGowaFRxMS9QUEo2ODd5MjlhSysvQzhDNUx0Z1Q0UU5uemErVlB6M3gxR0RwTGNNQUgzQVl2OWk0bzBXVDhiLzJzNEZiNVFIZlBpZVJLb2dJKzVQOTlsSDBHUWc3WEhFR3o5ekZFREZRWnFjTUpOYkg3YW5iS3RZK0h3bjBVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "record_id": "flaws_cloudtrail:0000082:33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "row_index": 82, "timestamp": "2019-02-28T22:51:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33ad5fd6-c579-4419-b392-4b57a4ba1a5e", "eventTime": "2019-02-28T22:51:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4U1VKbzZzY1NkWmxjajdpdlB5TlBLbEo4RjFibXIzYTVwcXVlRjVjZ1dvYU1xREo5MVFqNmJJY1ZNNmVyZnpPd21DV1VkWkQ2WURsWGx1aDF0dURUSURuanJBaVc3N0ZYT3cxelp5bjFISHk1dEUwa0V6NWVEVW1nV2swdER6RjNBY2x2bDVJZFkrdVAxNDh0azRONm4wK2hHSFAvS0tjSXVUSWJRdUNaSjFJeHpLL2lCU09oNzRMeGgxcVk0ST0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "record_id": "flaws_cloudtrail:0000083:e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "row_index": 83, "timestamp": "2019-02-28T22:51:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e250986b4-7308-4bf6-8a5d-4ae7feb94cc4", "eventTime": "2019-02-28T22:51:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCY1c3NDFRbWl0OHlmc0JwZFpQY3BKZHhXSXdxdVQzTlBXTWhMZ2dxMjFZbkxzMW45WC9GaWh6NWU0a1kvZ3pobjYwTHRvenlac25CbDlvcW5Hc29wbHA0UGpXYkliN0NTWGowaFRxMS9QUEo2ODd5MjlhSysvQzhDNUx0Z1Q0UU5uemErVlB6M3gxR0RwTGNNQUgzQVl2OWk0bzBXVDhiLzJzNEZiNVFIZlBpZVJLb2dJKzVQOTlsSDBHUWc3WEhFR3o5ekZFREZRWnFjTUpOYkg3YW5iS3RZK0h3bjBVPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29cc1e09-2582-4ab7-af47-423c30c69ca9", "record_id": "flaws_cloudtrail:0000084:29cc1e09-2582-4ab7-af47-423c30c69ca9", "row_index": 84, "timestamp": "2019-02-28T22:51:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29cc1e09-2582-4ab7-af47-423c30c69ca9", "eventTime": "2019-02-28T22:51:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiNVV4QlpFWnlPbEo2dVdHbWdiTjBmb1RkZ2ZRLzNtNlg5akxObi9Jc1BRMlJIQTVGMDY4cHZ3bWt0UGpBOC9hSElqL2R6TVM1WEVLbzZMNFU5dy9MUDl1U0tySTN3K285d2U3Vm0yanhaUENVN25kTjNJQjNZQTYzaFhJemJHeGdlRXIyV3RacUh3TXFTV3Zpa1lQV0VPRnloZDZ5QzNiUGxVVEZnWC82SkZKdDN4cmJLMzVkNGVjTWNmR2JJdWd4Wjkyb3N3S1pyZmpKS0JHdzFPUXdHMEpmRzRaVU1FPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29cc1e09-2582-4ab7-af47-423c30c69ca9", "record_id": "flaws_cloudtrail:0000085:29cc1e09-2582-4ab7-af47-423c30c69ca9", "row_index": 85, "timestamp": "2019-02-28T22:51:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29cc1e09-2582-4ab7-af47-423c30c69ca9", "eventTime": "2019-02-28T22:51:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiNVV4QlpFWnlPbEo2dVdHbWdiTjBmb1RkZ2ZRLzNtNlg5akxObi9Jc1BRMlJIQTVGMDY4cHZ3bWt0UGpBOC9hSElqL2R6TVM1WEVLbzZMNFU5dy9MUDl1U0tySTN3K285d2U3Vm0yanhaUENVN25kTjNJQjNZQTYzaFhJemJHeGdlRXIyV3RacUh3TXFTV3Zpa1lQV0VPRnloZDZ5QzNiUGxVVEZnWC82SkZKdDN4cmJLMzVkNGVjTWNmR2JJdWd4Wjkyb3N3S1pyZmpKS0JHdzFPUXdHMEpmRzRaVU1FPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "record_id": "flaws_cloudtrail:0000086:d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "row_index": 86, "timestamp": "2019-02-28T22:51:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "eventTime": "2019-02-28T22:51:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzemZqV3BybEpkdDlYN3FORlg1eGJDT0pMRW1ZSzlDaGhCTjdZd2hxLzBlaFRNN2VjUTVSQ1VkNytvczZoeVhuMmhyTFg2dWNyQ09zUEUvZTNiT2ZDMEJaeG4yL1MvTVEzQkVTc1N3TWpUUEFFcDUrRWxLb0IvZ1k1bmJQcXVSdFNlL2cvMC9OVWlsYmhYWHBac0MwOEdWZkNWUXErZE8ySnpieERCZU5KK0pMTmkyaG14Q0pCdXRTN2tPSjA3TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "record_id": "flaws_cloudtrail:0000087:a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "row_index": 87, "timestamp": "2019-02-28T22:51:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "eventTime": "2019-02-28T22:51:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTUlk0TjVhZ294YzlGdGphYkg3WHU1dklDNlk2QU1Ia3hUWEFJeXordmVVM3VYRmc1OXIyVXlGSEhTMzlGWld0bkljRlQ2aC91V1plV1B5SXp0clBGMnY2MTNPQVlNakFMNEsrUkIyWi96cmxPdStnMW5lRnRsRVlkRXYvTU9vWjR5UUQzKzFGT2wzVHRocXFaMVliMkJzYXYybTFieW96OTJhMVFiNTl4Tmpvb1RiZ3pzSHpaN3BxR1d1MTNMNHYzd1dlaWszelhaWS9IZlVDQ2dJQ0N4azQyUWVjaE9JPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "record_id": "flaws_cloudtrail:0000088:d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "row_index": 88, "timestamp": "2019-02-28T22:51:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6010a57-c760-4ca2-bbec-1fa4d4bb2f2d", "eventTime": "2019-02-28T22:51:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzemZqV3BybEpkdDlYN3FORlg1eGJDT0pMRW1ZSzlDaGhCTjdZd2hxLzBlaFRNN2VjUTVSQ1VkNytvczZoeVhuMmhyTFg2dWNyQ09zUEUvZTNiT2ZDMEJaeG4yL1MvTVEzQkVTc1N3TWpUUEFFcDUrRWxLb0IvZ1k1bmJQcXVSdFNlL2cvMC9OVWlsYmhYWHBac0MwOEdWZkNWUXErZE8ySnpieERCZU5KK0pMTmkyaG14Q0pCdXRTN2tPSjA3TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "record_id": "flaws_cloudtrail:0000089:a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "row_index": 89, "timestamp": "2019-02-28T22:51:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1bd77f3-caf2-4496-a097-c9aa704ad7f9", "eventTime": "2019-02-28T22:51:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTUlk0TjVhZ294YzlGdGphYkg3WHU1dklDNlk2QU1Ia3hUWEFJeXordmVVM3VYRmc1OXIyVXlGSEhTMzlGWld0bkljRlQ2aC91V1plV1B5SXp0clBGMnY2MTNPQVlNakFMNEsrUkIyWi96cmxPdStnMW5lRnRsRVlkRXYvTU9vWjR5UUQzKzFGT2wzVHRocXFaMVliMkJzYXYybTFieW96OTJhMVFiNTl4Tmpvb1RiZ3pzSHpaN3BxR1d1MTNMNHYzd1dlaWszelhaWS9IZlVDQ2dJQ0N4azQyUWVjaE9JPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41cbc8ed-7194-4aee-b1f3-6ea16856e", "record_id": "flaws_cloudtrail:0000090:41cbc8ed-7194-4aee-b1f3-6ea16856e", "row_index": 90, "timestamp": "2019-02-28T22:51:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41cbc8ed-7194-4aee-b1f3-6ea16856e", "eventTime": "2019-02-28T22:51:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUYVdUVmFoRUdORHVyWGdxcmFyK09tWFpjWHlEcTNLUXp2SGZkZXcxcmVBRnVtMzZ3QjFST3VoNk1oV1RzeUNqamJ2UFM4a1FVMWVTQ3VmdmhscFdoZzZlcmVFWHVKSGRHU09QMlI0ZjBrTittWS85bkhQc1JoSW1aZVl4OEgvV3ZJdzNXUUEyb3lmMXhuL1EwRlJGTUVTQ3UzU3dVaGc0UkxBZ1kyTDdGOWNtcWc5WTM4ZUwyNzFQTVhWSTRsND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bc052b7-f773-4e92-b5ed-6debc5802e6c", "record_id": "flaws_cloudtrail:0000091:2bc052b7-f773-4e92-b5ed-6debc5802e6c", "row_index": 91, "timestamp": "2019-02-28T22:51:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bc052b7-f773-4e92-b5ed-6debc5802e6c", "eventTime": "2019-02-28T22:51:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZNmxTRHkwWE1RQzJSTHJZNGNJbGpQaG5QRDA1VmxqZVVZR1RnUmRJMWk5SXBKSis3U2hxS0N2VzJuZXNpRm9yKy9DN3A0VnJhLzBoR0lTZEV1ODB4Y3lSTXJ3V2g0L2FjeVZWNzVheGtjd1E5a3BtVWtVeUs3ZldtQTJwVVNPNXVYZndoeWtXcXVobDBUL3hhbVFpMEtGM1hraXFaR3J0Tkk1ZDNTKy9jVjJCWDdPNUJCbnowMEdwT0dINUNhWXdRRGdhVysxY1FRandPcXNMOFprYjhNUzNWbjhYNVgwPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41cbc8ed-7194-4aee-b1f3-6ea16856e", "record_id": "flaws_cloudtrail:0000092:41cbc8ed-7194-4aee-b1f3-6ea16856e", "row_index": 92, "timestamp": "2019-02-28T22:51:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41cbc8ed-7194-4aee-b1f3-6ea16856e", "eventTime": "2019-02-28T22:51:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUYVdUVmFoRUdORHVyWGdxcmFyK09tWFpjWHlEcTNLUXp2SGZkZXcxcmVBRnVtMzZ3QjFST3VoNk1oV1RzeUNqamJ2UFM4a1FVMWVTQ3VmdmhscFdoZzZlcmVFWHVKSGRHU09QMlI0ZjBrTittWS85bkhQc1JoSW1aZVl4OEgvV3ZJdzNXUUEyb3lmMXhuL1EwRlJGTUVTQ3UzU3dVaGc0UkxBZ1kyTDdGOWNtcWc5WTM4ZUwyNzFQTVhWSTRsND0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bc052b7-f773-4e92-b5ed-6debc5802e6c", "record_id": "flaws_cloudtrail:0000093:2bc052b7-f773-4e92-b5ed-6debc5802e6c", "row_index": 93, "timestamp": "2019-02-28T22:51:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bc052b7-f773-4e92-b5ed-6debc5802e6c", "eventTime": "2019-02-28T22:51:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZNmxTRHkwWE1RQzJSTHJZNGNJbGpQaG5QRDA1VmxqZVVZR1RnUmRJMWk5SXBKSis3U2hxS0N2VzJuZXNpRm9yKy9DN3A0VnJhLzBoR0lTZEV1ODB4Y3lSTXJ3V2g0L2FjeVZWNzVheGtjd1E5a3BtVWtVeUs3ZldtQTJwVVNPNXVYZndoeWtXcXVobDBUL3hhbVFpMEtGM1hraXFaR3J0Tkk1ZDNTKy9jVjJCWDdPNUJCbnowMEdwT0dINUNhWXdRRGdhVysxY1FRandPcXNMOFprYjhNUzNWbjhYNVgwPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "record_id": "flaws_cloudtrail:0000094:e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "row_index": 94, "timestamp": "2019-02-28T22:51:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "eventTime": "2019-02-28T22:51:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMb01LazNWOEVEK0syOEdRdnVCS013VC9pTjBkNE92bmhwN0o0Mk4zSjVodE5mT3ZIamNQeXNFL3A5R2RvTzBleExLY0x3cXJHZ0gyTS92Q2JGZGt2QzNLV20vNTU2Z0NhN3RKUDUwdFpaK0V4cXR1c1BlVjZ2aXVIQ0tSdzJrZ3RlM3Z2aFZ0RldnL0pZRTBzWHlXWUtCS2Y4OWtOTTFZOFNHcCtubG02bUxCeHhSRG85ZTFidVM5Z1JTeGZzcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ef25097-f66f-4d48-9862-5ef9ce12aa40", "record_id": "flaws_cloudtrail:0000095:3ef25097-f66f-4d48-9862-5ef9ce12aa40", "row_index": 95, "timestamp": "2019-02-28T22:51:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ef25097-f66f-4d48-9862-5ef9ce12aa40", "eventTime": "2019-02-28T22:51:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3OEVLby9sakc2QkFoZ21WRyt4SEpwb2hhWEZ0eUtybDJFYnB2RXZqMUw0WWgvc1Z5S3Uyb0VobTZ0b09od005T2hNTXVwbGFvenVBM0c2ZVZxdnZKdnUwZGJiTWkwd205RllHUlVXcUwyN01IdkswL0xGSnRzNXRleFFTakxRUTdWUlE3eEVCWVVZT09RUzJFdmhINHBhaU4vbjY1a3cyU1lZazd6Ny9USG1ON1VabEF6VlR3WVZGSk1QZWwwOTc5SzJYMnZPQXRKOEhTbWhZTzVXd0w0Y05nc09VZW80PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "record_id": "flaws_cloudtrail:0000096:e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "row_index": 96, "timestamp": "2019-02-28T22:51:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3b8514d-4cf1-4bf3-8dc3-bf473b1abe34", "eventTime": "2019-02-28T22:51:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMb01LazNWOEVEK0syOEdRdnVCS013VC9pTjBkNE92bmhwN0o0Mk4zSjVodE5mT3ZIamNQeXNFL3A5R2RvTzBleExLY0x3cXJHZ0gyTS92Q2JGZGt2QzNLV20vNTU2Z0NhN3RKUDUwdFpaK0V4cXR1c1BlVjZ2aXVIQ0tSdzJrZ3RlM3Z2aFZ0RldnL0pZRTBzWHlXWUtCS2Y4OWtOTTFZOFNHcCtubG02bUxCeHhSRG85ZTFidVM5Z1JTeGZzcz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ef25097-f66f-4d48-9862-5ef9ce12aa40", "record_id": "flaws_cloudtrail:0000097:3ef25097-f66f-4d48-9862-5ef9ce12aa40", "row_index": 97, "timestamp": "2019-02-28T22:51:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ef25097-f66f-4d48-9862-5ef9ce12aa40", "eventTime": "2019-02-28T22:51:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3OEVLby9sakc2QkFoZ21WRyt4SEpwb2hhWEZ0eUtybDJFYnB2RXZqMUw0WWgvc1Z5S3Uyb0VobTZ0b09od005T2hNTXVwbGFvenVBM0c2ZVZxdnZKdnUwZGJiTWkwd205RllHUlVXcUwyN01IdkswL0xGSnRzNXRleFFTakxRUTdWUlE3eEVCWVVZT09RUzJFdmhINHBhaU4vbjY1a3cyU1lZazd6Ny9USG1ON1VabEF6VlR3WVZGSk1QZWwwOTc5SzJYMnZPQXRKOEhTbWhZTzVXd0w0Y05nc09VZW80PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ea95e37-89ba-4d42-a933-fae24d4b3e08", "record_id": "flaws_cloudtrail:0000098:8ea95e37-89ba-4d42-a933-fae24d4b3e08", "row_index": 98, "timestamp": "2019-02-28T22:52:56Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 543, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ea95e37-89ba-4d42-a933-fae24d4b3e08", "eventTime": "2019-02-28T22:52:56Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}, "requestParameters": {"userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce74f243-608d-4347-98c0-4be7b95e0559", "record_id": "flaws_cloudtrail:0000099:ce74f243-608d-4347-98c0-4be7b95e0559", "row_index": 99, "timestamp": "2019-02-28T22:55:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/backup-elevated-12"], "raw_record_size_bytes": 697, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce74f243-608d-4347-98c0-4be7b95e0559", "eventTime": "2019-02-28T22:55:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/backup-elevated-12", "roleSessionName": "backup-session"}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/backup-elevated-12"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5c005df-80bd-4b06-b76a-e8a1c9925cd0", "record_id": "flaws_cloudtrail:0000100:d5c005df-80bd-4b06-b76a-e8a1c9925cd0", "row_index": 100, "timestamp": "2019-02-28T22:57:07Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAYCM350RE648DFILZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.183.107.223", "user_agent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:s3:::prod-data-9292"], "raw_record_size_bytes": 630, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5c005df-80bd-4b06-b76a-e8a1c9925cd0", "eventTime": "2019-02-28T22:57:07Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.183.107.223", "userAgent": "Boto3/1.16.51 Python/3.7.10 Linux/4.14.225 Botocore/1.19.51", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAYCM350RE648DFILZ", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-9292", "key": "reports/198.csv"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-9292"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "133e85ce-0e94-4c5e-95a6-648b49607", "record_id": "flaws_cloudtrail:0000101:133e85ce-0e94-4c5e-95a6-648b49607", "row_index": 101, "timestamp": "2019-02-28T23:03:51Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "133e85ce-0e94-4c5e-95a6-648b49607", "eventTime": "2019-02-28T23:03:51Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "133e85ce-0e94-4c5e-95a6-648b49607", "record_id": "flaws_cloudtrail:0000102:133e85ce-0e94-4c5e-95a6-648b49607", "row_index": 102, "timestamp": "2019-02-28T23:03:51Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "133e85ce-0e94-4c5e-95a6-648b49607", "eventTime": "2019-02-28T23:03:51Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "451aec7d-bdf8-46c9-9279-48bc9cda20b0", "record_id": "flaws_cloudtrail:0000103:451aec7d-bdf8-46c9-9279-48bc9cda20b0", "row_index": 103, "timestamp": "2019-02-28T23:06:21Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "451aec7d-bdf8-46c9-9279-48bc9cda20b0", "eventTime": "2019-02-28T23:06:21Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "451aec7d-bdf8-46c9-9279-48bc9cda20b0", "record_id": "flaws_cloudtrail:0000104:451aec7d-bdf8-46c9-9279-48bc9cda20b0", "row_index": 104, "timestamp": "2019-02-28T23:06:21Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "451aec7d-bdf8-46c9-9279-48bc9cda20b0", "eventTime": "2019-02-28T23:06:21Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7eebe0c7-e483-4922-957c-74da4ab34b7e", "record_id": "flaws_cloudtrail:0000105:7eebe0c7-e483-4922-957c-74da4ab34b7e", "row_index": 105, "timestamp": "2019-02-28T23:07:24Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7eebe0c7-e483-4922-957c-74da4ab34b7e", "eventTime": "2019-02-28T23:07:24Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7eebe0c7-e483-4922-957c-74da4ab34b7e", "record_id": "flaws_cloudtrail:0000106:7eebe0c7-e483-4922-957c-74da4ab34b7e", "row_index": 106, "timestamp": "2019-02-28T23:07:24Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7eebe0c7-e483-4922-957c-74da4ab34b7e", "eventTime": "2019-02-28T23:07:24Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ba26c9b-f0a9-4929-b639-6d6fb893d097", "record_id": "flaws_cloudtrail:0000107:7ba26c9b-f0a9-4929-b639-6d6fb893d097", "row_index": 107, "timestamp": "2019-02-28T23:07:54Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ba26c9b-f0a9-4929-b639-6d6fb893d097", "eventTime": "2019-02-28T23:07:54Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ba26c9b-f0a9-4929-b639-6d6fb893d097", "record_id": "flaws_cloudtrail:0000108:7ba26c9b-f0a9-4929-b639-6d6fb893d097", "row_index": 108, "timestamp": "2019-02-28T23:07:54Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "179.83.215.238", "user_agent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ba26c9b-f0a9-4929-b639-6d6fb893d097", "eventTime": "2019-02-28T23:07:54Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "179.83.215.238", "userAgent": "aws-cli/1.16.100 Python/3.7.2 Darwin/18.2.0 botocore/1.12.90", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eda6668f-7bfd-402e-b86e-082ebbc59307", "record_id": "flaws_cloudtrail:0000109:eda6668f-7bfd-402e-b86e-082ebbc59307", "row_index": 109, "timestamp": "2019-02-28T23:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eda6668f-7bfd-402e-b86e-082ebbc59307", "eventTime": "2019-02-28T23:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA69BKEL1OGKLCFTVJ", "expiration": "Mar 1, 2019 5:26:48 AM", "sessionToken": "FQoGZXIvYXdzEPH//////////wEaDOuIf6JrPnIUsg4z7iK3Ay3s+C8n6CrsFiSfZzhdCFQb7vVq/yX617N8GQphyDjdaDmeVQ07yE4WnOTJUSxIV3s4FI+y359tWG2Ez37Gumfjg8yHaOwhpLz2nlFUs5/dp/JaE8B3mMyXKfgEVLXA4A5FEB1uA0Xnr/7RMn8mh9TD118koucI9EyHWrpYAIuDuF+bsLqBwwI7h4FYbtoMBNV7rnrR57/luSmpEou/f3GBgLuPU3u8OFrWulcrQb8FydmFKEWZDLP98BI02oyOHIeVZNzyRSruzDYsKCq+lFr9HPIbxL7d5QknYb1k1/pZKUrdNSDIkGh+tgIbAInMfiFuzQ1dj/aL1hHQSbG8oDNWSw5TvlzAQidsZD4lfd8N+LLabKczWNrDZEkCwDArv9Zj5LoMCWgOKb+jaqxXdqXuCYu70wj7XAyuI2Mz9V6NuIZJTaDJNKT1Jor189fOHH6PGP/ZXL1a0dGF9C9kreRR4E3edMbP4BWKLr5aJc6nN/rokblRYrvDVzacmlysvfKZktOlQo1/z3jEpPRIDOiW+eduHia4bMWOqNOx1UDfpswQ/uhs9FF7P0ZJ/f6xVnIsYEUxtVIortrh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eda6668f-7bfd-402e-b86e-082ebbc59307", "record_id": "flaws_cloudtrail:0000110:eda6668f-7bfd-402e-b86e-082ebbc59307", "row_index": 110, "timestamp": "2019-02-28T23:22:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1493, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eda6668f-7bfd-402e-b86e-082ebbc59307", "eventTime": "2019-02-28T23:22:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA69BKEL1OGKLCFTVJ", "expiration": "Mar 1, 2019 5:26:48 AM", "sessionToken": "FQoGZXIvYXdzEPH//////////wEaDOuIf6JrPnIUsg4z7iK3Ay3s+C8n6CrsFiSfZzhdCFQb7vVq/yX617N8GQphyDjdaDmeVQ07yE4WnOTJUSxIV3s4FI+y359tWG2Ez37Gumfjg8yHaOwhpLz2nlFUs5/dp/JaE8B3mMyXKfgEVLXA4A5FEB1uA0Xnr/7RMn8mh9TD118koucI9EyHWrpYAIuDuF+bsLqBwwI7h4FYbtoMBNV7rnrR57/luSmpEou/f3GBgLuPU3u8OFrWulcrQb8FydmFKEWZDLP98BI02oyOHIeVZNzyRSruzDYsKCq+lFr9HPIbxL7d5QknYb1k1/pZKUrdNSDIkGh+tgIbAInMfiFuzQ1dj/aL1hHQSbG8oDNWSw5TvlzAQidsZD4lfd8N+LLabKczWNrDZEkCwDArv9Zj5LoMCWgOKb+jaqxXdqXuCYu70wj7XAyuI2Mz9V6NuIZJTaDJNKT1Jor189fOHH6PGP/ZXL1a0dGF9C9kreRR4E3edMbP4BWKLr5aJc6nN/rokblRYrvDVzacmlysvfKZktOlQo1/z3jEpPRIDOiW+eduHia4bMWOqNOx1UDfpswQ/uhs9FF7P0ZJ/f6xVnIsYEUxtVIortrh4wU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe197bdf-6005-42bf-9f6f-478d2210105f", "record_id": "flaws_cloudtrail:0000111:fe197bdf-6005-42bf-9f6f-478d2210105f", "row_index": 111, "timestamp": "2019-02-28T23:52:14Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe197bdf-6005-42bf-9f6f-478d2210105f", "eventTime": "2019-02-28T23:52:14Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe197bdf-6005-42bf-9f6f-478d2210105f", "record_id": "flaws_cloudtrail:0000112:fe197bdf-6005-42bf-9f6f-478d2210105f", "row_index": 112, "timestamp": "2019-02-28T23:52:14Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 816, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe197bdf-6005-42bf-9f6f-478d2210105f", "eventTime": "2019-02-28T23:52:14Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "record_id": "flaws_cloudtrail:0000113:fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "row_index": 113, "timestamp": "2019-02-28T23:54:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "eventTime": "2019-02-28T23:54:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "record_id": "flaws_cloudtrail:0000114:fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "row_index": 114, "timestamp": "2019-02-28T23:54:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbc816a9-de9e-4f08-b381-c0794aa6bf4d", "eventTime": "2019-02-28T23:54:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33264e9e-c7ab-478f-a4b5-eca39a6402e4", "record_id": "flaws_cloudtrail:0000115:33264e9e-c7ab-478f-a4b5-eca39a6402e4", "row_index": 115, "timestamp": "2019-02-28T23:54:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33264e9e-c7ab-478f-a4b5-eca39a6402e4", "eventTime": "2019-02-28T23:54:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMK3FRT2FRbWV5dVBKclZpUDNwMERCYTA0UW9SenY0L3RQVjlvRXgrOURlRjNJWHo0TUhEOWVFVzlKaDR4TDFvZ2pvZm91MzFJeHh6R2VEcGMzZmUxSTBnL2xPT0puWSt2ZnJpYnBweGdjbHkvWTkra3dPbjhsd3cvSEZ5b0NxVDI2WUNteW13WTc1RjR5TGluYTRDaWpYRlZKdzdWRHRBVlZQOXZtQ1E3R0JsbCtwN3Q1RjhIdk1sZzZlUUppWmVyMnJQNGJvWDlCdUhYZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33264e9e-c7ab-478f-a4b5-eca39a6402e4", "record_id": "flaws_cloudtrail:0000116:33264e9e-c7ab-478f-a4b5-eca39a6402e4", "row_index": 116, "timestamp": "2019-02-28T23:54:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33264e9e-c7ab-478f-a4b5-eca39a6402e4", "eventTime": "2019-02-28T23:54:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMK3FRT2FRbWV5dVBKclZpUDNwMERCYTA0UW9SenY0L3RQVjlvRXgrOURlRjNJWHo0TUhEOWVFVzlKaDR4TDFvZ2pvZm91MzFJeHh6R2VEcGMzZmUxSTBnL2xPT0puWSt2ZnJpYnBweGdjbHkvWTkra3dPbjhsd3cvSEZ5b0NxVDI2WUNteW13WTc1RjR5TGluYTRDaWpYRlZKdzdWRHRBVlZQOXZtQ1E3R0JsbCtwN3Q1RjhIdk1sZzZlUUppWmVyMnJQNGJvWDlCdUhYZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70612d1e-5c2d-4a3c-873c-6a9629433239", "record_id": "flaws_cloudtrail:0000117:70612d1e-5c2d-4a3c-873c-6a9629433239", "row_index": 117, "timestamp": "2019-02-28T23:54:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1086, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70612d1e-5c2d-4a3c-873c-6a9629433239", "eventTime": "2019-02-28T23:54:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZbGFpQzRXdHI3Z1FjRUlkakpHNlRyNnE5WGpoaG1Yb29jVnQyd29KbFBodTN5emJ6M0IwdXJObW1UY25HSjZPZERsK0RRUzF4Q1F3OGwzTXlMQTVyTjEyYlNxYXFDNkFFQXQ4VFVtdlBUbjNJTE5CVm5rUlZ2TEJwZG9NZnBWNjdGNWoxUzJ6MDlsVEFVcS9KckJMeDRjYzVlcE14elQ3MGhuck52SlVLN25EZ0I2bVg0NFJPSzU5dEw3cHhlR0pXZzZYeXZDL000dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70612d1e-5c2d-4a3c-873c-6a9629433239", "record_id": "flaws_cloudtrail:0000118:70612d1e-5c2d-4a3c-873c-6a9629433239", "row_index": 118, "timestamp": "2019-02-28T23:54:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1086, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70612d1e-5c2d-4a3c-873c-6a9629433239", "eventTime": "2019-02-28T23:54:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZbGFpQzRXdHI3Z1FjRUlkakpHNlRyNnE5WGpoaG1Yb29jVnQyd29KbFBodTN5emJ6M0IwdXJObW1UY25HSjZPZERsK0RRUzF4Q1F3OGwzTXlMQTVyTjEyYlNxYXFDNkFFQXQ4VFVtdlBUbjNJTE5CVm5rUlZ2TEJwZG9NZnBWNjdGNWoxUzJ6MDlsVEFVcS9KckJMeDRjYzVlcE14elQ3MGhuck52SlVLN25EZ0I2bVg0NFJPSzU5dEw3cHhlR0pXZzZYeXZDL000dz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea85e40f-a355-42be-bddd-f0547182580d", "record_id": "flaws_cloudtrail:0000119:ea85e40f-a355-42be-bddd-f0547182580d", "row_index": 119, "timestamp": "2019-02-28T23:54:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1085, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea85e40f-a355-42be-bddd-f0547182580d", "eventTime": "2019-02-28T23:54:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRSEs4QllYcGdGRWMvb1F0NWhxeGs0bExRR1VKNUl6c3JjSGpVb05TOWxUN1BvVEZqZnAvYUNaNGJVRnFpVUxJYUJvS0RUYlh5Nm4wcUhyN2JvaHNBc2lhVm9mRU8xc3FlS2VwZFVwNTFuaWRndDFDQ0UxTXJSblc0Z2tsUmtOM21kdWVNeWFydTBKVEtMS1ZmODBJa2hnak44VEF1NjMxcWhFVUxaN3dDMGtFL0NwcHExRGVMa1JNUi9NODRSeHR0czg4aDlWVTN3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea85e40f-a355-42be-bddd-f0547182580d", "record_id": "flaws_cloudtrail:0000120:ea85e40f-a355-42be-bddd-f0547182580d", "row_index": 120, "timestamp": "2019-02-28T23:54:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1085, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea85e40f-a355-42be-bddd-f0547182580d", "eventTime": "2019-02-28T23:54:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRSEs4QllYcGdGRWMvb1F0NWhxeGs0bExRR1VKNUl6c3JjSGpVb05TOWxUN1BvVEZqZnAvYUNaNGJVRnFpVUxJYUJvS0RUYlh5Nm4wcUhyN2JvaHNBc2lhVm9mRU8xc3FlS2VwZFVwNTFuaWRndDFDQ0UxTXJSblc0Z2tsUmtOM21kdWVNeWFydTBKVEtMS1ZmODBJa2hnak44VEF1NjMxcWhFVUxaN3dDMGtFL0NwcHExRGVMa1JNUi9NODRSeHR0czg4aDlWVTN3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "record_id": "flaws_cloudtrail:0000121:2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "row_index": 121, "timestamp": "2019-02-28T23:54:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "eventTime": "2019-02-28T23:54:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVQUUxbWw2VVAxWStHMzBSMmJNWmpzME53ZDFOT0VWTFBxQUNHdWFBbmhLUlR1V3JDYmJZdXhuaUVjUlNKRTNDdThmeDNxbldRcnNWVS9WL252MUcwTyttd012YnlLaDl2dmxxK20ySk0yRE9yTXVocXliRnZVRnFzd2VWa2tVMzZJQmQ3NUo2clB0RGZ5cHphZEwvdW5XS1hZVlFLWkF6QXVFZkRKQnJidzBzNGRDV3YyTzdkL3dYaThRQmYveUJObDZrK1JCMlhkQnpBdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "record_id": "flaws_cloudtrail:0000122:2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "row_index": 122, "timestamp": "2019-02-28T23:54:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e7f3c5d-5677-4ac9-b1e8-6d2cf0ec3168", "eventTime": "2019-02-28T23:54:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVQUUxbWw2VVAxWStHMzBSMmJNWmpzME53ZDFOT0VWTFBxQUNHdWFBbmhLUlR1V3JDYmJZdXhuaUVjUlNKRTNDdThmeDNxbldRcnNWVS9WL252MUcwTyttd012YnlLaDl2dmxxK20ySk0yRE9yTXVocXliRnZVRnFzd2VWa2tVMzZJQmQ3NUo2clB0RGZ5cHphZEwvdW5XS1hZVlFLWkF6QXVFZkRKQnJidzBzNGRDV3YyTzdkL3dYaThRQmYveUJObDZrK1JCMlhkQnpBdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fcff043-bae0-4d64-b695-cf81180de362", "record_id": "flaws_cloudtrail:0000123:0fcff043-bae0-4d64-b695-cf81180de362", "row_index": 123, "timestamp": "2019-02-28T23:54:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fcff043-bae0-4d64-b695-cf81180de362", "eventTime": "2019-02-28T23:54:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvdFlENWxraWd4dWlJdjFneVExUzBRY3dMbWpsZDNndHpzUHRVbE1HeXFUZ2l6djlDN05rWTNTenZVdndENWpkekE4RVFkUWJaMTlyZ2lhbkc2L3lSdkhrelhzR01BZXI0bnkvZGJIQ2RHdEMwQTRSYmE3VW1PT1FYVnY4N1JoYndReFU5dGtkWTcwNTJVSUVYdnpPZnhoUFBrMFBobUdIYmF5cDFJOTIwMVhHc2NTZnQ4UTdoNUxDRENiMllwR0tTYU9LVWpPU01hdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fcff043-bae0-4d64-b695-cf81180de362", "record_id": "flaws_cloudtrail:0000124:0fcff043-bae0-4d64-b695-cf81180de362", "row_index": 124, "timestamp": "2019-02-28T23:54:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fcff043-bae0-4d64-b695-cf81180de362", "eventTime": "2019-02-28T23:54:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJvdFlENWxraWd4dWlJdjFneVExUzBRY3dMbWpsZDNndHpzUHRVbE1HeXFUZ2l6djlDN05rWTNTenZVdndENWpkekE4RVFkUWJaMTlyZ2lhbkc2L3lSdkhrelhzR01BZXI0bnkvZGJIQ2RHdEMwQTRSYmE3VW1PT1FYVnY4N1JoYndReFU5dGtkWTcwNTJVSUVYdnpPZnhoUFBrMFBobUdIYmF5cDFJOTIwMVhHc2NTZnQ4UTdoNUxDRENiMllwR0tTYU9LVWpPU01hdz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "record_id": "flaws_cloudtrail:0000125:a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "row_index": 125, "timestamp": "2019-02-28T23:54:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "eventTime": "2019-02-28T23:54:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVZkErbG9mL2hJWWpFWmNsaVFJVEV1OFdwZ2lRc2RYVERFSlZOVHZvR0llVC9yQXN4V3ZYdHBiQzdTcGtjT3BuOTlhRTlNb2NTbzcvN095b2hmVCtZa0EyUjE1LzVMSE5McW9LL28wWFg1cG82OEhXTDE5bGIzcU5iVXkyZElUYmM1U2xQcDRYZVpnTWZRYmRXT0FsclJaR0VqSjM2eHQrSEtSQTFWVGVNOHNnYWZoMzk3Ymk5V3gxdUhVYVRIVXFja2NOdjdjTmxtMEUwUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "record_id": "flaws_cloudtrail:0000126:a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "row_index": 126, "timestamp": "2019-02-28T23:54:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a677e6ad-51fc-4c6c-b8ea-98a3213f60de", "eventTime": "2019-02-28T23:54:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJVZkErbG9mL2hJWWpFWmNsaVFJVEV1OFdwZ2lRc2RYVERFSlZOVHZvR0llVC9yQXN4V3ZYdHBiQzdTcGtjT3BuOTlhRTlNb2NTbzcvN095b2hmVCtZa0EyUjE1LzVMSE5McW9LL28wWFg1cG82OEhXTDE5bGIzcU5iVXkyZElUYmM1U2xQcDRYZVpnTWZRYmRXT0FsclJaR0VqSjM2eHQrSEtSQTFWVGVNOHNnYWZoMzk3Ymk5V3gxdUhVYVRIVXFja2NOdjdjTmxtMEUwUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91ee1687-ce09-4135-a66a-8b331dd5382f", "record_id": "flaws_cloudtrail:0000127:91ee1687-ce09-4135-a66a-8b331dd5382f", "row_index": 127, "timestamp": "2019-02-28T23:54:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91ee1687-ce09-4135-a66a-8b331dd5382f", "eventTime": "2019-02-28T23:54:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5YitaZENjajdMNE1ZWEVTTllBTGNSekNYOEtYUitoUmM4bEZHSG55Y21JUlZxK0pMOEl5Z3JpekZwTjRDYVRUL1NEcHZXTU1zRytud3NoSGcrbEhZTld0K3FrMmRmUjZwdkNPYWJ1T3BmS3ZOQjNjNWNiamswUFFoSlJhSUdjeVpRZW0veWFNMjQ2VTR3Zm5EZ2Q2Z2twejMzaThZekQxcmlBRmhTVG1XOFJKVnMvTTdDU1puZ1B0UmcwdTE1UHdWS3BocWpXSjNkOHBkQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91ee1687-ce09-4135-a66a-8b331dd5382f", "record_id": "flaws_cloudtrail:0000128:91ee1687-ce09-4135-a66a-8b331dd5382f", "row_index": 128, "timestamp": "2019-02-28T23:54:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91ee1687-ce09-4135-a66a-8b331dd5382f", "eventTime": "2019-02-28T23:54:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5YitaZENjajdMNE1ZWEVTTllBTGNSekNYOEtYUitoUmM4bEZHSG55Y21JUlZxK0pMOEl5Z3JpekZwTjRDYVRUL1NEcHZXTU1zRytud3NoSGcrbEhZTld0K3FrMmRmUjZwdkNPYWJ1T3BmS3ZOQjNjNWNiamswUFFoSlJhSUdjeVpRZW0veWFNMjQ2VTR3Zm5EZ2Q2Z2twejMzaThZekQxcmlBRmhTVG1XOFJKVnMvTTdDU1puZ1B0UmcwdTE1UHdWS3BocWpXSjNkOHBkQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83c07c59-6552-4d47-a508-33ad6a626b69", "record_id": "flaws_cloudtrail:0000129:83c07c59-6552-4d47-a508-33ad6a626b69", "row_index": 129, "timestamp": "2019-02-28T23:54:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1086, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83c07c59-6552-4d47-a508-33ad6a626b69", "eventTime": "2019-02-28T23:54:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBd1E3L2RTQXBjMFdrVVJlV2Y4NFJVbjRldy8wZFhWK3JhMko3QjNyVkRGZWpTOFJvMHdBZisxNkYyRXE3Ymc0U1BiYmJxV1QzTTNkRVVLRE5oSHNvTkdXQ0NVTjVZM2pxdXIvdEdHVldITGp6VmFhN3AzZDRCYXlBWStBOG1zeWRzQjVsRWgwcGxIUGVQSzNUZDVWdklvaUQ0cmxnMFRBOENqRnpvUGlIQW4yeXRjQzhpd2F4Y3JFZU1BbXUxVEFWUEJZUkxlbG4vTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83c07c59-6552-4d47-a508-33ad6a626b69", "record_id": "flaws_cloudtrail:0000130:83c07c59-6552-4d47-a508-33ad6a626b69", "row_index": 130, "timestamp": "2019-02-28T23:54:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1086, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83c07c59-6552-4d47-a508-33ad6a626b69", "eventTime": "2019-02-28T23:54:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBd1E3L2RTQXBjMFdrVVJlV2Y4NFJVbjRldy8wZFhWK3JhMko3QjNyVkRGZWpTOFJvMHdBZisxNkYyRXE3Ymc0U1BiYmJxV1QzTTNkRVVLRE5oSHNvTkdXQ0NVTjVZM2pxdXIvdEdHVldITGp6VmFhN3AzZDRCYXlBWStBOG1zeWRzQjVsRWgwcGxIUGVQSzNUZDVWdklvaUQ0cmxnMFRBOENqRnpvUGlIQW4yeXRjQzhpd2F4Y3JFZU1BbXUxVEFWUEJZUkxlbG4vTT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f0699df-ff7b-4c38-9e06-2c384c0429b2", "record_id": "flaws_cloudtrail:0000131:9f0699df-ff7b-4c38-9e06-2c384c0429b2", "row_index": 131, "timestamp": "2019-02-28T23:54:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f0699df-ff7b-4c38-9e06-2c384c0429b2", "eventTime": "2019-02-28T23:54:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFTGVqYlhzUmpIZFpIZzdBVkZGbURSN1RzWFYwSG9UNzh4SlB2STNsU3pXQytGeWk3RGljdW1hWDRZOHgxMEU1SFRrSTE4YjdFOFZueUdSN3hLSjBtVjMvMEhqb0ZkaUQxaG5Hd1hubHBJcUd4YjNmTHdFZHVVaVV0T1JlSjF1YWFKSWZaa0k3R2dDbGpnMG81ZWJHa2sycXRFVlgxaCtGTVVIZExFb210N09Qc3VVV0JUV3FQOFFJQzZMOVI5dEVkQUtDQ1QvRmJTdVlyUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f0699df-ff7b-4c38-9e06-2c384c0429b2", "record_id": "flaws_cloudtrail:0000132:9f0699df-ff7b-4c38-9e06-2c384c0429b2", "row_index": 132, "timestamp": "2019-02-28T23:54:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f0699df-ff7b-4c38-9e06-2c384c0429b2", "eventTime": "2019-02-28T23:54:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFTGVqYlhzUmpIZFpIZzdBVkZGbURSN1RzWFYwSG9UNzh4SlB2STNsU3pXQytGeWk3RGljdW1hWDRZOHgxMEU1SFRrSTE4YjdFOFZueUdSN3hLSjBtVjMvMEhqb0ZkaUQxaG5Hd1hubHBJcUd4YjNmTHdFZHVVaVV0T1JlSjF1YWFKSWZaa0k3R2dDbGpnMG81ZWJHa2sycXRFVlgxaCtGTVVIZExFb210N09Qc3VVV0JUV3FQOFFJQzZMOVI5dEVkQUtDQ1QvRmJTdVlyUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3176b93-72af-4053-a4f8-d538cc84fb55", "record_id": "flaws_cloudtrail:0000133:e3176b93-72af-4053-a4f8-d538cc84fb55", "row_index": 133, "timestamp": "2019-02-28T23:54:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3176b93-72af-4053-a4f8-d538cc84fb55", "eventTime": "2019-02-28T23:54:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0SFVhb1lRL2pXWktaUHczVXM1RmwxWGdSNWlpZ29pL3lMRFpkWi9JYmVWaDdnQ0RtUkhJcktUQ0VpU3VHL2VMeExTSDVsbnltL1lVVy8wZDVsTHlSRXFKeDkvOVVnZDlQbnRHaEN0RnFsSkVQdk1IUG9HTUdyOWQ5RVE2OEZyRlFxbUQ5VXpZUzkvR2oyajQwcDlWNDAxdzErQWtVN0dWWmJWVk16S0pOanpPWkZ6YzhsQmxrUWdyOGFFMTNtU0RVWmZteGo4WFBRRnNlUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3176b93-72af-4053-a4f8-d538cc84fb55", "record_id": "flaws_cloudtrail:0000134:e3176b93-72af-4053-a4f8-d538cc84fb55", "row_index": 134, "timestamp": "2019-02-28T23:54:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3176b93-72af-4053-a4f8-d538cc84fb55", "eventTime": "2019-02-28T23:54:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0SFVhb1lRL2pXWktaUHczVXM1RmwxWGdSNWlpZ29pL3lMRFpkWi9JYmVWaDdnQ0RtUkhJcktUQ0VpU3VHL2VMeExTSDVsbnltL1lVVy8wZDVsTHlSRXFKeDkvOVVnZDlQbnRHaEN0RnFsSkVQdk1IUG9HTUdyOWQ5RVE2OEZyRlFxbUQ5VXpZUzkvR2oyajQwcDlWNDAxdzErQWtVN0dWWmJWVk16S0pOanpPWkZ6YzhsQmxrUWdyOGFFMTNtU0RVWmZteGo4WFBRRnNlUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a139f20b-eeec-47c5-8688-553705e55a43", "record_id": "flaws_cloudtrail:0000135:a139f20b-eeec-47c5-8688-553705e55a43", "row_index": 135, "timestamp": "2019-02-28T23:54:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a139f20b-eeec-47c5-8688-553705e55a43", "eventTime": "2019-02-28T23:54:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKVEt1aWlYYzJGZ05rVVg1dUhUWThzM25sTjNWNkNqd3hzVHMzeHQvSXBkKzVQOGFyQXNCMkR2SWhPbGxoSTQ1a3gvQ1gzSnFNSjZhVWJibmk5SGJTTHRBTlo0dnRITVg3WWthb0h2cnEyU3llTCtlU3JqclRWa0s3NSs0elM4MVZCbTBZSTBJVVlDR2x2bWN4cCt3Wmgwais0d2hocDZYNTYxREJZa01zV3VCek5rZUptUkNCZFlNZEozMXZpS01GNVZIcjhVRUFSaFI3UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a139f20b-eeec-47c5-8688-553705e55a43", "record_id": "flaws_cloudtrail:0000136:a139f20b-eeec-47c5-8688-553705e55a43", "row_index": 136, "timestamp": "2019-02-28T23:54:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a139f20b-eeec-47c5-8688-553705e55a43", "eventTime": "2019-02-28T23:54:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKVEt1aWlYYzJGZ05rVVg1dUhUWThzM25sTjNWNkNqd3hzVHMzeHQvSXBkKzVQOGFyQXNCMkR2SWhPbGxoSTQ1a3gvQ1gzSnFNSjZhVWJibmk5SGJTTHRBTlo0dnRITVg3WWthb0h2cnEyU3llTCtlU3JqclRWa0s3NSs0elM4MVZCbTBZSTBJVVlDR2x2bWN4cCt3Wmgwais0d2hocDZYNTYxREJZa01zV3VCek5rZUptUkNCZFlNZEozMXZpS01GNVZIcjhVRUFSaFI3UT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "786ac59d-1fd0-495b-956e-13cf26d22a1c", "record_id": "flaws_cloudtrail:0000137:786ac59d-1fd0-495b-956e-13cf26d22a1c", "row_index": 137, "timestamp": "2019-02-28T23:54:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "786ac59d-1fd0-495b-956e-13cf26d22a1c", "eventTime": "2019-02-28T23:54:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwUHAwekg3WVQ1SzdvWGtVZDAyM3pTSU1hTGFSTjVxcVRpZ2JIaEd5RFlZR29tcjdhaUZseDVhQXJydlkzbkN3Y1Q5YzRhVGo4WTQ5VjcxQXpNWGNIckd0Z2d0ckRabVhYZXpXdGJZSHNsbEJEejRVNWhJRVRSNnoyck9zZUk5VUhlTzlxVEx5QnFDSXJKNWZJR0czcW5VU3JGNFovTHZqcExydlE5TFRGKzhZSUsyUHBKWTBrWi9JcFF6VUJkSHNTMXE1aUZJK0h3aFJOQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "786ac59d-1fd0-495b-956e-13cf26d22a1c", "record_id": "flaws_cloudtrail:0000138:786ac59d-1fd0-495b-956e-13cf26d22a1c", "row_index": 138, "timestamp": "2019-02-28T23:54:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "786ac59d-1fd0-495b-956e-13cf26d22a1c", "eventTime": "2019-02-28T23:54:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwUHAwekg3WVQ1SzdvWGtVZDAyM3pTSU1hTGFSTjVxcVRpZ2JIaEd5RFlZR29tcjdhaUZseDVhQXJydlkzbkN3Y1Q5YzRhVGo4WTQ5VjcxQXpNWGNIckd0Z2d0ckRabVhYZXpXdGJZSHNsbEJEejRVNWhJRVRSNnoyck9zZUk5VUhlTzlxVEx5QnFDSXJKNWZJR0czcW5VU3JGNFovTHZqcExydlE5TFRGKzhZSUsyUHBKWTBrWi9JcFF6VUJkSHNTMXE1aUZJK0h3aFJOQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "828f5412-0ef4-474f-8ff5-d0c2c463bef7", "record_id": "flaws_cloudtrail:0000139:828f5412-0ef4-474f-8ff5-d0c2c463bef7", "row_index": 139, "timestamp": "2019-02-28T23:54:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "828f5412-0ef4-474f-8ff5-d0c2c463bef7", "eventTime": "2019-02-28T23:54:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxazlZc3RnTnVUVDFwdTVZUklnT0poU05Kd1RZcXh6dUlISFFTQUhsVEl1RnVOb1JvU2lpV3ZKd3pWakYzUDBZZktLbHpYMGM1QmxNYnZ3VlVtUWhWaHBnTHcySk05KzR4SEtkL2hHZzVhVld4Z2JialZ2MUVFZ0hGR2VCZGZES3FKOHc3V3h3V1VvOFhRS3ljU015Q0FZMHNwMUdBTGdic2FodXovY0FEMzRXT0dnNk1FeDNmWFY2Vm9CMkJ0OFVUWDd4c1NrTzIxbVFIQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "record_id": "flaws_cloudtrail:0000140:67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "row_index": 140, "timestamp": "2019-02-28T23:54:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "eventTime": "2019-02-28T23:54:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoVWF6OXllWHdPeCt4N1JOK29JdXBrWUhuRHZucVUzKzZ5dklLc1NJalRCUnhtVTUrVXZsY0VLdSs0VVg4aDZjWTZPckVyTDNFWnJOS3NGbFBOTjRhSUpmOFpteUV0SVlXZktITnhzU01va214aSs2Skk3WElZbmN3Z3ROa1JXZzcvNWNNLzNsZGtNOHhnejBySkpMMFFqQy90amVnZUJjamtjaWQ1d0VxRWwxZ05XeFp0clJQMjJhVUtWaUxmU0R1ZVR5ZVJmbnVKa2pnUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "828f5412-0ef4-474f-8ff5-d0c2c463bef7", "record_id": "flaws_cloudtrail:0000141:828f5412-0ef4-474f-8ff5-d0c2c463bef7", "row_index": 141, "timestamp": "2019-02-28T23:54:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "828f5412-0ef4-474f-8ff5-d0c2c463bef7", "eventTime": "2019-02-28T23:54:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxazlZc3RnTnVUVDFwdTVZUklnT0poU05Kd1RZcXh6dUlISFFTQUhsVEl1RnVOb1JvU2lpV3ZKd3pWakYzUDBZZktLbHpYMGM1QmxNYnZ3VlVtUWhWaHBnTHcySk05KzR4SEtkL2hHZzVhVld4Z2JialZ2MUVFZ0hGR2VCZGZES3FKOHc3V3h3V1VvOFhRS3ljU015Q0FZMHNwMUdBTGdic2FodXovY0FEMzRXT0dnNk1FeDNmWFY2Vm9CMkJ0OFVUWDd4c1NrTzIxbVFIQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "record_id": "flaws_cloudtrail:0000142:67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "row_index": 142, "timestamp": "2019-02-28T23:54:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1094, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67aa0e20-0529-4c9e-b0a2-b0ad3a2c16a3", "eventTime": "2019-02-28T23:54:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoVWF6OXllWHdPeCt4N1JOK29JdXBrWUhuRHZucVUzKzZ5dklLc1NJalRCUnhtVTUrVXZsY0VLdSs0VVg4aDZjWTZPckVyTDNFWnJOS3NGbFBOTjRhSUpmOFpteUV0SVlXZktITnhzU01va214aSs2Skk3WElZbmN3Z3ROa1JXZzcvNWNNLzNsZGtNOHhnejBySkpMMFFqQy90amVnZUJjamtjaWQ1d0VxRWwxZ05XeFp0clJQMjJhVUtWaUxmU0R1ZVR5ZVJmbnVKa2pnUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "record_id": "flaws_cloudtrail:0000143:8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "row_index": 143, "timestamp": "2019-02-28T23:54:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "eventTime": "2019-02-28T23:54:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiR0UxMERFUFZtQzZHOEpWT09BUS9SSzA5M0FaQ25tTjZRajNEVzRqM3BGNEpGaUJIcFRZT09lWU5ibU9RZGZVSW5nWVpYQmdsc1NVRW1LSUtuVG5wd2gxdmdQV21XUElkTGxtbFRtTnhQRy92NjNiNThLbDVhb1FuUEhGcDFEQ0hYOGlNYnRjWm9wUGJLTkQ0Q3FmeVJOQkF3NXMxNkN6czNGWkVSVE42dHFqekRZQUIzcG83OGpKNGU5UUJ6Zz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b51fa76e-9b00-453f-85fa-a3231a5cfc11", "record_id": "flaws_cloudtrail:0000144:b51fa76e-9b00-453f-85fa-a3231a5cfc11", "row_index": 144, "timestamp": "2019-02-28T23:54:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b51fa76e-9b00-453f-85fa-a3231a5cfc11", "eventTime": "2019-02-28T23:54:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUdDlIN1oxVjJmc2lxNFhOSUdpaHNncHV6ekh1SlhYV1BEYjdoZkJHRGRVdDROR3NQdjB1VU5nSkxYYkRDSjRySEVRT09PVUJGSTFWcnJtQUtoam9oTkthVkFZcU1kYVc2Kzl6Zk9OdzdrZ25IdWhLdUU5NWxlUEVHS3ZWOXlMT3ZjMGd3N3FESFZRSkhJd3FYcHpac1lET01rcFYvOUx5bGRlZkUxZTRCZm1NeTlZd2hEck1oVFIydlRraUlpVS9aWnhycWZ3Qm5YdmQwb2NkL2tyNVI0K1lyQi9MWG5RPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "record_id": "flaws_cloudtrail:0000145:8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "row_index": 145, "timestamp": "2019-02-28T23:54:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b5ad8c3-8f2c-4dfa-aba6-c10e56ca7651", "eventTime": "2019-02-28T23:54:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJiR0UxMERFUFZtQzZHOEpWT09BUS9SSzA5M0FaQ25tTjZRajNEVzRqM3BGNEpGaUJIcFRZT09lWU5ibU9RZGZVSW5nWVpYQmdsc1NVRW1LSUtuVG5wd2gxdmdQV21XUElkTGxtbFRtTnhQRy92NjNiNThLbDVhb1FuUEhGcDFEQ0hYOGlNYnRjWm9wUGJLTkQ0Q3FmeVJOQkF3NXMxNkN6czNGWkVSVE42dHFqekRZQUIzcG83OGpKNGU5UUJ6Zz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b51fa76e-9b00-453f-85fa-a3231a5cfc11", "record_id": "flaws_cloudtrail:0000146:b51fa76e-9b00-453f-85fa-a3231a5cfc11", "row_index": 146, "timestamp": "2019-02-28T23:54:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b51fa76e-9b00-453f-85fa-a3231a5cfc11", "eventTime": "2019-02-28T23:54:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUdDlIN1oxVjJmc2lxNFhOSUdpaHNncHV6ekh1SlhYV1BEYjdoZkJHRGRVdDROR3NQdjB1VU5nSkxYYkRDSjRySEVRT09PVUJGSTFWcnJtQUtoam9oTkthVkFZcU1kYVc2Kzl6Zk9OdzdrZ25IdWhLdUU5NWxlUEVHS3ZWOXlMT3ZjMGd3N3FESFZRSkhJd3FYcHpac1lET01rcFYvOUx5bGRlZkUxZTRCZm1NeTlZd2hEck1oVFIydlRraUlpVS9aWnhycWZ3Qm5YdmQwb2NkL2tyNVI0K1lyQi9MWG5RPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bd578dc-ca86-4027-beeb-d5e4e397edd4", "record_id": "flaws_cloudtrail:0000147:8bd578dc-ca86-4027-beeb-d5e4e397edd4", "row_index": 147, "timestamp": "2019-02-28T23:54:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bd578dc-ca86-4027-beeb-d5e4e397edd4", "eventTime": "2019-02-28T23:54:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpcDBhSitMQ1U3amhjL3hqT0xvMnE5RElkbHFQbVF5ckxiUEVPMmRHMFRWSkZKZUpTZnBRYlg5VXVCR0tlZlpaZzF1RVFLYVFGUy80MGxVc3E5RnpkMUUrZlA4ak93KzVPeVlFaTlqMzN1RjZ4VXhkTnlhREZyZ1Evak5lam9ReVpUb3cvWDZ3aVZyL2p6SmNhMExqdnRZVDM0QU0vUWp5Z2tkellUTHVERit2VHNwTnBabVY1QUhoWWtVRE1FRFkrM2o1Q2g3V0xGMUZsS3hoYzR1aEtsMGJ1Nlp4b1U0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bd578dc-ca86-4027-beeb-d5e4e397edd4", "record_id": "flaws_cloudtrail:0000148:8bd578dc-ca86-4027-beeb-d5e4e397edd4", "row_index": 148, "timestamp": "2019-02-28T23:54:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bd578dc-ca86-4027-beeb-d5e4e397edd4", "eventTime": "2019-02-28T23:54:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpcDBhSitMQ1U3amhjL3hqT0xvMnE5RElkbHFQbVF5ckxiUEVPMmRHMFRWSkZKZUpTZnBRYlg5VXVCR0tlZlpaZzF1RVFLYVFGUy80MGxVc3E5RnpkMUUrZlA4ak93KzVPeVlFaTlqMzN1RjZ4VXhkTnlhREZyZ1Evak5lam9ReVpUb3cvWDZ3aVZyL2p6SmNhMExqdnRZVDM0QU0vUWp5Z2tkellUTHVERit2VHNwTnBabVY1QUhoWWtVRE1FRFkrM2o1Q2g3V0xGMUZsS3hoYzR1aEtsMGJ1Nlp4b1U0PSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69dd9afa-bea3-485d-a06d-bbd336a51be3", "record_id": "flaws_cloudtrail:0000149:69dd9afa-bea3-485d-a06d-bbd336a51be3", "row_index": 149, "timestamp": "2019-02-28T23:54:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69dd9afa-bea3-485d-a06d-bbd336a51be3", "eventTime": "2019-02-28T23:54:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzOS9LcnlObEVhTXQ3RThZSENNZWdId2ZuVzhZKzdoY21mdVRDZ1U1ellZbUlFR3NiZVJndG96WFdRdGtCTmEzRnJFZXRhSVNad3NhQ3k1VzdTVXN3SzVQSDJQK0YyK1F4WjVoSFlNQ3RKakNUNTZEUGU4bmp6TEpXUzdHQVh0WXRCY0NHS1laclhzR3grQUZLdUt3Y04yYUpmVHF3My9VenN0L1JRWEVkZHVxUmFUZ0Uzd3BYQW5pdnI2RjdhYzBBSnlOM015dWZSNDlUYTUzditad2FrVnlzc2VnUVpvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcc3f77a-4ce1-4442-811b-fe6909d04844", "record_id": "flaws_cloudtrail:0000150:bcc3f77a-4ce1-4442-811b-fe6909d04844", "row_index": 150, "timestamp": "2019-02-28T23:54:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcc3f77a-4ce1-4442-811b-fe6909d04844", "eventTime": "2019-02-28T23:54:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwalhDcUxwRmd4Rlo4ZGlaVkpocTUycnRJeC9FOU96YXZQRmZNVThML2Ira0lnU2dmYkNDbUZsS2hiMW1TSEtNYmhFZHEyOWpFMmNuNmM1YXplVW5lYkZWSzlkanpwNUN2ZTRlVGlUek9aYjg4M28vaHFOOXJLL1hwajRuZnFlT3RVZ25Gc1pmUklaZzhBZlR3RFVmTzVBOHlvNEVuR3NRUUtJTDZaZ0hEVzQ0Vk9oYkx1dDZORFprNXVhZEQ3WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69dd9afa-bea3-485d-a06d-bbd336a51be3", "record_id": "flaws_cloudtrail:0000151:69dd9afa-bea3-485d-a06d-bbd336a51be3", "row_index": 151, "timestamp": "2019-02-28T23:54:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69dd9afa-bea3-485d-a06d-bbd336a51be3", "eventTime": "2019-02-28T23:54:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzOS9LcnlObEVhTXQ3RThZSENNZWdId2ZuVzhZKzdoY21mdVRDZ1U1ellZbUlFR3NiZVJndG96WFdRdGtCTmEzRnJFZXRhSVNad3NhQ3k1VzdTVXN3SzVQSDJQK0YyK1F4WjVoSFlNQ3RKakNUNTZEUGU4bmp6TEpXUzdHQVh0WXRCY0NHS1laclhzR3grQUZLdUt3Y04yYUpmVHF3My9VenN0L1JRWEVkZHVxUmFUZ0Uzd3BYQW5pdnI2RjdhYzBBSnlOM015dWZSNDlUYTUzditad2FrVnlzc2VnUVpvPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcc3f77a-4ce1-4442-811b-fe6909d04844", "record_id": "flaws_cloudtrail:0000152:bcc3f77a-4ce1-4442-811b-fe6909d04844", "row_index": 152, "timestamp": "2019-02-28T23:54:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcc3f77a-4ce1-4442-811b-fe6909d04844", "eventTime": "2019-02-28T23:54:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwalhDcUxwRmd4Rlo4ZGlaVkpocTUycnRJeC9FOU96YXZQRmZNVThML2Ira0lnU2dmYkNDbUZsS2hiMW1TSEtNYmhFZHEyOWpFMmNuNmM1YXplVW5lYkZWSzlkanpwNUN2ZTRlVGlUek9aYjg4M28vaHFOOXJLL1hwajRuZnFlT3RVZ25Gc1pmUklaZzhBZlR3RFVmTzVBOHlvNEVuR3NRUUtJTDZaZ0hEVzQ0Vk9oYkx1dDZORFprNXVhZEQ3WT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3dcc69c-6611-4c84-9244-868f99e07d59", "record_id": "flaws_cloudtrail:0000153:b3dcc69c-6611-4c84-9244-868f99e07d59", "row_index": 153, "timestamp": "2019-02-28T23:54:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3dcc69c-6611-4c84-9244-868f99e07d59", "eventTime": "2019-02-28T23:54:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRQjBNUmZwbHUwR3l2ZVJFdEt0UnNHd2JEdnlrOWhLa0xSVmhVc2pWTW4xRDdibXNkbVduMzVScERXOXZNWk5lMHRIbzJKTS92Mnk0ckl3ZFVTQ2ZXVkVsVTFMaVh1SWhtZlFLVnViSkVCdEt2QlBRUFBUbGVSU3ppWEJtbStCZ01EWW84SFEreUJoMFNwZGdZV0kwdVIxcnh2cmw5WU1LZitTY2I2UU5zMitnbGtZUVVJWko2M1g3REkrYlBka29WeHg3dHRPOGxBa2ZxckE1U0w4WERRWm9zSFBVMk1VPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34168-8c83-454e-9dbf-20c13dcf52b4", "record_id": "flaws_cloudtrail:0000154:34168-8c83-454e-9dbf-20c13dcf52b4", "row_index": 154, "timestamp": "2019-02-28T23:54:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34168-8c83-454e-9dbf-20c13dcf52b4", "eventTime": "2019-02-28T23:54:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBeUlXWUVyTkRuU2dFYmtocUE4T2xZZUtZcURpVmQ2bGRMd09WOVlIWmwxWm11TzA3S1Z0MU5PcTA0TUcwd20vVW1OWUYxUFdwTGJjR2N3dHBMQlVWd1pRbG1YT0dsKzRyRitvcDZlUHVuQVo5UTRXOUxjY2MybUdhR0cyZllvdXAwcmIvWnBZN2NleDYydWhrMzdaSUVqQWpKYUpLdXJUaG9lOG1aakJXVG1FdjRsV0NsbWRkVkl1blRoaEc3TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3dcc69c-6611-4c84-9244-868f99e07d59", "record_id": "flaws_cloudtrail:0000155:b3dcc69c-6611-4c84-9244-868f99e07d59", "row_index": 155, "timestamp": "2019-02-28T23:54:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3dcc69c-6611-4c84-9244-868f99e07d59", "eventTime": "2019-02-28T23:54:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRQjBNUmZwbHUwR3l2ZVJFdEt0UnNHd2JEdnlrOWhLa0xSVmhVc2pWTW4xRDdibXNkbVduMzVScERXOXZNWk5lMHRIbzJKTS92Mnk0ckl3ZFVTQ2ZXVkVsVTFMaVh1SWhtZlFLVnViSkVCdEt2QlBRUFBUbGVSU3ppWEJtbStCZ01EWW84SFEreUJoMFNwZGdZV0kwdVIxcnh2cmw5WU1LZitTY2I2UU5zMitnbGtZUVVJWko2M1g3REkrYlBka29WeHg3dHRPOGxBa2ZxckE1U0w4WERRWm9zSFBVMk1VPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34168-8c83-454e-9dbf-20c13dcf52b4", "record_id": "flaws_cloudtrail:0000156:34168-8c83-454e-9dbf-20c13dcf52b4", "row_index": 156, "timestamp": "2019-02-28T23:54:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34168-8c83-454e-9dbf-20c13dcf52b4", "eventTime": "2019-02-28T23:54:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBeUlXWUVyTkRuU2dFYmtocUE4T2xZZUtZcURpVmQ2bGRMd09WOVlIWmwxWm11TzA3S1Z0MU5PcTA0TUcwd20vVW1OWUYxUFdwTGJjR2N3dHBMQlVWd1pRbG1YT0dsKzRyRitvcDZlUHVuQVo5UTRXOUxjY2MybUdhR0cyZllvdXAwcmIvWnBZN2NleDYydWhrMzdaSUVqQWpKYUpLdXJUaG9lOG1aakJXVG1FdjRsV0NsbWRkVkl1blRoaEc3TT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "record_id": "flaws_cloudtrail:0000157:a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "row_index": 157, "timestamp": "2019-02-28T23:54:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "eventTime": "2019-02-28T23:54:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNcEEvS1dvY1JZQU1mZGRDK3NKWkpDZ0pNVXBBMVR3YkR6Z1c3dlIxQ1U2N1c0eDFQOXlmV09XZDZNUlUyY21OWDloWmJsTG5YRGpFV2pNOGswVjFCMjRGV2pXZlF6S1hldjRpd1pKbG5OaG5nTkRIbG8rWERUd3Y2aG8xYzZSWFkwN2Q0NVNBanJYZXZQVW5qMkxaOVprWU1XVGEzN3dicGFtWmdJb0N4ZDZBdlloSW13cEcwYm52S01kV3B5NE5XOU5Qdk9UaE5iajdKY3dEOVh3enYrZm5JV096K2FJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a91119-ab31-4943-8114-e85e016955", "record_id": "flaws_cloudtrail:0000158:a91119-ab31-4943-8114-e85e016955", "row_index": 158, "timestamp": "2019-02-28T23:54:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a91119-ab31-4943-8114-e85e016955", "eventTime": "2019-02-28T23:54:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJISGEvNlhiakptemZueVVYUGpRb3NMUUkrdGkzU1puVmtDWWsvbzd4eDR5RmNCN1lYOWIrcXpQTHpvK29Eb1p3dTd1R0kySGhUdEoxZ3VYVjVGZG5oNWtJR0dRc0dPbHZLb1Fsd0xRcm83RTJwRE9yWXNhdS9kRWRQcnRsdnAxRFJvYi9kMndITk9MVm9oam1ISkQ0Qjg2ZUh2YVRIckR2N1hKd1Q2NFMzTVNlaWhDVVRHbjlvSHNTdDFtRnlqaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "record_id": "flaws_cloudtrail:0000159:a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "row_index": 159, "timestamp": "2019-02-28T23:54:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1114, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1fa03e7-ed67-4b68-aa9a-bc7e89b20bd7", "eventTime": "2019-02-28T23:54:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJNcEEvS1dvY1JZQU1mZGRDK3NKWkpDZ0pNVXBBMVR3YkR6Z1c3dlIxQ1U2N1c0eDFQOXlmV09XZDZNUlUyY21OWDloWmJsTG5YRGpFV2pNOGswVjFCMjRGV2pXZlF6S1hldjRpd1pKbG5OaG5nTkRIbG8rWERUd3Y2aG8xYzZSWFkwN2Q0NVNBanJYZXZQVW5qMkxaOVprWU1XVGEzN3dicGFtWmdJb0N4ZDZBdlloSW13cEcwYm52S01kV3B5NE5XOU5Qdk9UaE5iajdKY3dEOVh3enYrZm5JV096K2FJPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a91119-ab31-4943-8114-e85e016955", "record_id": "flaws_cloudtrail:0000160:a91119-ab31-4943-8114-e85e016955", "row_index": 160, "timestamp": "2019-02-28T23:54:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a91119-ab31-4943-8114-e85e016955", "eventTime": "2019-02-28T23:54:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJISGEvNlhiakptemZueVVYUGpRb3NMUUkrdGkzU1puVmtDWWsvbzd4eDR5RmNCN1lYOWIrcXpQTHpvK29Eb1p3dTd1R0kySGhUdEoxZ3VYVjVGZG5oNWtJR0dRc0dPbHZLb1Fsd0xRcm83RTJwRE9yWXNhdS9kRWRQcnRsdnAxRFJvYi9kMndITk9MVm9oam1ISkQ0Qjg2ZUh2YVRIckR2N1hKd1Q2NFMzTVNlaWhDVVRHbjlvSHNTdDFtRnlqaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d145df3-a0cd-475f-907d-e5f2cbf88461", "record_id": "flaws_cloudtrail:0000161:7d145df3-a0cd-475f-907d-e5f2cbf88461", "row_index": 161, "timestamp": "2019-02-28T23:55:01Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d145df3-a0cd-475f-907d-e5f2cbf88461", "eventTime": "2019-02-28T23:55:01Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d145df3-a0cd-475f-907d-e5f2cbf88461", "record_id": "flaws_cloudtrail:0000162:7d145df3-a0cd-475f-907d-e5f2cbf88461", "row_index": 162, "timestamp": "2019-02-28T23:55:01Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d145df3-a0cd-475f-907d-e5f2cbf88461", "eventTime": "2019-02-28T23:55:01Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "record_id": "flaws_cloudtrail:0000163:11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "row_index": 163, "timestamp": "2019-02-28T23:55:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "eventTime": "2019-02-28T23:55:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "record_id": "flaws_cloudtrail:0000164:11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "row_index": 164, "timestamp": "2019-02-28T23:55:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11e9318b-51eb-4e0e-bc13-b9488d3a6e22", "eventTime": "2019-02-28T23:55:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.115 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "record_id": "flaws_cloudtrail:0000165:df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "row_index": 165, "timestamp": "2019-02-28T23:59:01Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "eventTime": "2019-02-28T23:59:01Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "record_id": "flaws_cloudtrail:0000166:df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "row_index": 166, "timestamp": "2019-02-28T23:59:01Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df175304b-16cc-4e30-b7b5-6b7d3cd51f41", "eventTime": "2019-02-28T23:59:01Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.us-west-2.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "record_id": "flaws_cloudtrail:0000167:643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "row_index": 167, "timestamp": "2019-03-01T00:02:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "eventTime": "2019-03-01T00:02:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "record_id": "flaws_cloudtrail:0000168:643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "row_index": 168, "timestamp": "2019-03-01T00:02:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "643b5dd7-b39f-4ecc-9eea-c9ad8c41092e", "eventTime": "2019-03-01T00:02:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c323b98f-e635-4ce3-bf55-5932a8de49c7", "record_id": "flaws_cloudtrail:0000169:c323b98f-e635-4ce3-bf55-5932a8de49c7", "row_index": 169, "timestamp": "2019-03-01T00:02:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c323b98f-e635-4ce3-bf55-5932a8de49c7", "eventTime": "2019-03-01T00:02:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3QTZic1R0WThSa1ZCdi9iVHhkTzNpZmxnNFJKTDFJVFo4WUNtSTdzd1FyQ2NkY1JmZ0l3NjdZak8vOFpmcXRJaUpRWml4VGx3aE5WUnBROGF3RTFPbHAwQ3NtREozWnVnVUVMbC94TSs5R2dSZm1GL1FVVUdjRWZMakU4YXhJcVZLclR4bkV0VTVEdHZSRjBDMDVCVU1uN3UvOExQVGdrN0Q5SkJva1c0dG5PWWE4Tk9BYmwyQ2VuaUJBQ2pRc2J3cnBSRFFkODNSYmdtQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c323b98f-e635-4ce3-bf55-5932a8de49c7", "record_id": "flaws_cloudtrail:0000170:c323b98f-e635-4ce3-bf55-5932a8de49c7", "row_index": 170, "timestamp": "2019-03-01T00:02:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c323b98f-e635-4ce3-bf55-5932a8de49c7", "eventTime": "2019-03-01T00:02:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3QTZic1R0WThSa1ZCdi9iVHhkTzNpZmxnNFJKTDFJVFo4WUNtSTdzd1FyQ2NkY1JmZ0l3NjdZak8vOFpmcXRJaUpRWml4VGx3aE5WUnBROGF3RTFPbHAwQ3NtREozWnVnVUVMbC94TSs5R2dSZm1GL1FVVUdjRWZMakU4YXhJcVZLclR4bkV0VTVEdHZSRjBDMDVCVU1uN3UvOExQVGdrN0Q5SkJva1c0dG5PWWE4Tk9BYmwyQ2VuaUJBQ2pRc2J3cnBSRFFkODNSYmdtQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03507bbd-7e92-4938-a40d-eaea25212a60", "record_id": "flaws_cloudtrail:0000171:03507bbd-7e92-4938-a40d-eaea25212a60", "row_index": 171, "timestamp": "2019-03-01T00:02:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03507bbd-7e92-4938-a40d-eaea25212a60", "eventTime": "2019-03-01T00:02:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjNHZsQzBDRDVrNHZvM1JSQWgwckhjS2RhUXZQNGxhbHcyaWlVc0NLSU1pSlA4MTVBSDZ0RVlyUzVjbUxIdE9sWEQ5a00rOVcwQzM4ay9URDhhcW1YQ2daREdTNFloc25QNU1CYXdveGhXOE0ycTFPd2N5VG13ckFCQmVjNXhQNzkzRXpQUlhHanVTUjNMZ2xzc21zVFFZOUNMTGpWeWJHR2h3elFSZnI5N3J6KzBXMGRkaCtSWlF0azZ1dlg2Sk44NkxBT3g4WU5Qaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03507bbd-7e92-4938-a40d-eaea25212a60", "record_id": "flaws_cloudtrail:0000172:03507bbd-7e92-4938-a40d-eaea25212a60", "row_index": 172, "timestamp": "2019-03-01T00:02:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03507bbd-7e92-4938-a40d-eaea25212a60", "eventTime": "2019-03-01T00:02:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJjNHZsQzBDRDVrNHZvM1JSQWgwckhjS2RhUXZQNGxhbHcyaWlVc0NLSU1pSlA4MTVBSDZ0RVlyUzVjbUxIdE9sWEQ5a00rOVcwQzM4ay9URDhhcW1YQ2daREdTNFloc25QNU1CYXdveGhXOE0ycTFPd2N5VG13ckFCQmVjNXhQNzkzRXpQUlhHanVTUjNMZ2xzc21zVFFZOUNMTGpWeWJHR2h3elFSZnI5N3J6KzBXMGRkaCtSWlF0azZ1dlg2Sk44NkxBT3g4WU5Qaz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d169e68-cff1-4e0f-8d92-1e8a129213", "record_id": "flaws_cloudtrail:0000173:5d169e68-cff1-4e0f-8d92-1e8a129213", "row_index": 173, "timestamp": "2019-03-01T00:03:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d169e68-cff1-4e0f-8d92-1e8a129213", "eventTime": "2019-03-01T00:03:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlTzFaN1hxOUx6Q1V5U0xIaGdDRVJpVEEydGlYSncxdDNPVVJzN0tVRGYvSkwyQmRZdFBWTmdUWVBKOEkwYkIzbG1SMjVBVGF5RG52bElyNFA2T1dJKzlseU1FcXBzOEgzOFhNd3NEa2k3L3oxT0RCaHBibnJJL253VXczUW5zUkNNNzF1QWpTMDJPTExzQzlZVGwyeDBrL0gvVEEySFhkVWRxMTVZVTJkYlFoeDJSTFRqbk9XOVIrS2gvMGd1R21obzFNREF3RXdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d169e68-cff1-4e0f-8d92-1e8a129213", "record_id": "flaws_cloudtrail:0000174:5d169e68-cff1-4e0f-8d92-1e8a129213", "row_index": 174, "timestamp": "2019-03-01T00:03:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1080, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d169e68-cff1-4e0f-8d92-1e8a129213", "eventTime": "2019-03-01T00:03:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlTzFaN1hxOUx6Q1V5U0xIaGdDRVJpVEEydGlYSncxdDNPVVJzN0tVRGYvSkwyQmRZdFBWTmdUWVBKOEkwYkIzbG1SMjVBVGF5RG52bElyNFA2T1dJKzlseU1FcXBzOEgzOFhNd3NEa2k3L3oxT0RCaHBibnJJL253VXczUW5zUkNNNzF1QWpTMDJPTExzQzlZVGwyeDBrL0gvVEEySFhkVWRxMTVZVTJkYlFoeDJSTFRqbk9XOVIrS2gvMGd1R21obzFNREF3RXdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0920b00-3d30-4ef5-a70d-66de0c9575dd", "record_id": "flaws_cloudtrail:0000175:e0920b00-3d30-4ef5-a70d-66de0c9575dd", "row_index": 175, "timestamp": "2019-03-01T00:03:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0920b00-3d30-4ef5-a70d-66de0c9575dd", "eventTime": "2019-03-01T00:03:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaeWhITmF6bElaVXA2bi9XdjdVYmhlTy9GT1dOZEtYWExodGVHUGJxMWlOdjRGdjEvS2g2THNMbjdaOVhDZGl3UlQwYWd0Nk8wSkc0Y2Zkbm9CR2I4NEZreXFKUnlDaU03cHhqZ3VkVndBYlgvTU5GTXRwdkFSRmtmTTBzUk4rVFozZEtRdWZKUWRkS1kzclJIVXFWK2piRnFRdDYyMWNzQnZFOWs5MEt1QmtFWFdXcXliL20yVmZWM0k4cU83U1BuMGkrQk9TRmk1QVczUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0920b00-3d30-4ef5-a70d-66de0c9575dd", "record_id": "flaws_cloudtrail:0000176:e0920b00-3d30-4ef5-a70d-66de0c9575dd", "row_index": 176, "timestamp": "2019-03-01T00:03:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0920b00-3d30-4ef5-a70d-66de0c9575dd", "eventTime": "2019-03-01T00:03:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaeWhITmF6bElaVXA2bi9XdjdVYmhlTy9GT1dOZEtYWExodGVHUGJxMWlOdjRGdjEvS2g2THNMbjdaOVhDZGl3UlQwYWd0Nk8wSkc0Y2Zkbm9CR2I4NEZreXFKUnlDaU03cHhqZ3VkVndBYlgvTU5GTXRwdkFSRmtmTTBzUk4rVFozZEtRdWZKUWRkS1kzclJIVXFWK2piRnFRdDYyMWNzQnZFOWs5MEt1QmtFWFdXcXliL20yVmZWM0k4cU83U1BuMGkrQk9TRmk1QVczUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "748252ab6-b86e-4d42-8fc4-dbd1b83638d", "record_id": "flaws_cloudtrail:0000177:748252ab6-b86e-4d42-8fc4-dbd1b83638d", "row_index": 177, "timestamp": "2019-03-01T00:03:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1082, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "748252ab6-b86e-4d42-8fc4-dbd1b83638d", "eventTime": "2019-03-01T00:03:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4MmJuWm1hSkZiOW52M0VxcDVEbXV3dWNVcTlzZG1kbUYraVh0c0RuMUdkeW9QN0kxcDRQMksyU0czOWFVcW5YZkdlTUsrV3dzL3lLaWJKeTBRSnZ5WmlPY0sxTlhKbU1aaEZqYWNzZmJXNnN3SlN3ajNwVDhMUjJPbytYUGtKL3l3L0lydk5kOHdRYVdJT01wV0ROemRDZGRGd1hJWWJIL0pvQUdLRGtXYjB3ZDdZUmo0OXFZU29naDFCU3pZUlFaUHRyR0k5bkJZUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "748252ab6-b86e-4d42-8fc4-dbd1b83638d", "record_id": "flaws_cloudtrail:0000178:748252ab6-b86e-4d42-8fc4-dbd1b83638d", "row_index": 178, "timestamp": "2019-03-01T00:03:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1082, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "748252ab6-b86e-4d42-8fc4-dbd1b83638d", "eventTime": "2019-03-01T00:03:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4MmJuWm1hSkZiOW52M0VxcDVEbXV3dWNVcTlzZG1kbUYraVh0c0RuMUdkeW9QN0kxcDRQMksyU0czOWFVcW5YZkdlTUsrV3dzL3lLaWJKeTBRSnZ5WmlPY0sxTlhKbU1aaEZqYWNzZmJXNnN3SlN3ajNwVDhMUjJPbytYUGtKL3l3L0lydk5kOHdRYVdJT01wV0ROemRDZGRGd1hJWWJIL0pvQUdLRGtXYjB3ZDdZUmo0OXFZU29naDFCU3pZUlFaUHRyR0k5bkJZUT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdd912622-a219-47e6-be05-ab95cd0cb600", "record_id": "flaws_cloudtrail:0000179:fdd912622-a219-47e6-be05-ab95cd0cb600", "row_index": 179, "timestamp": "2019-03-01T00:03:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdd912622-a219-47e6-be05-ab95cd0cb600", "eventTime": "2019-03-01T00:03:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwbzd6N01TNHorZTFmdThuUVowZXFKaVRhdHNLcC9UMWc4Sld0b2pFb1JFVEFaWGlsakYybC9OVkFYTDE3QUpISUlBRTdaT0EyTTRtbEFLL1UzRjIwMEhrNUNKaVFZb1NpemJIS3dwWHkzcXI2dVJmYjVsMURzcmZ3WGdOVVRRUjdYdVdPaloyYktiODlXMTJlNzZIL2Vxby9jNnlMOGpHYmIyVFpqNUFzQUthU2VtTHpocHhINHBmMXF5SnlsQytQSXVjWmxVcFcyNGY0dz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdd912622-a219-47e6-be05-ab95cd0cb600", "record_id": "flaws_cloudtrail:0000180:fdd912622-a219-47e6-be05-ab95cd0cb600", "row_index": 180, "timestamp": "2019-03-01T00:03:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdd912622-a219-47e6-be05-ab95cd0cb600", "eventTime": "2019-03-01T00:03:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwbzd6N01TNHorZTFmdThuUVowZXFKaVRhdHNLcC9UMWc4Sld0b2pFb1JFVEFaWGlsakYybC9OVkFYTDE3QUpISUlBRTdaT0EyTTRtbEFLL1UzRjIwMEhrNUNKaVFZb1NpemJIS3dwWHkzcXI2dVJmYjVsMURzcmZ3WGdOVVRRUjdYdVdPaloyYktiODlXMTJlNzZIL2Vxby9jNnlMOGpHYmIyVFpqNUFzQUthU2VtTHpocHhINHBmMXF5SnlsQytQSXVjWmxVcFcyNGY0dz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "224a9ae4-2252-41b2-bf2c-f911a42ca29b", "record_id": "flaws_cloudtrail:0000181:224a9ae4-2252-41b2-bf2c-f911a42ca29b", "row_index": 181, "timestamp": "2019-03-01T00:03:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "224a9ae4-2252-41b2-bf2c-f911a42ca29b", "eventTime": "2019-03-01T00:03:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJma0xJclU0MEtsUjdacVF3c0Q5ejVKbGxGY3Jxdi92LzNFWmRMUmFpT1k1MXpOdnRpOVB3TWE2UGJ2MXdRVzhnbWNxaG83TDJYREk2Yk4xSlJFQmRRQVg2ZFRXSitwSS9lWmg1MURJN1FLQVBhblFCU0xhaEJPcEJUVS9OcnB0eHEzZHNXcFNXTnovL2kyWDlnZTJKNHhJTDdhbTJuaFMzQjlxbDFPd1lTQnJ5UXQxQTZWZ3FVdnhOOWtVUGtvZEgzMzJ3UnNMbU1IV25QUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "224a9ae4-2252-41b2-bf2c-f911a42ca29b", "record_id": "flaws_cloudtrail:0000182:224a9ae4-2252-41b2-bf2c-f911a42ca29b", "row_index": 182, "timestamp": "2019-03-01T00:03:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1091, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "224a9ae4-2252-41b2-bf2c-f911a42ca29b", "eventTime": "2019-03-01T00:03:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJma0xJclU0MEtsUjdacVF3c0Q5ejVKbGxGY3Jxdi92LzNFWmRMUmFpT1k1MXpOdnRpOVB3TWE2UGJ2MXdRVzhnbWNxaG83TDJYREk2Yk4xSlJFQmRRQVg2ZFRXSitwSS9lWmg1MURJN1FLQVBhblFCU0xhaEJPcEJUVS9OcnB0eHEzZHNXcFNXTnovL2kyWDlnZTJKNHhJTDdhbTJuaFMzQjlxbDFPd1lTQnJ5UXQxQTZWZ3FVdnhOOWtVUGtvZEgzMzJ3UnNMbU1IV25QUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "record_id": "flaws_cloudtrail:0000183:c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "row_index": 183, "timestamp": "2019-03-01T00:03:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "eventTime": "2019-03-01T00:03:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaS3pUa2U1RWgrMmJkNlR1aGtFYmk0bWd5LzZaUGhDQlFpd0QzQXVyaVZVeWc0Ky9kUUNmbEt5eVhKTXVTait5SDluRnpId25LNWk3eVBPWHpUTHBGTy8rcVpvZTJ1T0RaWEtUY0lhcEVCWk5xMFUra3RSZnhYMmIwZm1pTjFtYXk4RjFnVUFvbkpiM0E0RjVHeFh1TlBadHVhYkIyMnQwN1BrelVxdFc1VUVOZEdpRmw1K2xiUHJNblpFU0F4UW1mOXZhcDh1UHFyMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "record_id": "flaws_cloudtrail:0000184:c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "row_index": 184, "timestamp": "2019-03-01T00:03:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8c71c69-2fc5-4c6c-be66-bf779c96ad0d", "eventTime": "2019-03-01T00:03:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaS3pUa2U1RWgrMmJkNlR1aGtFYmk0bWd5LzZaUGhDQlFpd0QzQXVyaVZVeWc0Ky9kUUNmbEt5eVhKTXVTait5SDluRnpId25LNWk3eVBPWHpUTHBGTy8rcVpvZTJ1T0RaWEtUY0lhcEVCWk5xMFUra3RSZnhYMmIwZm1pTjFtYXk4RjFnVUFvbkpiM0E0RjVHeFh1TlBadHVhYkIyMnQwN1BrelVxdFc1VUVOZEdpRmw1K2xiUHJNblpFU0F4UW1mOXZhcDh1UHFyMD0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ad537b0-6c22-45a6-9d85-4641a6c9b287", "record_id": "flaws_cloudtrail:0000185:7ad537b0-6c22-45a6-9d85-4641a6c9b287", "row_index": 185, "timestamp": "2019-03-01T00:03:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ad537b0-6c22-45a6-9d85-4641a6c9b287", "eventTime": "2019-03-01T00:03:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0ejI4VmZTZk0ycDBYWDQ3c3BqNzVxSS8xRkllNXJHb2g4bGR0ZGQ0aEhISGV0ZkFWYTF0dVhDbFR3Wi9CRjEvNFdSSGwvUHgzalJOYmU3N24reWp4WUpMd3U1c2hHUHpFdjM3bzI2d01GSWY4MUQ2U2hXdGhIam81WUdqSC9pditZQXY5TkhtMXJkby9iZ1dWakx1Rmp6eXRneFhsRGUwRUxEQWRjOS82Q08vcHJyS3YwOGxRYlNhSWlRQStOT2h6ekp6djdhSHhyS3NnZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ad537b0-6c22-45a6-9d85-4641a6c9b287", "record_id": "flaws_cloudtrail:0000186:7ad537b0-6c22-45a6-9d85-4641a6c9b287", "row_index": 186, "timestamp": "2019-03-01T00:03:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1092, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ad537b0-6c22-45a6-9d85-4641a6c9b287", "eventTime": "2019-03-01T00:03:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0ejI4VmZTZk0ycDBYWDQ3c3BqNzVxSS8xRkllNXJHb2g4bGR0ZGQ0aEhISGV0ZkFWYTF0dVhDbFR3Wi9CRjEvNFdSSGwvUHgzalJOYmU3N24reWp4WUpMd3U1c2hHUHpFdjM3bzI2d01GSWY4MUQ2U2hXdGhIam81WUdqSC9pditZQXY5TkhtMXJkby9iZ1dWakx1Rmp6eXRneFhsRGUwRUxEQWRjOS82Q08vcHJyS3YwOGxRYlNhSWlRQStOT2h6ekp6djdhSHhyS3NnZz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0a605a0-7638-436e-bf90-8f818376a09", "record_id": "flaws_cloudtrail:0000187:c0a605a0-7638-436e-bf90-8f818376a09", "row_index": 187, "timestamp": "2019-03-01T00:03:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1090, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0a605a0-7638-436e-bf90-8f818376a09", "eventTime": "2019-03-01T00:03:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsZk82Tk8zNUtYelVtODMydzdaaWFINWpoV3BQRDBkZU9LdXQ4OGNxNnJ5MUFoNEd4d3hmaXcxdTJlb3E5RlpNdHFlTmJpVDFJUlp3ZWZvT3lMVXR5QkZ6Z1dUZGpkTmlMUlkyZVpaYmREWlBOTUhUK09nN0NzS044NUpFbW5xYm5tbDJPdVovNVRiYk1FQUpNMHc1REEzYmFmNkI5VEJRcnpTb2x1NG1VT0crSTM1WUZzd3hkdWh5N3h0MVpad2pRM29aU3BpdnFiOTZxUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0a605a0-7638-436e-bf90-8f818376a09", "record_id": "flaws_cloudtrail:0000188:c0a605a0-7638-436e-bf90-8f818376a09", "row_index": 188, "timestamp": "2019-03-01T00:03:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1090, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0a605a0-7638-436e-bf90-8f818376a09", "eventTime": "2019-03-01T00:03:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsZk82Tk8zNUtYelVtODMydzdaaWFINWpoV3BQRDBkZU9LdXQ4OGNxNnJ5MUFoNEd4d3hmaXcxdTJlb3E5RlpNdHFlTmJpVDFJUlp3ZWZvT3lMVXR5QkZ6Z1dUZGpkTmlMUlkyZVpaYmREWlBOTUhUK09nN0NzS044NUpFbW5xYm5tbDJPdVovNVRiYk1FQUpNMHc1REEzYmFmNkI5VEJRcnpTb2x1NG1VT0crSTM1WUZzd3hkdWh5N3h0MVpad2pRM29aU3BpdnFiOTZxUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08127e-c1d3-43f8-b1c0-34d03ae37f46", "record_id": "flaws_cloudtrail:0000189:08127e-c1d3-43f8-b1c0-34d03ae37f46", "row_index": 189, "timestamp": "2019-03-01T00:05:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 789, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08127e-c1d3-43f8-b1c0-34d03ae37f46", "eventTime": "2019-03-01T00:05:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08127e-c1d3-43f8-b1c0-34d03ae37f46", "record_id": "flaws_cloudtrail:0000190:08127e-c1d3-43f8-b1c0-34d03ae37f46", "row_index": 190, "timestamp": "2019-03-01T00:05:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 789, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08127e-c1d3-43f8-b1c0-34d03ae37f46", "eventTime": "2019-03-01T00:05:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14a0904a-f129-4814-817c-cb67ced3d5b5", "record_id": "flaws_cloudtrail:0000191:14a0904a-f129-4814-817c-cb67ced3d5b5", "row_index": 191, "timestamp": "2019-03-01T00:06:27Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14a0904a-f129-4814-817c-cb67ced3d5b5", "eventTime": "2019-03-01T00:06:27Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14a0904a-f129-4814-817c-cb67ced3d5b5", "record_id": "flaws_cloudtrail:0000192:14a0904a-f129-4814-817c-cb67ced3d5b5", "row_index": 192, "timestamp": "2019-03-01T00:06:27Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14a0904a-f129-4814-817c-cb67ced3d5b5", "eventTime": "2019-03-01T00:06:27Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "record_id": "flaws_cloudtrail:0000193:8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "row_index": 193, "timestamp": "2019-03-01T00:14:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1921, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "eventTime": "2019-03-01T00:14:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGHCCXG1Y7I8THN35", "expiration": "Mar 1, 2019 1:14:21 AM", "sessionToken": "AgoGb3JpZ2luEDQaCXVzLXdlc3QtMiKAAi1qy/mXWRMeNkE2HieDr9Q4VLSzrvJaS85VKoz65//lCooXzwvb92ZRK/hfufngas/8WR66Fmp2alpOlBrnZ3i4Iec3yx9UvfgcCcsC+Wp7K7EVf6J6Ln+9Dz/1q8i4QPRP931v76QXHFmSSgs7NAxT+of7V/CpjJf/mBxGKMlNhtYILiSXkNpVNgqZRli5U61uqeFk50dRW3sDWPso1ouOZZNpZfvxtHMLEQ0zSvBVd3fDyG6SuQK7CGTbU2nKiHbBtMBF5+oYXUUsj1PcKBb1gJwgkr2CvMMH2WIu5xov00O+6l/OjLigpAUhGPU1H57UqLffyD/eN2EUsSSAxSkq6AIIaRAAGgw5NzU0MjYyNjIwMjkiDKdX8czgVlPeCt7yeSrFAmzU7l0RSfDgs8QXOwZHSfSAEd2Je3eEFID/jzYDUGQhBOnBcsojA2sqmK/9T/cC5QfgfboRuYKHRkOYquj7nqCSrnKGeofMqw+CnRYSxsabuVedaTF84v0zLN38uaJtRtcwmFw1D4M+9ZseZrvQb/klOvKdrwd6QO7csLFQIzjl7aEQI/h8EuPWGfq00chRPl5ijz38bp82wGe6/QotJyZGe6K0KGVMsdCLrVqbP9MA4ESTVWrMSmvBmJQLcZAIHoIDuXuGwKRV2EVLxIDf9Vt+sVnhRoi5Y/x4elccXEFdLWukwxIFsOpk1Yp7dsllgED8Zi3nQhcJFYu1+ysE6ETJQsXWtygN90mj29IOlysCnF0SZJNw7O99KQggIef/2lcTrVfAcNdl8YMAXdxOBYmbIb+X5BqLiBcUzA1X4myIELELGEIw3fLh4wU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "record_id": "flaws_cloudtrail:0000194:8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "row_index": 194, "timestamp": "2019-03-01T00:14:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1921, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8fd9b47a-9abd-41d4-be0b-a5da0c4c0d83", "eventTime": "2019-03-01T00:14:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAGHCCXG1Y7I8THN35", "expiration": "Mar 1, 2019 1:14:21 AM", "sessionToken": "AgoGb3JpZ2luEDQaCXVzLXdlc3QtMiKAAi1qy/mXWRMeNkE2HieDr9Q4VLSzrvJaS85VKoz65//lCooXzwvb92ZRK/hfufngas/8WR66Fmp2alpOlBrnZ3i4Iec3yx9UvfgcCcsC+Wp7K7EVf6J6Ln+9Dz/1q8i4QPRP931v76QXHFmSSgs7NAxT+of7V/CpjJf/mBxGKMlNhtYILiSXkNpVNgqZRli5U61uqeFk50dRW3sDWPso1ouOZZNpZfvxtHMLEQ0zSvBVd3fDyG6SuQK7CGTbU2nKiHbBtMBF5+oYXUUsj1PcKBb1gJwgkr2CvMMH2WIu5xov00O+6l/OjLigpAUhGPU1H57UqLffyD/eN2EUsSSAxSkq6AIIaRAAGgw5NzU0MjYyNjIwMjkiDKdX8czgVlPeCt7yeSrFAmzU7l0RSfDgs8QXOwZHSfSAEd2Je3eEFID/jzYDUGQhBOnBcsojA2sqmK/9T/cC5QfgfboRuYKHRkOYquj7nqCSrnKGeofMqw+CnRYSxsabuVedaTF84v0zLN38uaJtRtcwmFw1D4M+9ZseZrvQb/klOvKdrwd6QO7csLFQIzjl7aEQI/h8EuPWGfq00chRPl5ijz38bp82wGe6/QotJyZGe6K0KGVMsdCLrVqbP9MA4ESTVWrMSmvBmJQLcZAIHoIDuXuGwKRV2EVLxIDf9Vt+sVnhRoi5Y/x4elccXEFdLWukwxIFsOpk1Yp7dsllgED8Zi3nQhcJFYu1+ysE6ETJQsXWtygN90mj29IOlysCnF0SZJNw7O99KQggIef/2lcTrVfAcNdl8YMAXdxOBYmbIb+X5BqLiBcUzA1X4myIELELGEIw3fLh4wU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "record_id": "flaws_cloudtrail:0000195:c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "row_index": 195, "timestamp": "2019-03-01T00:14:47Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "eventTime": "2019-03-01T00:14:47Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "record_id": "flaws_cloudtrail:0000196:c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "row_index": 196, "timestamp": "2019-03-01T00:14:47Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c87f2cc6-3e5f-497b-8398-1702dd19cd8a", "eventTime": "2019-03-01T00:14:47Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ccfa881-7223-4155-bd43-c0a36492", "record_id": "flaws_cloudtrail:0000197:6ccfa881-7223-4155-bd43-c0a36492", "row_index": 197, "timestamp": "2019-03-01T00:15:32Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ccfa881-7223-4155-bd43-c0a36492", "eventTime": "2019-03-01T00:15:32Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ccfa881-7223-4155-bd43-c0a36492", "record_id": "flaws_cloudtrail:0000198:6ccfa881-7223-4155-bd43-c0a36492", "row_index": 198, "timestamp": "2019-03-01T00:15:32Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 823, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ccfa881-7223-4155-bd43-c0a36492", "eventTime": "2019-03-01T00:15:32Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87ba8758-a622-4aa1-8d78-22f62469e637", "record_id": "flaws_cloudtrail:0000199:87ba8758-a622-4aa1-8d78-22f62469e637", "row_index": 199, "timestamp": "2019-03-01T00:16:00Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.114 Python/3.6.8 Linux/4.15.0-kali2-amd64 botocore/1.12.104]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87ba8758-a622-4aa1-8d78-22f62469e637", "eventTime": "2019-03-01T00:16:00Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.114 Python/3.6.8 Linux/4.15.0-kali2-amd64 botocore/1.12.104]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87ba8758-a622-4aa1-8d78-22f62469e637", "record_id": "flaws_cloudtrail:0000200:87ba8758-a622-4aa1-8d78-22f62469e637", "row_index": 200, "timestamp": "2019-03-01T00:16:00Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "[aws-cli/1.16.114 Python/3.6.8 Linux/4.15.0-kali2-amd64 botocore/1.12.104]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87ba8758-a622-4aa1-8d78-22f62469e637", "eventTime": "2019-03-01T00:16:00Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "[aws-cli/1.16.114 Python/3.6.8 Linux/4.15.0-kali2-amd64 botocore/1.12.104]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"host": ["s3.amazonaws.com"]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8f0c139-a678-4fab-960e-498decc4f079", "record_id": "flaws_cloudtrail:0000201:c8f0c139-a678-4fab-960e-498decc4f079", "row_index": 201, "timestamp": "2019-03-01T00:16:20Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8f0c139-a678-4fab-960e-498decc4f079", "eventTime": "2019-03-01T00:16:20Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8f0c139-a678-4fab-960e-498decc4f079", "record_id": "flaws_cloudtrail:0000202:c8f0c139-a678-4fab-960e-498decc4f079", "row_index": 202, "timestamp": "2019-03-01T00:16:20Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 837, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8f0c139-a678-4fab-960e-498decc4f079", "eventTime": "2019-03-01T00:16:20Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "aws-cli/1.16.81 Python/3.6.8rc1 Linux/4.18.0-kali3-amd64 botocore/1.12.71", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary on resource: *", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6740d47f-a5e5-429d-94c4-f9f9761e3e72", "record_id": "flaws_cloudtrail:0000203:6740d47f-a5e5-429d-94c4-f9f9761e3e72", "row_index": 203, "timestamp": "2019-03-01T00:19:45Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6740d47f-a5e5-429d-94c4-f9f9761e3e72", "eventTime": "2019-03-01T00:19:45Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6740d47f-a5e5-429d-94c4-f9f9761e3e72", "record_id": "flaws_cloudtrail:0000204:6740d47f-a5e5-429d-94c4-f9f9761e3e72", "row_index": 204, "timestamp": "2019-03-01T00:19:45Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6740d47f-a5e5-429d-94c4-f9f9761e3e72", "eventTime": "2019-03-01T00:19:45Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "record_id": "flaws_cloudtrail:0000205:b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "row_index": 205, "timestamp": "2019-03-01T00:19:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "eventTime": "2019-03-01T00:19:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "record_id": "flaws_cloudtrail:0000206:b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "row_index": 206, "timestamp": "2019-03-01T00:19:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1bb4ab0-a406-41a3-a304-2dd9fec65a45", "eventTime": "2019-03-01T00:19:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "record_id": "flaws_cloudtrail:0000207:0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "row_index": 207, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 679, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "record_id": "flaws_cloudtrail:0000208:fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "row_index": 208, "timestamp": "2019-03-01T00:19:47Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "eventTime": "2019-03-01T00:19:47Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e9d70eb-ff2d-44ae-80b6-a2b233018", "record_id": "flaws_cloudtrail:0000209:8e9d70eb-ff2d-44ae-80b6-a2b233018", "row_index": 209, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 676, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e9d70eb-ff2d-44ae-80b6-a2b233018", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6787a743-314f-479e-b61d-b9f541e5be81", "record_id": "flaws_cloudtrail:0000210:6787a743-314f-479e-b61d-b9f541e5be81", "row_index": 210, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 677, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6787a743-314f-479e-b61d-b9f541e5be81", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "record_id": "flaws_cloudtrail:0000211:0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "row_index": 211, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 679, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e0c665b-9dfd-4f0c-a931-523f6e0827b6", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "record_id": "flaws_cloudtrail:0000212:fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "row_index": 212, "timestamp": "2019-03-01T00:19:47Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fdd7cf01-2b58-4a86-a890-0230b93bb3cd", "eventTime": "2019-03-01T00:19:47Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e9d70eb-ff2d-44ae-80b6-a2b233018", "record_id": "flaws_cloudtrail:0000213:8e9d70eb-ff2d-44ae-80b6-a2b233018", "row_index": 213, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 676, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e9d70eb-ff2d-44ae-80b6-a2b233018", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6787a743-314f-479e-b61d-b9f541e5be81", "record_id": "flaws_cloudtrail:0000214:6787a743-314f-479e-b61d-b9f541e5be81", "row_index": 214, "timestamp": "2019-03-01T00:19:47Z", "event_type": "ListIdentities", "event_source": "ses.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 677, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6787a743-314f-479e-b61d-b9f541e5be81", "eventTime": "2019-03-01T00:19:47Z", "eventName": "ListIdentities", "eventSource": "ses.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be3e0b36-8d32-4f83-ad72-565a3e7c2796", "record_id": "flaws_cloudtrail:0000215:be3e0b36-8d32-4f83-ad72-565a3e7c2796", "row_index": 215, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be3e0b36-8d32-4f83-ad72-565a3e7c2796", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "record_id": "flaws_cloudtrail:0000216:4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "row_index": 216, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "record_id": "flaws_cloudtrail:0000217:51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "row_index": 217, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0e8265e-130a-4624-a9f4-1165d1d734c7", "record_id": "flaws_cloudtrail:0000218:c0e8265e-130a-4624-a9f4-1165d1d734c7", "row_index": 218, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0e8265e-130a-4624-a9f4-1165d1d734c7", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44eca394-0245-4b87-b874-ce10d6626f20", "record_id": "flaws_cloudtrail:0000219:44eca394-0245-4b87-b874-ce10d6626f20", "row_index": 219, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44eca394-0245-4b87-b874-ce10d6626f20", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c1b0858-5ac8-459a-af99-3188ed8a0225", "record_id": "flaws_cloudtrail:0000220:9c1b0858-5ac8-459a-af99-3188ed8a0225", "row_index": 220, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c1b0858-5ac8-459a-af99-3188ed8a0225", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3cd67533-99b6-4847-9fa3-94b05795d573", "record_id": "flaws_cloudtrail:0000221:3cd67533-99b6-4847-9fa3-94b05795d573", "row_index": 221, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3cd67533-99b6-4847-9fa3-94b05795d573", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8136cc43-b83a-44a2-a671-1bd34fb042206", "record_id": "flaws_cloudtrail:0000222:8136cc43-b83a-44a2-a671-1bd34fb042206", "row_index": 222, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8136cc43-b83a-44a2-a671-1bd34fb042206", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "record_id": "flaws_cloudtrail:0000223:4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "row_index": 223, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f47760f8-72f1-48fa-a3a2-e603f651b3cf", "record_id": "flaws_cloudtrail:0000224:f47760f8-72f1-48fa-a3a2-e603f651b3cf", "row_index": 224, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f47760f8-72f1-48fa-a3a2-e603f651b3cf", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be3e0b36-8d32-4f83-ad72-565a3e7c2796", "record_id": "flaws_cloudtrail:0000225:be3e0b36-8d32-4f83-ad72-565a3e7c2796", "row_index": 225, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be3e0b36-8d32-4f83-ad72-565a3e7c2796", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "record_id": "flaws_cloudtrail:0000226:4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "row_index": 226, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f2f6b84-1e49-49c2-85ad-047dcb4216ec", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "record_id": "flaws_cloudtrail:0000227:51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "row_index": 227, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51c434b2-da7a-48ea-b4ad-fa9882f1a0b7", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0e8265e-130a-4624-a9f4-1165d1d734c7", "record_id": "flaws_cloudtrail:0000228:c0e8265e-130a-4624-a9f4-1165d1d734c7", "row_index": 228, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0e8265e-130a-4624-a9f4-1165d1d734c7", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44eca394-0245-4b87-b874-ce10d6626f20", "record_id": "flaws_cloudtrail:0000229:44eca394-0245-4b87-b874-ce10d6626f20", "row_index": 229, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44eca394-0245-4b87-b874-ce10d6626f20", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c1b0858-5ac8-459a-af99-3188ed8a0225", "record_id": "flaws_cloudtrail:0000230:9c1b0858-5ac8-459a-af99-3188ed8a0225", "row_index": 230, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c1b0858-5ac8-459a-af99-3188ed8a0225", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3cd67533-99b6-4847-9fa3-94b05795d573", "record_id": "flaws_cloudtrail:0000231:3cd67533-99b6-4847-9fa3-94b05795d573", "row_index": 231, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3cd67533-99b6-4847-9fa3-94b05795d573", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8136cc43-b83a-44a2-a671-1bd34fb042206", "record_id": "flaws_cloudtrail:0000232:8136cc43-b83a-44a2-a671-1bd34fb042206", "row_index": 232, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8136cc43-b83a-44a2-a671-1bd34fb042206", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "record_id": "flaws_cloudtrail:0000233:4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "row_index": 233, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ff52552-2bae-42c2-b675-cad8e5b9c5cb", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f47760f8-72f1-48fa-a3a2-e603f651b3cf", "record_id": "flaws_cloudtrail:0000234:f47760f8-72f1-48fa-a3a2-e603f651b3cf", "row_index": 234, "timestamp": "2019-03-01T00:19:50Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 724, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f47760f8-72f1-48fa-a3a2-e603f651b3cf", "eventTime": "2019-03-01T00:19:50Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67b95a18-6722-4f7a-8d5f-00995db35345", "record_id": "flaws_cloudtrail:0000235:67b95a18-6722-4f7a-8d5f-00995db35345", "row_index": 235, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67b95a18-6722-4f7a-8d5f-00995db35345", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1cc9fd8-efd2-4c01-afae-649b3122077c", "record_id": "flaws_cloudtrail:0000236:c1cc9fd8-efd2-4c01-afae-649b3122077c", "row_index": 236, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1cc9fd8-efd2-4c01-afae-649b3122077c", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4f514c1-6dac-4bc1-9520-871bf66564f", "record_id": "flaws_cloudtrail:0000237:b4f514c1-6dac-4bc1-9520-871bf66564f", "row_index": 237, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 795, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4f514c1-6dac-4bc1-9520-871bf66564f", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"name": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c65d266b-6ef4-4849-98c0-36cec08a5db4", "record_id": "flaws_cloudtrail:0000238:c65d266b-6ef4-4849-98c0-36cec08a5db4", "row_index": 238, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c65d266b-6ef4-4849-98c0-36cec08a5db4", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "record_id": "flaws_cloudtrail:0000239:985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "row_index": 239, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "255abc9b-b0b8-46b0-a123-b79813cf7", "record_id": "flaws_cloudtrail:0000240:255abc9b-b0b8-46b0-a123-b79813cf7", "row_index": 240, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "255abc9b-b0b8-46b0-a123-b79813cf7", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67b95a18-6722-4f7a-8d5f-00995db35345", "record_id": "flaws_cloudtrail:0000241:67b95a18-6722-4f7a-8d5f-00995db35345", "row_index": 241, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67b95a18-6722-4f7a-8d5f-00995db35345", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1cc9fd8-efd2-4c01-afae-649b3122077c", "record_id": "flaws_cloudtrail:0000242:c1cc9fd8-efd2-4c01-afae-649b3122077c", "row_index": 242, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1cc9fd8-efd2-4c01-afae-649b3122077c", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4f514c1-6dac-4bc1-9520-871bf66564f", "record_id": "flaws_cloudtrail:0000243:b4f514c1-6dac-4bc1-9520-871bf66564f", "row_index": 243, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 795, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4f514c1-6dac-4bc1-9520-871bf66564f", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"name": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c65d266b-6ef4-4849-98c0-36cec08a5db4", "record_id": "flaws_cloudtrail:0000244:c65d266b-6ef4-4849-98c0-36cec08a5db4", "row_index": 244, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c65d266b-6ef4-4849-98c0-36cec08a5db4", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "record_id": "flaws_cloudtrail:0000245:985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "row_index": 245, "timestamp": "2019-03-01T00:19:51Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "985dd67d-662c-4e8a-a2e8-7f1e3be6ebcf", "eventTime": "2019-03-01T00:19:51Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-east-1:745598359964:trail/summitroute-logs"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "255abc9b-b0b8-46b0-a123-b79813cf7", "record_id": "flaws_cloudtrail:0000246:255abc9b-b0b8-46b0-a123-b79813cf7", "row_index": 246, "timestamp": "2019-03-01T00:19:51Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "255abc9b-b0b8-46b0-a123-b79813cf7", "eventTime": "2019-03-01T00:19:51Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95aac31b-99bf-4a87-8e05-532c28e5f7f7", "record_id": "flaws_cloudtrail:0000247:95aac31b-99bf-4a87-8e05-532c28e5f7f7", "row_index": 247, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95aac31b-99bf-4a87-8e05-532c28e5f7f7", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e80284f-9704-4812-8bdc-0854a9e5fd15", "record_id": "flaws_cloudtrail:0000248:e80284f-9704-4812-8bdc-0854a9e5fd15", "row_index": 248, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e80284f-9704-4812-8bdc-0854a9e5fd15", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21542b-1fab-441f-8e40-ec8ada56a37a", "record_id": "flaws_cloudtrail:0000249:21542b-1fab-441f-8e40-ec8ada56a37a", "row_index": 249, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21542b-1fab-441f-8e40-ec8ada56a37a", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "def737ff-e792-4476-a464-0fd553e334048", "record_id": "flaws_cloudtrail:0000250:def737ff-e792-4476-a464-0fd553e334048", "row_index": 250, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "def737ff-e792-4476-a464-0fd553e334048", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f9ebdaa-f913-4911-8c2f-caba79d55c22", "record_id": "flaws_cloudtrail:0000251:3f9ebdaa-f913-4911-8c2f-caba79d55c22", "row_index": 251, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f9ebdaa-f913-4911-8c2f-caba79d55c22", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "658e0440-7405-4efc-a422-57d514af9789", "record_id": "flaws_cloudtrail:0000252:658e0440-7405-4efc-a422-57d514af9789", "row_index": 252, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "658e0440-7405-4efc-a422-57d514af9789", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2967a92f-cb1d-4652-b8d6-ba707815c0dc", "record_id": "flaws_cloudtrail:0000253:2967a92f-cb1d-4652-b8d6-ba707815c0dc", "row_index": 253, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2967a92f-cb1d-4652-b8d6-ba707815c0dc", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95aac31b-99bf-4a87-8e05-532c28e5f7f7", "record_id": "flaws_cloudtrail:0000254:95aac31b-99bf-4a87-8e05-532c28e5f7f7", "row_index": 254, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95aac31b-99bf-4a87-8e05-532c28e5f7f7", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e80284f-9704-4812-8bdc-0854a9e5fd15", "record_id": "flaws_cloudtrail:0000255:e80284f-9704-4812-8bdc-0854a9e5fd15", "row_index": 255, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e80284f-9704-4812-8bdc-0854a9e5fd15", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21542b-1fab-441f-8e40-ec8ada56a37a", "record_id": "flaws_cloudtrail:0000256:21542b-1fab-441f-8e40-ec8ada56a37a", "row_index": 256, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21542b-1fab-441f-8e40-ec8ada56a37a", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "def737ff-e792-4476-a464-0fd553e334048", "record_id": "flaws_cloudtrail:0000257:def737ff-e792-4476-a464-0fd553e334048", "row_index": 257, "timestamp": "2019-03-01T00:19:52Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "def737ff-e792-4476-a464-0fd553e334048", "eventTime": "2019-03-01T00:19:52Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f9ebdaa-f913-4911-8c2f-caba79d55c22", "record_id": "flaws_cloudtrail:0000258:3f9ebdaa-f913-4911-8c2f-caba79d55c22", "row_index": 258, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetTrailStatus", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f9ebdaa-f913-4911-8c2f-caba79d55c22", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetTrailStatus", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"name": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "658e0440-7405-4efc-a422-57d514af9789", "record_id": "flaws_cloudtrail:0000259:658e0440-7405-4efc-a422-57d514af9789", "row_index": 259, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "658e0440-7405-4efc-a422-57d514af9789", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2967a92f-cb1d-4652-b8d6-ba707815c0dc", "record_id": "flaws_cloudtrail:0000260:2967a92f-cb1d-4652-b8d6-ba707815c0dc", "row_index": 260, "timestamp": "2019-03-01T00:19:52Z", "event_type": "GetEventSelectors", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "managementEvent", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2967a92f-cb1d-4652-b8d6-ba707815c0dc", "eventTime": "2019-03-01T00:19:52Z", "eventName": "GetEventSelectors", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"trailName": "arn:aws:cloudtrail:us-west-2:811596193553:trail/cloudtrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf5c9f39-28d0-4692-8201-2597ac1856e7", "record_id": "flaws_cloudtrail:0000261:cf5c9f39-28d0-4692-8201-2597ac1856e7", "row_index": 261, "timestamp": "2019-03-01T00:19:56Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf5c9f39-28d0-4692-8201-2597ac1856e7", "eventTime": "2019-03-01T00:19:56Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf5c9f39-28d0-4692-8201-2597ac1856e7", "record_id": "flaws_cloudtrail:0000262:cf5c9f39-28d0-4692-8201-2597ac1856e7", "row_index": 262, "timestamp": "2019-03-01T00:19:56Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf5c9f39-28d0-4692-8201-2597ac1856e7", "eventTime": "2019-03-01T00:19:56Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8984ebf5-e992-457d-a7a7-f5a52b33c274", "record_id": "flaws_cloudtrail:0000263:8984ebf5-e992-457d-a7a7-f5a52b33c274", "row_index": 263, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8984ebf5-e992-457d-a7a7-f5a52b33c274", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de9bc80d-fa52-4180-ae24-5e22ace7c83e", "record_id": "flaws_cloudtrail:0000264:de9bc80d-fa52-4180-ae24-5e22ace7c83e", "row_index": 264, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de9bc80d-fa52-4180-ae24-5e22ace7c83e", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8faa862-402d-43c9-b546-928d04c5c8dd", "record_id": "flaws_cloudtrail:0000265:c8faa862-402d-43c9-b546-928d04c5c8dd", "row_index": 265, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8faa862-402d-43c9-b546-928d04c5c8dd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "record_id": "flaws_cloudtrail:0000266:7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "row_index": 266, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bd5a455-136a-42dd-8e9e-60483e6f99bf", "record_id": "flaws_cloudtrail:0000267:4bd5a455-136a-42dd-8e9e-60483e6f99bf", "row_index": 267, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bd5a455-136a-42dd-8e9e-60483e6f99bf", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce186742-2679-4544-a6cd-0517649a9338", "record_id": "flaws_cloudtrail:0000268:ce186742-2679-4544-a6cd-0517649a9338", "row_index": 268, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce186742-2679-4544-a6cd-0517649a9338", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "788899b1b-27e9-46f0-a3cf-e56fa8e80676", "record_id": "flaws_cloudtrail:0000269:788899b1b-27e9-46f0-a3cf-e56fa8e80676", "row_index": 269, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "788899b1b-27e9-46f0-a3cf-e56fa8e80676", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d466ae89-d341-4f2c-95f8-2a097e1c80bd", "record_id": "flaws_cloudtrail:0000270:d466ae89-d341-4f2c-95f8-2a097e1c80bd", "row_index": 270, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d466ae89-d341-4f2c-95f8-2a097e1c80bd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9de35e69-7b61-4192-aa30-1be0d86d8135", "record_id": "flaws_cloudtrail:0000271:9de35e69-7b61-4192-aa30-1be0d86d8135", "row_index": 271, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9de35e69-7b61-4192-aa30-1be0d86d8135", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac812d55-548c-449f-a3b8-80811f", "record_id": "flaws_cloudtrail:0000272:ac812d55-548c-449f-a3b8-80811f", "row_index": 272, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 684, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac812d55-548c-449f-a3b8-80811f", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8984ebf5-e992-457d-a7a7-f5a52b33c274", "record_id": "flaws_cloudtrail:0000273:8984ebf5-e992-457d-a7a7-f5a52b33c274", "row_index": 273, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8984ebf5-e992-457d-a7a7-f5a52b33c274", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de9bc80d-fa52-4180-ae24-5e22ace7c83e", "record_id": "flaws_cloudtrail:0000274:de9bc80d-fa52-4180-ae24-5e22ace7c83e", "row_index": 274, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de9bc80d-fa52-4180-ae24-5e22ace7c83e", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8faa862-402d-43c9-b546-928d04c5c8dd", "record_id": "flaws_cloudtrail:0000275:c8faa862-402d-43c9-b546-928d04c5c8dd", "row_index": 275, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8faa862-402d-43c9-b546-928d04c5c8dd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "record_id": "flaws_cloudtrail:0000276:7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "row_index": 276, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7aa5a8e5-fa39-447e-8971-6bb76bf643bd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bd5a455-136a-42dd-8e9e-60483e6f99bf", "record_id": "flaws_cloudtrail:0000277:4bd5a455-136a-42dd-8e9e-60483e6f99bf", "row_index": 277, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bd5a455-136a-42dd-8e9e-60483e6f99bf", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce186742-2679-4544-a6cd-0517649a9338", "record_id": "flaws_cloudtrail:0000278:ce186742-2679-4544-a6cd-0517649a9338", "row_index": 278, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce186742-2679-4544-a6cd-0517649a9338", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "788899b1b-27e9-46f0-a3cf-e56fa8e80676", "record_id": "flaws_cloudtrail:0000279:788899b1b-27e9-46f0-a3cf-e56fa8e80676", "row_index": 279, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "788899b1b-27e9-46f0-a3cf-e56fa8e80676", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d466ae89-d341-4f2c-95f8-2a097e1c80bd", "record_id": "flaws_cloudtrail:0000280:d466ae89-d341-4f2c-95f8-2a097e1c80bd", "row_index": 280, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d466ae89-d341-4f2c-95f8-2a097e1c80bd", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9de35e69-7b61-4192-aa30-1be0d86d8135", "record_id": "flaws_cloudtrail:0000281:9de35e69-7b61-4192-aa30-1be0d86d8135", "row_index": 281, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9de35e69-7b61-4192-aa30-1be0d86d8135", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac812d55-548c-449f-a3b8-80811f", "record_id": "flaws_cloudtrail:0000282:ac812d55-548c-449f-a3b8-80811f", "row_index": 282, "timestamp": "2019-03-01T00:19:57Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 684, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac812d55-548c-449f-a3b8-80811f", "eventTime": "2019-03-01T00:19:57Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "record_id": "flaws_cloudtrail:0000283:4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "row_index": 283, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07e170529-2ce7-4574-b83f-1b9ed7523a6c", "record_id": "flaws_cloudtrail:0000284:07e170529-2ce7-4574-b83f-1b9ed7523a6c", "row_index": 284, "timestamp": "2019-03-01T00:19:59Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07e170529-2ce7-4574-b83f-1b9ed7523a6c", "eventTime": "2019-03-01T00:19:59Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbece284-d99e-47c1-9c2c-40ad6add2a46", "record_id": "flaws_cloudtrail:0000285:bbece284-d99e-47c1-9c2c-40ad6add2a46", "row_index": 285, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbece284-d99e-47c1-9c2c-40ad6add2a46", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"stackName": "Summit-Route-security-assessment-access"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55a348614-58af-425c-b391-d2a6d64ae1e7", "record_id": "flaws_cloudtrail:0000286:55a348614-58af-425c-b391-d2a6d64ae1e7", "row_index": 286, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55a348614-58af-425c-b391-d2a6d64ae1e7", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "649e16d9-2340-4be0-b80a-4e7d9f0a601e", "record_id": "flaws_cloudtrail:0000287:649e16d9-2340-4be0-b80a-4e7d9f0a601e", "row_index": 287, "timestamp": "2019-03-01T00:19:59Z", "event_type": "GetStackPolicy", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "649e16d9-2340-4be0-b80a-4e7d9f0a601e", "eventTime": "2019-03-01T00:19:59Z", "eventName": "GetStackPolicy", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"stackName": "Summit-Route-security-assessment-access"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77a53a22-025c-4af3-841e-7ae2529eaabd", "record_id": "flaws_cloudtrail:0000288:77a53a22-025c-4af3-841e-7ae2529eaabd", "row_index": 288, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77a53a22-025c-4af3-841e-7ae2529eaabd", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "record_id": "flaws_cloudtrail:0000289:68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "row_index": 289, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "record_id": "flaws_cloudtrail:0000290:6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "row_index": 290, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "record_id": "flaws_cloudtrail:0000291:4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "row_index": 291, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4133a11f-9c7c-4ab0-a0fd-d07eab6f4188", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07e170529-2ce7-4574-b83f-1b9ed7523a6c", "record_id": "flaws_cloudtrail:0000292:07e170529-2ce7-4574-b83f-1b9ed7523a6c", "row_index": 292, "timestamp": "2019-03-01T00:19:59Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07e170529-2ce7-4574-b83f-1b9ed7523a6c", "eventTime": "2019-03-01T00:19:59Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbece284-d99e-47c1-9c2c-40ad6add2a46", "record_id": "flaws_cloudtrail:0000293:bbece284-d99e-47c1-9c2c-40ad6add2a46", "row_index": 293, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbece284-d99e-47c1-9c2c-40ad6add2a46", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"stackName": "Summit-Route-security-assessment-access"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55a348614-58af-425c-b391-d2a6d64ae1e7", "record_id": "flaws_cloudtrail:0000294:55a348614-58af-425c-b391-d2a6d64ae1e7", "row_index": 294, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55a348614-58af-425c-b391-d2a6d64ae1e7", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "649e16d9-2340-4be0-b80a-4e7d9f0a601e", "record_id": "flaws_cloudtrail:0000295:649e16d9-2340-4be0-b80a-4e7d9f0a601e", "row_index": 295, "timestamp": "2019-03-01T00:19:59Z", "event_type": "GetStackPolicy", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "649e16d9-2340-4be0-b80a-4e7d9f0a601e", "eventTime": "2019-03-01T00:19:59Z", "eventName": "GetStackPolicy", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"stackName": "Summit-Route-security-assessment-access"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77a53a22-025c-4af3-841e-7ae2529eaabd", "record_id": "flaws_cloudtrail:0000296:77a53a22-025c-4af3-841e-7ae2529eaabd", "row_index": 296, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77a53a22-025c-4af3-841e-7ae2529eaabd", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "record_id": "flaws_cloudtrail:0000297:68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "row_index": 297, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68c9c1c3-85be-4c2d-a83d-0f5800aefa43", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "record_id": "flaws_cloudtrail:0000298:6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "row_index": 298, "timestamp": "2019-03-01T00:19:59Z", "event_type": "DescribeStacks", "event_source": "cloudformation.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c1fb6d4-f9e1-4cc5-a6f4-396cf2c1d725", "eventTime": "2019-03-01T00:19:59Z", "eventName": "DescribeStacks", "eventSource": "cloudformation.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ddc134-0df4-49af-b2df-7d5b65ca0d16", "record_id": "flaws_cloudtrail:0000299:37ddc134-0df4-49af-b2df-7d5b65ca0d16", "row_index": 299, "timestamp": "2019-03-01T00:20:00Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ddc134-0df4-49af-b2df-7d5b65ca0d16", "eventTime": "2019-03-01T00:20:00Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4874fe7-b1ac-4781-911a-8efdbc6e6681", "record_id": "flaws_cloudtrail:0000300:e4874fe7-b1ac-4781-911a-8efdbc6e6681", "row_index": 300, "timestamp": "2019-03-01T00:20:00Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4874fe7-b1ac-4781-911a-8efdbc6e6681", "eventTime": "2019-03-01T00:20:00Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ddc134-0df4-49af-b2df-7d5b65ca0d16", "record_id": "flaws_cloudtrail:0000301:37ddc134-0df4-49af-b2df-7d5b65ca0d16", "row_index": 301, "timestamp": "2019-03-01T00:20:00Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ddc134-0df4-49af-b2df-7d5b65ca0d16", "eventTime": "2019-03-01T00:20:00Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4874fe7-b1ac-4781-911a-8efdbc6e6681", "record_id": "flaws_cloudtrail:0000302:e4874fe7-b1ac-4781-911a-8efdbc6e6681", "row_index": 302, "timestamp": "2019-03-01T00:20:00Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4874fe7-b1ac-4781-911a-8efdbc6e6681", "eventTime": "2019-03-01T00:20:00Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "record_id": "flaws_cloudtrail:0000303:6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "row_index": 303, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22f36bd7-c5e9-4e1b-abac-0646c3767220", "record_id": "flaws_cloudtrail:0000304:22f36bd7-c5e9-4e1b-abac-0646c3767220", "row_index": 304, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22f36bd7-c5e9-4e1b-abac-0646c3767220", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "record_id": "flaws_cloudtrail:0000305:fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "row_index": 305, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db1546b7-9d02-49b2-a422-67e368633a093", "record_id": "flaws_cloudtrail:0000306:db1546b7-9d02-49b2-a422-67e368633a093", "row_index": 306, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db1546b7-9d02-49b2-a422-67e368633a093", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "810fb160-7ebe-433c-817f-47206a99fc54", "record_id": "flaws_cloudtrail:0000307:810fb160-7ebe-433c-817f-47206a99fc54", "row_index": 307, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "810fb160-7ebe-433c-817f-47206a99fc54", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61e8e938-1424-4620-a3e2-a41fff1e36ab", "record_id": "flaws_cloudtrail:0000308:61e8e938-1424-4620-a3e2-a41fff1e36ab", "row_index": 308, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61e8e938-1424-4620-a3e2-a41fff1e36ab", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f18e0ec2-f469-4fac-817f-8c66f3972a90", "record_id": "flaws_cloudtrail:0000309:f18e0ec2-f469-4fac-817f-8c66f3972a90", "row_index": 309, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f18e0ec2-f469-4fac-817f-8c66f3972a90", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34ef64ec-da18-4cd7-b82f-9874fcd3db03", "record_id": "flaws_cloudtrail:0000310:34ef64ec-da18-4cd7-b82f-9874fcd3db03", "row_index": 310, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34ef64ec-da18-4cd7-b82f-9874fcd3db03", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f5a9223-2796-4bc9-a01e-7924bfd5955c", "record_id": "flaws_cloudtrail:0000311:7f5a9223-2796-4bc9-a01e-7924bfd5955c", "row_index": 311, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f5a9223-2796-4bc9-a01e-7924bfd5955c", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f2edb97-1862-4aa8-b6ba-a48309d29979", "record_id": "flaws_cloudtrail:0000312:9f2edb97-1862-4aa8-b6ba-a48309d29979", "row_index": 312, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f2edb97-1862-4aa8-b6ba-a48309d29979", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94d1b18c-a42a-44e3-a562-fb6b987bda90", "record_id": "flaws_cloudtrail:0000313:94d1b18c-a42a-44e3-a562-fb6b987bda90", "row_index": 313, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94d1b18c-a42a-44e3-a562-fb6b987bda90", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "record_id": "flaws_cloudtrail:0000314:9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "row_index": 314, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "298c4bd7-31ae-45a8-b675-540bb5702d6a", "record_id": "flaws_cloudtrail:0000315:298c4bd7-31ae-45a8-b675-540bb5702d6a", "row_index": 315, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "298c4bd7-31ae-45a8-b675-540bb5702d6a", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a58c89d6-55a8-45d1-b95f-184d8e850a88", "record_id": "flaws_cloudtrail:0000316:a58c89d6-55a8-45d1-b95f-184d8e850a88", "row_index": 316, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a58c89d6-55a8-45d1-b95f-184d8e850a88", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "603eda49-2af5-4054-b076-73dbaa856fff", "record_id": "flaws_cloudtrail:0000317:603eda49-2af5-4054-b076-73dbaa856fff", "row_index": 317, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "603eda49-2af5-4054-b076-73dbaa856fff", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e796f96-ebff-473d-b442-75b1adc89cbb", "record_id": "flaws_cloudtrail:0000318:3e796f96-ebff-473d-b442-75b1adc89cbb", "row_index": 318, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e796f96-ebff-473d-b442-75b1adc89cbb", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e98543-1e16-447b-8fe1-e993132a4e24", "record_id": "flaws_cloudtrail:0000319:6e98543-1e16-447b-8fe1-e993132a4e24", "row_index": 319, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e98543-1e16-447b-8fe1-e993132a4e24", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98927c0d-661d-43db-a497-b6e19d04dabc", "record_id": "flaws_cloudtrail:0000320:98927c0d-661d-43db-a497-b6e19d04dabc", "row_index": 320, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98927c0d-661d-43db-a497-b6e19d04dabc", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65e58b2f-ca89-4f71-979d-d153dac9ff18", "record_id": "flaws_cloudtrail:0000321:65e58b2f-ca89-4f71-979d-d153dac9ff18", "row_index": 321, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65e58b2f-ca89-4f71-979d-d153dac9ff18", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d6e97cc-e81b-44eb-ae18-8fda34da3421", "record_id": "flaws_cloudtrail:0000322:8d6e97cc-e81b-44eb-ae18-8fda34da3421", "row_index": 322, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d6e97cc-e81b-44eb-ae18-8fda34da3421", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "record_id": "flaws_cloudtrail:0000323:6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "row_index": 323, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cb99f8b-2855-49ef-bd9e-210d01ed9bed", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22f36bd7-c5e9-4e1b-abac-0646c3767220", "record_id": "flaws_cloudtrail:0000324:22f36bd7-c5e9-4e1b-abac-0646c3767220", "row_index": 324, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22f36bd7-c5e9-4e1b-abac-0646c3767220", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "record_id": "flaws_cloudtrail:0000325:fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "row_index": 325, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa6b13b1-4b1e-4a18-9997-8f01fecfcd8f", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db1546b7-9d02-49b2-a422-67e368633a093", "record_id": "flaws_cloudtrail:0000326:db1546b7-9d02-49b2-a422-67e368633a093", "row_index": 326, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db1546b7-9d02-49b2-a422-67e368633a093", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "810fb160-7ebe-433c-817f-47206a99fc54", "record_id": "flaws_cloudtrail:0000327:810fb160-7ebe-433c-817f-47206a99fc54", "row_index": 327, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "810fb160-7ebe-433c-817f-47206a99fc54", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61e8e938-1424-4620-a3e2-a41fff1e36ab", "record_id": "flaws_cloudtrail:0000328:61e8e938-1424-4620-a3e2-a41fff1e36ab", "row_index": 328, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61e8e938-1424-4620-a3e2-a41fff1e36ab", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f18e0ec2-f469-4fac-817f-8c66f3972a90", "record_id": "flaws_cloudtrail:0000329:f18e0ec2-f469-4fac-817f-8c66f3972a90", "row_index": 329, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f18e0ec2-f469-4fac-817f-8c66f3972a90", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34ef64ec-da18-4cd7-b82f-9874fcd3db03", "record_id": "flaws_cloudtrail:0000330:34ef64ec-da18-4cd7-b82f-9874fcd3db03", "row_index": 330, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34ef64ec-da18-4cd7-b82f-9874fcd3db03", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f5a9223-2796-4bc9-a01e-7924bfd5955c", "record_id": "flaws_cloudtrail:0000331:7f5a9223-2796-4bc9-a01e-7924bfd5955c", "row_index": 331, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f5a9223-2796-4bc9-a01e-7924bfd5955c", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f2edb97-1862-4aa8-b6ba-a48309d29979", "record_id": "flaws_cloudtrail:0000332:9f2edb97-1862-4aa8-b6ba-a48309d29979", "row_index": 332, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f2edb97-1862-4aa8-b6ba-a48309d29979", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94d1b18c-a42a-44e3-a562-fb6b987bda90", "record_id": "flaws_cloudtrail:0000333:94d1b18c-a42a-44e3-a562-fb6b987bda90", "row_index": 333, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94d1b18c-a42a-44e3-a562-fb6b987bda90", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "record_id": "flaws_cloudtrail:0000334:9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "row_index": 334, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf9a5bc-3a94-45fe-9c21-c80dba1d7ec6", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "298c4bd7-31ae-45a8-b675-540bb5702d6a", "record_id": "flaws_cloudtrail:0000335:298c4bd7-31ae-45a8-b675-540bb5702d6a", "row_index": 335, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 731, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "298c4bd7-31ae-45a8-b675-540bb5702d6a", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a58c89d6-55a8-45d1-b95f-184d8e850a88", "record_id": "flaws_cloudtrail:0000336:a58c89d6-55a8-45d1-b95f-184d8e850a88", "row_index": 336, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a58c89d6-55a8-45d1-b95f-184d8e850a88", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "603eda49-2af5-4054-b076-73dbaa856fff", "record_id": "flaws_cloudtrail:0000337:603eda49-2af5-4054-b076-73dbaa856fff", "row_index": 337, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "603eda49-2af5-4054-b076-73dbaa856fff", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e796f96-ebff-473d-b442-75b1adc89cbb", "record_id": "flaws_cloudtrail:0000338:3e796f96-ebff-473d-b442-75b1adc89cbb", "row_index": 338, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e796f96-ebff-473d-b442-75b1adc89cbb", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e98543-1e16-447b-8fe1-e993132a4e24", "record_id": "flaws_cloudtrail:0000339:6e98543-1e16-447b-8fe1-e993132a4e24", "row_index": 339, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e98543-1e16-447b-8fe1-e993132a4e24", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98927c0d-661d-43db-a497-b6e19d04dabc", "record_id": "flaws_cloudtrail:0000340:98927c0d-661d-43db-a497-b6e19d04dabc", "row_index": 340, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98927c0d-661d-43db-a497-b6e19d04dabc", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65e58b2f-ca89-4f71-979d-d153dac9ff18", "record_id": "flaws_cloudtrail:0000341:65e58b2f-ca89-4f71-979d-d153dac9ff18", "row_index": 341, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65e58b2f-ca89-4f71-979d-d153dac9ff18", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d6e97cc-e81b-44eb-ae18-8fda34da3421", "record_id": "flaws_cloudtrail:0000342:8d6e97cc-e81b-44eb-ae18-8fda34da3421", "row_index": 342, "timestamp": "2019-03-01T00:20:13Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d6e97cc-e81b-44eb-ae18-8fda34da3421", "eventTime": "2019-03-01T00:20:13Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "record_id": "flaws_cloudtrail:0000343:018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "row_index": 343, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "559d1a8f-4278-4d7e-a132-60095de747592", "record_id": "flaws_cloudtrail:0000344:559d1a8f-4278-4d7e-a132-60095de747592", "row_index": 344, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "559d1a8f-4278-4d7e-a132-60095de747592", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4666db91-7b41-4ed9-908d-b58408597d5a", "record_id": "flaws_cloudtrail:0000345:4666db91-7b41-4ed9-908d-b58408597d5a", "row_index": 345, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4666db91-7b41-4ed9-908d-b58408597d5a", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f97876-e4ba-448a-a913-538f842e99aa", "record_id": "flaws_cloudtrail:0000346:6f97876-e4ba-448a-a913-538f842e99aa", "row_index": 346, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f97876-e4ba-448a-a913-538f842e99aa", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1289aec6-c333-43ce-be99-d75a0d56ba85", "record_id": "flaws_cloudtrail:0000347:1289aec6-c333-43ce-be99-d75a0d56ba85", "row_index": 347, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1289aec6-c333-43ce-be99-d75a0d56ba85", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "record_id": "flaws_cloudtrail:0000348:ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "row_index": 348, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "record_id": "flaws_cloudtrail:0000349:b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "row_index": 349, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac9afb1c-6df8-4de5-823e-bcce496b328f", "record_id": "flaws_cloudtrail:0000350:ac9afb1c-6df8-4de5-823e-bcce496b328f", "row_index": 350, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac9afb1c-6df8-4de5-823e-bcce496b328f", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ae4863a-ba8e-4a57-84de-a7402db032d2", "record_id": "flaws_cloudtrail:0000351:7ae4863a-ba8e-4a57-84de-a7402db032d2", "row_index": 351, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ae4863a-ba8e-4a57-84de-a7402db032d2", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "record_id": "flaws_cloudtrail:0000352:6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "row_index": 352, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41b27679-f8f0-41af-91ce-aaceb2df3857", "record_id": "flaws_cloudtrail:0000353:41b27679-f8f0-41af-91ce-aaceb2df3857", "row_index": 353, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41b27679-f8f0-41af-91ce-aaceb2df3857", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd7944bf-c346-452f-a810-b9358bb8a0d8", "record_id": "flaws_cloudtrail:0000354:bd7944bf-c346-452f-a810-b9358bb8a0d8", "row_index": 354, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd7944bf-c346-452f-a810-b9358bb8a0d8", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fbe6e80-3b46-4173-b68f-391ecad94fcb", "record_id": "flaws_cloudtrail:0000355:3fbe6e80-3b46-4173-b68f-391ecad94fcb", "row_index": 355, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fbe6e80-3b46-4173-b68f-391ecad94fcb", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06d72a57-b507-4777-a978-8b331253b7669", "record_id": "flaws_cloudtrail:0000356:06d72a57-b507-4777-a978-8b331253b7669", "row_index": 356, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06d72a57-b507-4777-a978-8b331253b7669", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "record_id": "flaws_cloudtrail:0000357:224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "row_index": 357, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "174b7397-7a1f-4de7-bcd7-934695d1d926", "record_id": "flaws_cloudtrail:0000358:174b7397-7a1f-4de7-bcd7-934695d1d926", "row_index": 358, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "174b7397-7a1f-4de7-bcd7-934695d1d926", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d2b1300-d583-451a-99d5-bc13506f8dc9", "record_id": "flaws_cloudtrail:0000359:4d2b1300-d583-451a-99d5-bc13506f8dc9", "row_index": 359, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d2b1300-d583-451a-99d5-bc13506f8dc9", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb0566f1-d4fc-4e7d-97a6-bff120361c6", "record_id": "flaws_cloudtrail:0000360:cb0566f1-d4fc-4e7d-97a6-bff120361c6", "row_index": 360, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb0566f1-d4fc-4e7d-97a6-bff120361c6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "record_id": "flaws_cloudtrail:0000361:3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "row_index": 361, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cc0dbd1-0278-4835-b9f0-0280b08732", "record_id": "flaws_cloudtrail:0000362:1cc0dbd1-0278-4835-b9f0-0280b08732", "row_index": 362, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cc0dbd1-0278-4835-b9f0-0280b08732", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43abef69-8d41-49b5-840d-8783b991f044", "record_id": "flaws_cloudtrail:0000363:43abef69-8d41-49b5-840d-8783b991f044", "row_index": 363, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43abef69-8d41-49b5-840d-8783b991f044", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83205fd7-7541-44fe-af3c-58986b747b7a", "record_id": "flaws_cloudtrail:0000364:83205fd7-7541-44fe-af3c-58986b747b7a", "row_index": 364, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83205fd7-7541-44fe-af3c-58986b747b7a", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4953aa91-1229-4dde-9f8d-7ab85e291fe2", "record_id": "flaws_cloudtrail:0000365:4953aa91-1229-4dde-9f8d-7ab85e291fe2", "row_index": 365, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4953aa91-1229-4dde-9f8d-7ab85e291fe2", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21e8bfbb-1085-4491-be67-f41090aacbb6", "record_id": "flaws_cloudtrail:0000366:21e8bfbb-1085-4491-be67-f41090aacbb6", "row_index": 366, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21e8bfbb-1085-4491-be67-f41090aacbb6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "record_id": "flaws_cloudtrail:0000367:018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "row_index": 367, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "018c6adf-e6dd-48ad-97f9-96bfd0bfa237", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "559d1a8f-4278-4d7e-a132-60095de747592", "record_id": "flaws_cloudtrail:0000368:559d1a8f-4278-4d7e-a132-60095de747592", "row_index": 368, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "559d1a8f-4278-4d7e-a132-60095de747592", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4666db91-7b41-4ed9-908d-b58408597d5a", "record_id": "flaws_cloudtrail:0000369:4666db91-7b41-4ed9-908d-b58408597d5a", "row_index": 369, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4666db91-7b41-4ed9-908d-b58408597d5a", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f97876-e4ba-448a-a913-538f842e99aa", "record_id": "flaws_cloudtrail:0000370:6f97876-e4ba-448a-a913-538f842e99aa", "row_index": 370, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f97876-e4ba-448a-a913-538f842e99aa", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1289aec6-c333-43ce-be99-d75a0d56ba85", "record_id": "flaws_cloudtrail:0000371:1289aec6-c333-43ce-be99-d75a0d56ba85", "row_index": 371, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1289aec6-c333-43ce-be99-d75a0d56ba85", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "record_id": "flaws_cloudtrail:0000372:ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "row_index": 372, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffbcdd4a-a40f-4f8d-b4f7-ac6e37c463175", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "record_id": "flaws_cloudtrail:0000373:b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "row_index": 373, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6272f69-e7ec-47b5-a4e9-d4e8a4eaf8a6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac9afb1c-6df8-4de5-823e-bcce496b328f", "record_id": "flaws_cloudtrail:0000374:ac9afb1c-6df8-4de5-823e-bcce496b328f", "row_index": 374, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac9afb1c-6df8-4de5-823e-bcce496b328f", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ae4863a-ba8e-4a57-84de-a7402db032d2", "record_id": "flaws_cloudtrail:0000375:7ae4863a-ba8e-4a57-84de-a7402db032d2", "row_index": 375, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ae4863a-ba8e-4a57-84de-a7402db032d2", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "record_id": "flaws_cloudtrail:0000376:6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "row_index": 376, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cdd4e86-cc7c-4a88-9486-41b335a9cc94", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41b27679-f8f0-41af-91ce-aaceb2df3857", "record_id": "flaws_cloudtrail:0000377:41b27679-f8f0-41af-91ce-aaceb2df3857", "row_index": 377, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41b27679-f8f0-41af-91ce-aaceb2df3857", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd7944bf-c346-452f-a810-b9358bb8a0d8", "record_id": "flaws_cloudtrail:0000378:bd7944bf-c346-452f-a810-b9358bb8a0d8", "row_index": 378, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd7944bf-c346-452f-a810-b9358bb8a0d8", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fbe6e80-3b46-4173-b68f-391ecad94fcb", "record_id": "flaws_cloudtrail:0000379:3fbe6e80-3b46-4173-b68f-391ecad94fcb", "row_index": 379, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fbe6e80-3b46-4173-b68f-391ecad94fcb", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06d72a57-b507-4777-a978-8b331253b7669", "record_id": "flaws_cloudtrail:0000380:06d72a57-b507-4777-a978-8b331253b7669", "row_index": 380, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06d72a57-b507-4777-a978-8b331253b7669", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "record_id": "flaws_cloudtrail:0000381:224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "row_index": 381, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "224f4818-e6bb-4cbd-a1cf-ea5e591982ab", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "174b7397-7a1f-4de7-bcd7-934695d1d926", "record_id": "flaws_cloudtrail:0000382:174b7397-7a1f-4de7-bcd7-934695d1d926", "row_index": 382, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "174b7397-7a1f-4de7-bcd7-934695d1d926", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d2b1300-d583-451a-99d5-bc13506f8dc9", "record_id": "flaws_cloudtrail:0000383:4d2b1300-d583-451a-99d5-bc13506f8dc9", "row_index": 383, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d2b1300-d583-451a-99d5-bc13506f8dc9", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb0566f1-d4fc-4e7d-97a6-bff120361c6", "record_id": "flaws_cloudtrail:0000384:cb0566f1-d4fc-4e7d-97a6-bff120361c6", "row_index": 384, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-north-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb0566f1-d4fc-4e7d-97a6-bff120361c6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-north-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "record_id": "flaws_cloudtrail:0000385:3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "row_index": 385, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d3b4d3f-b68e-4bed-b14d-693c9d2eb7aa", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cc0dbd1-0278-4835-b9f0-0280b08732", "record_id": "flaws_cloudtrail:0000386:1cc0dbd1-0278-4835-b9f0-0280b08732", "row_index": 386, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cc0dbd1-0278-4835-b9f0-0280b08732", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43abef69-8d41-49b5-840d-8783b991f044", "record_id": "flaws_cloudtrail:0000387:43abef69-8d41-49b5-840d-8783b991f044", "row_index": 387, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43abef69-8d41-49b5-840d-8783b991f044", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83205fd7-7541-44fe-af3c-58986b747b7a", "record_id": "flaws_cloudtrail:0000388:83205fd7-7541-44fe-af3c-58986b747b7a", "row_index": 388, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83205fd7-7541-44fe-af3c-58986b747b7a", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4953aa91-1229-4dde-9f8d-7ab85e291fe2", "record_id": "flaws_cloudtrail:0000389:4953aa91-1229-4dde-9f8d-7ab85e291fe2", "row_index": 389, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4953aa91-1229-4dde-9f8d-7ab85e291fe2", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21e8bfbb-1085-4491-be67-f41090aacbb6", "record_id": "flaws_cloudtrail:0000390:21e8bfbb-1085-4491-be67-f41090aacbb6", "row_index": 390, "timestamp": "2019-03-01T00:20:14Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21e8bfbb-1085-4491-be67-f41090aacbb6", "eventTime": "2019-03-01T00:20:14Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "313bd057-08fe-47a4-822a-04ae8ac5fccd", "record_id": "flaws_cloudtrail:0000391:313bd057-08fe-47a4-822a-04ae8ac5fccd", "row_index": 391, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "313bd057-08fe-47a4-822a-04ae8ac5fccd", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0480d2e5-e2ee-426a-bd99-c3833b525d98", "record_id": "flaws_cloudtrail:0000392:0480d2e5-e2ee-426a-bd99-c3833b525d98", "row_index": 392, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0480d2e5-e2ee-426a-bd99-c3833b525d98", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff47a3f5-be0b-490c-9277-8b998dc238693", "record_id": "flaws_cloudtrail:0000393:ff47a3f5-be0b-490c-9277-8b998dc238693", "row_index": 393, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff47a3f5-be0b-490c-9277-8b998dc238693", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17acd599-f18a-4a75-a8cb-e082c5d253e9", "record_id": "flaws_cloudtrail:0000394:17acd599-f18a-4a75-a8cb-e082c5d253e9", "row_index": 394, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17acd599-f18a-4a75-a8cb-e082c5d253e9", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeab4622-217c-4104-a39a-12b9d0fc1693", "record_id": "flaws_cloudtrail:0000395:aeab4622-217c-4104-a39a-12b9d0fc1693", "row_index": 395, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeab4622-217c-4104-a39a-12b9d0fc1693", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "record_id": "flaws_cloudtrail:0000396:be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "row_index": 396, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97c73c1e-06c3-4174-acc1-2c954b27a744", "record_id": "flaws_cloudtrail:0000397:97c73c1e-06c3-4174-acc1-2c954b27a744", "row_index": 397, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97c73c1e-06c3-4174-acc1-2c954b27a744", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f69cf554-709e-4e52-ba27-647675e6f1", "record_id": "flaws_cloudtrail:0000398:f69cf554-709e-4e52-ba27-647675e6f1", "row_index": 398, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f69cf554-709e-4e52-ba27-647675e6f1", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9146ddfd-cfc3-4191-be86-6b624a536513f", "record_id": "flaws_cloudtrail:0000399:9146ddfd-cfc3-4191-be86-6b624a536513f", "row_index": 399, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9146ddfd-cfc3-4191-be86-6b624a536513f", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c2db985-2ee2-4c98-9bfa-8a42720e954c", "record_id": "flaws_cloudtrail:0000400:3c2db985-2ee2-4c98-9bfa-8a42720e954c", "row_index": 400, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c2db985-2ee2-4c98-9bfa-8a42720e954c", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a78275ca-935e-46bc-955b-2d05cb82c143", "record_id": "flaws_cloudtrail:0000401:a78275ca-935e-46bc-955b-2d05cb82c143", "row_index": 401, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a78275ca-935e-46bc-955b-2d05cb82c143", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5613e42-1f92-4bc4-a80d-e8abecb8a198", "record_id": "flaws_cloudtrail:0000402:e5613e42-1f92-4bc4-a80d-e8abecb8a198", "row_index": 402, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5613e42-1f92-4bc4-a80d-e8abecb8a198", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "record_id": "flaws_cloudtrail:0000403:61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "row_index": 403, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f96d273-b657-4351-a560-03b5ed8b6a6d", "record_id": "flaws_cloudtrail:0000404:1f96d273-b657-4351-a560-03b5ed8b6a6d", "row_index": 404, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f96d273-b657-4351-a560-03b5ed8b6a6d", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a976cca5-572b-486b-a549-8d6a295338bf2", "record_id": "flaws_cloudtrail:0000405:a976cca5-572b-486b-a549-8d6a295338bf2", "row_index": 405, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a976cca5-572b-486b-a549-8d6a295338bf2", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "record_id": "flaws_cloudtrail:0000406:34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "row_index": 406, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 773, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "313bd057-08fe-47a4-822a-04ae8ac5fccd", "record_id": "flaws_cloudtrail:0000407:313bd057-08fe-47a4-822a-04ae8ac5fccd", "row_index": 407, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "313bd057-08fe-47a4-822a-04ae8ac5fccd", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0480d2e5-e2ee-426a-bd99-c3833b525d98", "record_id": "flaws_cloudtrail:0000408:0480d2e5-e2ee-426a-bd99-c3833b525d98", "row_index": 408, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0480d2e5-e2ee-426a-bd99-c3833b525d98", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff47a3f5-be0b-490c-9277-8b998dc238693", "record_id": "flaws_cloudtrail:0000409:ff47a3f5-be0b-490c-9277-8b998dc238693", "row_index": 409, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff47a3f5-be0b-490c-9277-8b998dc238693", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17acd599-f18a-4a75-a8cb-e082c5d253e9", "record_id": "flaws_cloudtrail:0000410:17acd599-f18a-4a75-a8cb-e082c5d253e9", "row_index": 410, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17acd599-f18a-4a75-a8cb-e082c5d253e9", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aeab4622-217c-4104-a39a-12b9d0fc1693", "record_id": "flaws_cloudtrail:0000411:aeab4622-217c-4104-a39a-12b9d0fc1693", "row_index": 411, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aeab4622-217c-4104-a39a-12b9d0fc1693", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "record_id": "flaws_cloudtrail:0000412:be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "row_index": 412, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be9b7fd0-4ad8-4da8-8fa9-4b1a24b81cb7", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97c73c1e-06c3-4174-acc1-2c954b27a744", "record_id": "flaws_cloudtrail:0000413:97c73c1e-06c3-4174-acc1-2c954b27a744", "row_index": 413, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97c73c1e-06c3-4174-acc1-2c954b27a744", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f69cf554-709e-4e52-ba27-647675e6f1", "record_id": "flaws_cloudtrail:0000414:f69cf554-709e-4e52-ba27-647675e6f1", "row_index": 414, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f69cf554-709e-4e52-ba27-647675e6f1", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9146ddfd-cfc3-4191-be86-6b624a536513f", "record_id": "flaws_cloudtrail:0000415:9146ddfd-cfc3-4191-be86-6b624a536513f", "row_index": 415, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9146ddfd-cfc3-4191-be86-6b624a536513f", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c2db985-2ee2-4c98-9bfa-8a42720e954c", "record_id": "flaws_cloudtrail:0000416:3c2db985-2ee2-4c98-9bfa-8a42720e954c", "row_index": 416, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c2db985-2ee2-4c98-9bfa-8a42720e954c", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a78275ca-935e-46bc-955b-2d05cb82c143", "record_id": "flaws_cloudtrail:0000417:a78275ca-935e-46bc-955b-2d05cb82c143", "row_index": 417, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a78275ca-935e-46bc-955b-2d05cb82c143", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5613e42-1f92-4bc4-a80d-e8abecb8a198", "record_id": "flaws_cloudtrail:0000418:e5613e42-1f92-4bc4-a80d-e8abecb8a198", "row_index": 418, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5613e42-1f92-4bc4-a80d-e8abecb8a198", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "record_id": "flaws_cloudtrail:0000419:61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "row_index": 419, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61fac703-3bfc-42d5-bd67-b8bd9e90fcbe", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f96d273-b657-4351-a560-03b5ed8b6a6d", "record_id": "flaws_cloudtrail:0000420:1f96d273-b657-4351-a560-03b5ed8b6a6d", "row_index": 420, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f96d273-b657-4351-a560-03b5ed8b6a6d", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a976cca5-572b-486b-a549-8d6a295338bf2", "record_id": "flaws_cloudtrail:0000421:a976cca5-572b-486b-a549-8d6a295338bf2", "row_index": 421, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a976cca5-572b-486b-a549-8d6a295338bf2", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "record_id": "flaws_cloudtrail:0000422:34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "row_index": 422, "timestamp": "2019-03-01T00:20:15Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 773, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34db6248-6bfb-45b7-a0f3-7bf6c39bf229", "eventTime": "2019-03-01T00:20:15Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66efd7e9-412d-4cfd-b479-18fac9096b15", "record_id": "flaws_cloudtrail:0000423:66efd7e9-412d-4cfd-b479-18fac9096b15", "row_index": 423, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66efd7e9-412d-4cfd-b479-18fac9096b15", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab6efa5d-e7e3-4783-9787-fb342fe57abf", "record_id": "flaws_cloudtrail:0000424:ab6efa5d-e7e3-4783-9787-fb342fe57abf", "row_index": 424, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab6efa5d-e7e3-4783-9787-fb342fe57abf", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21bdf318-8637-49ff-a4e9-7a10d380342b8", "record_id": "flaws_cloudtrail:0000425:21bdf318-8637-49ff-a4e9-7a10d380342b8", "row_index": 425, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21bdf318-8637-49ff-a4e9-7a10d380342b8", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "record_id": "flaws_cloudtrail:0000426:3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "row_index": 426, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b94a74a5-409a-4c11-9fcb-117c93f7d177", "record_id": "flaws_cloudtrail:0000427:b94a74a5-409a-4c11-9fcb-117c93f7d177", "row_index": 427, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b94a74a5-409a-4c11-9fcb-117c93f7d177", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f02d70c3-faa7-4f44-b499-9f62e4179e0f", "record_id": "flaws_cloudtrail:0000428:f02d70c3-faa7-4f44-b499-9f62e4179e0f", "row_index": 428, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f02d70c3-faa7-4f44-b499-9f62e4179e0f", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66efd7e9-412d-4cfd-b479-18fac9096b15", "record_id": "flaws_cloudtrail:0000429:66efd7e9-412d-4cfd-b479-18fac9096b15", "row_index": 429, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66efd7e9-412d-4cfd-b479-18fac9096b15", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab6efa5d-e7e3-4783-9787-fb342fe57abf", "record_id": "flaws_cloudtrail:0000430:ab6efa5d-e7e3-4783-9787-fb342fe57abf", "row_index": 430, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab6efa5d-e7e3-4783-9787-fb342fe57abf", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21bdf318-8637-49ff-a4e9-7a10d380342b8", "record_id": "flaws_cloudtrail:0000431:21bdf318-8637-49ff-a4e9-7a10d380342b8", "row_index": 431, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21bdf318-8637-49ff-a4e9-7a10d380342b8", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "record_id": "flaws_cloudtrail:0000432:3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "row_index": 432, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3820faf5-e25b-4ea7-ba49-6eae47abcbf1", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b94a74a5-409a-4c11-9fcb-117c93f7d177", "record_id": "flaws_cloudtrail:0000433:b94a74a5-409a-4c11-9fcb-117c93f7d177", "row_index": 433, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b94a74a5-409a-4c11-9fcb-117c93f7d177", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f02d70c3-faa7-4f44-b499-9f62e4179e0f", "record_id": "flaws_cloudtrail:0000434:f02d70c3-faa7-4f44-b499-9f62e4179e0f", "row_index": 434, "timestamp": "2019-03-01T00:20:16Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f02d70c3-faa7-4f44-b499-9f62e4179e0f", "eventTime": "2019-03-01T00:20:16Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29a7ea2a-7f10-4103-9349-4060edab9767", "record_id": "flaws_cloudtrail:0000435:29a7ea2a-7f10-4103-9349-4060edab9767", "row_index": 435, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29a7ea2a-7f10-4103-9349-4060edab9767", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "653d0476-2e16-4cd7-b753-b005ef198723", "record_id": "flaws_cloudtrail:0000436:653d0476-2e16-4cd7-b753-b005ef198723", "row_index": 436, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "653d0476-2e16-4cd7-b753-b005ef198723", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15a4a09f-e485-464d-bb14-2da7167b8fc2", "record_id": "flaws_cloudtrail:0000437:15a4a09f-e485-464d-bb14-2da7167b8fc2", "row_index": 437, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15a4a09f-e485-464d-bb14-2da7167b8fc2", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "233429df8-deb2-4054-91c6-8f8ac8831dfd", "record_id": "flaws_cloudtrail:0000438:233429df8-deb2-4054-91c6-8f8ac8831dfd", "row_index": 438, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "233429df8-deb2-4054-91c6-8f8ac8831dfd", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25e3ad9d-d743-42ab-a18b-fcadf1e80702", "record_id": "flaws_cloudtrail:0000439:25e3ad9d-d743-42ab-a18b-fcadf1e80702", "row_index": 439, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25e3ad9d-d743-42ab-a18b-fcadf1e80702", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "record_id": "flaws_cloudtrail:0000440:44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "row_index": 440, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d1b65cb-e96c-4563-9772-1475b0eb9e22", "record_id": "flaws_cloudtrail:0000441:0d1b65cb-e96c-4563-9772-1475b0eb9e22", "row_index": 441, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d1b65cb-e96c-4563-9772-1475b0eb9e22", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f178898-3ce0-491c-9d34-ba16c5af7616", "record_id": "flaws_cloudtrail:0000442:f178898-3ce0-491c-9d34-ba16c5af7616", "row_index": 442, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f178898-3ce0-491c-9d34-ba16c5af7616", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4035bbae-7d2d-413f-8688-0892e2a5ffae", "record_id": "flaws_cloudtrail:0000443:4035bbae-7d2d-413f-8688-0892e2a5ffae", "row_index": 443, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4035bbae-7d2d-413f-8688-0892e2a5ffae", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f212d0af-7235-4a78-b719-49025a5", "record_id": "flaws_cloudtrail:0000444:f212d0af-7235-4a78-b719-49025a5", "row_index": 444, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f212d0af-7235-4a78-b719-49025a5", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea3525c6-71e5-45e1-bc5b-f26255a58b77", "record_id": "flaws_cloudtrail:0000445:ea3525c6-71e5-45e1-bc5b-f26255a58b77", "row_index": 445, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea3525c6-71e5-45e1-bc5b-f26255a58b77", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c1b69fe-ccce-4ac1-9871-f5955d632df5", "record_id": "flaws_cloudtrail:0000446:7c1b69fe-ccce-4ac1-9871-f5955d632df5", "row_index": 446, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c1b69fe-ccce-4ac1-9871-f5955d632df5", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c63b68d-963a-4e70-aaae-e0f51187a612", "record_id": "flaws_cloudtrail:0000447:4c63b68d-963a-4e70-aaae-e0f51187a612", "row_index": 447, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c63b68d-963a-4e70-aaae-e0f51187a612", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "record_id": "flaws_cloudtrail:0000448:a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "row_index": 448, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "29a7ea2a-7f10-4103-9349-4060edab9767", "record_id": "flaws_cloudtrail:0000449:29a7ea2a-7f10-4103-9349-4060edab9767", "row_index": 449, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "29a7ea2a-7f10-4103-9349-4060edab9767", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "653d0476-2e16-4cd7-b753-b005ef198723", "record_id": "flaws_cloudtrail:0000450:653d0476-2e16-4cd7-b753-b005ef198723", "row_index": 450, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "653d0476-2e16-4cd7-b753-b005ef198723", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15a4a09f-e485-464d-bb14-2da7167b8fc2", "record_id": "flaws_cloudtrail:0000451:15a4a09f-e485-464d-bb14-2da7167b8fc2", "row_index": 451, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15a4a09f-e485-464d-bb14-2da7167b8fc2", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "233429df8-deb2-4054-91c6-8f8ac8831dfd", "record_id": "flaws_cloudtrail:0000452:233429df8-deb2-4054-91c6-8f8ac8831dfd", "row_index": 452, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "233429df8-deb2-4054-91c6-8f8ac8831dfd", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25e3ad9d-d743-42ab-a18b-fcadf1e80702", "record_id": "flaws_cloudtrail:0000453:25e3ad9d-d743-42ab-a18b-fcadf1e80702", "row_index": 453, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25e3ad9d-d743-42ab-a18b-fcadf1e80702", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "record_id": "flaws_cloudtrail:0000454:44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "row_index": 454, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44a1bd75-16d4-44d5-b0b6-26c3bff3c7a9", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d1b65cb-e96c-4563-9772-1475b0eb9e22", "record_id": "flaws_cloudtrail:0000455:0d1b65cb-e96c-4563-9772-1475b0eb9e22", "row_index": 455, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d1b65cb-e96c-4563-9772-1475b0eb9e22", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f178898-3ce0-491c-9d34-ba16c5af7616", "record_id": "flaws_cloudtrail:0000456:f178898-3ce0-491c-9d34-ba16c5af7616", "row_index": 456, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f178898-3ce0-491c-9d34-ba16c5af7616", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4035bbae-7d2d-413f-8688-0892e2a5ffae", "record_id": "flaws_cloudtrail:0000457:4035bbae-7d2d-413f-8688-0892e2a5ffae", "row_index": 457, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4035bbae-7d2d-413f-8688-0892e2a5ffae", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f212d0af-7235-4a78-b719-49025a5", "record_id": "flaws_cloudtrail:0000458:f212d0af-7235-4a78-b719-49025a5", "row_index": 458, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f212d0af-7235-4a78-b719-49025a5", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea3525c6-71e5-45e1-bc5b-f26255a58b77", "record_id": "flaws_cloudtrail:0000459:ea3525c6-71e5-45e1-bc5b-f26255a58b77", "row_index": 459, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea3525c6-71e5-45e1-bc5b-f26255a58b77", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c1b69fe-ccce-4ac1-9871-f5955d632df5", "record_id": "flaws_cloudtrail:0000460:7c1b69fe-ccce-4ac1-9871-f5955d632df5", "row_index": 460, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c1b69fe-ccce-4ac1-9871-f5955d632df5", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c63b68d-963a-4e70-aaae-e0f51187a612", "record_id": "flaws_cloudtrail:0000461:4c63b68d-963a-4e70-aaae-e0f51187a612", "row_index": 461, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c63b68d-963a-4e70-aaae-e0f51187a612", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "record_id": "flaws_cloudtrail:0000462:a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "row_index": 462, "timestamp": "2019-03-01T00:20:19Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8c95d05-3a14-48d2-84c7-8e2d74ebe6c0", "eventTime": "2019-03-01T00:20:19Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "606f3b99-e511-41b8-848b-6fd427dee64b", "record_id": "flaws_cloudtrail:0000463:606f3b99-e511-41b8-848b-6fd427dee64b", "row_index": 463, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "606f3b99-e511-41b8-848b-6fd427dee64b", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "851951d5-31e0-4eb5-ad72-47d46fa9edf4", "record_id": "flaws_cloudtrail:0000464:851951d5-31e0-4eb5-ad72-47d46fa9edf4", "row_index": 464, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "851951d5-31e0-4eb5-ad72-47d46fa9edf4", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4210f68-33f3-418c-83a4-471eee088997", "record_id": "flaws_cloudtrail:0000465:e4210f68-33f3-418c-83a4-471eee088997", "row_index": 465, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4210f68-33f3-418c-83a4-471eee088997", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f1ef18c-70e7-4665-a522-c140561c8bae", "record_id": "flaws_cloudtrail:0000466:9f1ef18c-70e7-4665-a522-c140561c8bae", "row_index": 466, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f1ef18c-70e7-4665-a522-c140561c8bae", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "708fa857-f29c-481a-bb2d-6a73b5d214b1", "record_id": "flaws_cloudtrail:0000467:708fa857-f29c-481a-bb2d-6a73b5d214b1", "row_index": 467, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "708fa857-f29c-481a-bb2d-6a73b5d214b1", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "record_id": "flaws_cloudtrail:0000468:ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "row_index": 468, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7c82b38-914d-46f8-9897-113b967d6229", "record_id": "flaws_cloudtrail:0000469:a7c82b38-914d-46f8-9897-113b967d6229", "row_index": 469, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7c82b38-914d-46f8-9897-113b967d6229", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "record_id": "flaws_cloudtrail:0000470:5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "row_index": 470, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e297768-c0da-459c-8aff-389c5825db62", "record_id": "flaws_cloudtrail:0000471:e297768-c0da-459c-8aff-389c5825db62", "row_index": 471, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e297768-c0da-459c-8aff-389c5825db62", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c7f0956-467c-4685-b96f-8f8b0faca91b", "record_id": "flaws_cloudtrail:0000472:0c7f0956-467c-4685-b96f-8f8b0faca91b", "row_index": 472, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c7f0956-467c-4685-b96f-8f8b0faca91b", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a80094-0f49-4407-9a9c-070eec365a26", "record_id": "flaws_cloudtrail:0000473:9a80094-0f49-4407-9a9c-070eec365a26", "row_index": 473, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a80094-0f49-4407-9a9c-070eec365a26", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d557342-e26c-47a6-a91b-920dda589570", "record_id": "flaws_cloudtrail:0000474:8d557342-e26c-47a6-a91b-920dda589570", "row_index": 474, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d557342-e26c-47a6-a91b-920dda589570", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "record_id": "flaws_cloudtrail:0000475:8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "row_index": 475, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09935fa3-be88-4a6f-b61a-1cb1afd5539a", "record_id": "flaws_cloudtrail:0000476:09935fa3-be88-4a6f-b61a-1cb1afd5539a", "row_index": 476, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09935fa3-be88-4a6f-b61a-1cb1afd5539a", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "record_id": "flaws_cloudtrail:0000477:1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "row_index": 477, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "585a9e91-9dad-4a7c-9811-0e4d947c36cd", "record_id": "flaws_cloudtrail:0000478:585a9e91-9dad-4a7c-9811-0e4d947c36cd", "row_index": 478, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "585a9e91-9dad-4a7c-9811-0e4d947c36cd", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "userData"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e67677-0e35-430b-970d-1f19a0a7e7e5", "record_id": "flaws_cloudtrail:0000479:e67677-0e35-430b-970d-1f19a0a7e7e5", "row_index": 479, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e67677-0e35-430b-970d-1f19a0a7e7e5", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "606f3b99-e511-41b8-848b-6fd427dee64b", "record_id": "flaws_cloudtrail:0000480:606f3b99-e511-41b8-848b-6fd427dee64b", "row_index": 480, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "606f3b99-e511-41b8-848b-6fd427dee64b", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "851951d5-31e0-4eb5-ad72-47d46fa9edf4", "record_id": "flaws_cloudtrail:0000481:851951d5-31e0-4eb5-ad72-47d46fa9edf4", "row_index": 481, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "851951d5-31e0-4eb5-ad72-47d46fa9edf4", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4210f68-33f3-418c-83a4-471eee088997", "record_id": "flaws_cloudtrail:0000482:e4210f68-33f3-418c-83a4-471eee088997", "row_index": 482, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4210f68-33f3-418c-83a4-471eee088997", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f1ef18c-70e7-4665-a522-c140561c8bae", "record_id": "flaws_cloudtrail:0000483:9f1ef18c-70e7-4665-a522-c140561c8bae", "row_index": 483, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f1ef18c-70e7-4665-a522-c140561c8bae", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "708fa857-f29c-481a-bb2d-6a73b5d214b1", "record_id": "flaws_cloudtrail:0000484:708fa857-f29c-481a-bb2d-6a73b5d214b1", "row_index": 484, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "708fa857-f29c-481a-bb2d-6a73b5d214b1", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "record_id": "flaws_cloudtrail:0000485:ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "row_index": 485, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea1bdb2a-b5c2-4002-9863-11d0c8ae8211", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7c82b38-914d-46f8-9897-113b967d6229", "record_id": "flaws_cloudtrail:0000486:a7c82b38-914d-46f8-9897-113b967d6229", "row_index": 486, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7c82b38-914d-46f8-9897-113b967d6229", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "record_id": "flaws_cloudtrail:0000487:5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "row_index": 487, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ab8ffda-cdcd-4cee-8776-ad5e1c8778a1", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e297768-c0da-459c-8aff-389c5825db62", "record_id": "flaws_cloudtrail:0000488:e297768-c0da-459c-8aff-389c5825db62", "row_index": 488, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e297768-c0da-459c-8aff-389c5825db62", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c7f0956-467c-4685-b96f-8f8b0faca91b", "record_id": "flaws_cloudtrail:0000489:0c7f0956-467c-4685-b96f-8f8b0faca91b", "row_index": 489, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c7f0956-467c-4685-b96f-8f8b0faca91b", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a80094-0f49-4407-9a9c-070eec365a26", "record_id": "flaws_cloudtrail:0000490:9a80094-0f49-4407-9a9c-070eec365a26", "row_index": 490, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a80094-0f49-4407-9a9c-070eec365a26", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d557342-e26c-47a6-a91b-920dda589570", "record_id": "flaws_cloudtrail:0000491:8d557342-e26c-47a6-a91b-920dda589570", "row_index": 491, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d557342-e26c-47a6-a91b-920dda589570", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "record_id": "flaws_cloudtrail:0000492:8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "row_index": 492, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c5fc2a1-a06b-4af3-ad5c-6c492eacbbf0", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09935fa3-be88-4a6f-b61a-1cb1afd5539a", "record_id": "flaws_cloudtrail:0000493:09935fa3-be88-4a6f-b61a-1cb1afd5539a", "row_index": 493, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09935fa3-be88-4a6f-b61a-1cb1afd5539a", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "record_id": "flaws_cloudtrail:0000494:1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "row_index": 494, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d6ce5e5-a937-4aa6-aa0b-509c014923ea", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "585a9e91-9dad-4a7c-9811-0e4d947c36cd", "record_id": "flaws_cloudtrail:0000495:585a9e91-9dad-4a7c-9811-0e4d947c36cd", "row_index": 495, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeInstanceAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "585a9e91-9dad-4a7c-9811-0e4d947c36cd", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeInstanceAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"instanceId": "i-aa2d3b42e5c6e801a", "attribute": "userData"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e67677-0e35-430b-970d-1f19a0a7e7e5", "record_id": "flaws_cloudtrail:0000496:e67677-0e35-430b-970d-1f19a0a7e7e5", "row_index": 496, "timestamp": "2019-03-01T00:20:20Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e67677-0e35-430b-970d-1f19a0a7e7e5", "eventTime": "2019-03-01T00:20:20Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "493720ed-552c-4648-a712-d65433c6bbf", "record_id": "flaws_cloudtrail:0000497:493720ed-552c-4648-a712-d65433c6bbf", "row_index": 497, "timestamp": "2019-03-01T00:20:21Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "493720ed-552c-4648-a712-d65433c6bbf", "eventTime": "2019-03-01T00:20:21Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "record_id": "flaws_cloudtrail:0000498:ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "row_index": 498, "timestamp": "2019-03-01T00:20:21Z", "event_type": "ListHostedZones", "event_source": "route53.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "eventTime": "2019-03-01T00:20:21Z", "eventName": "ListHostedZones", "eventSource": "route53.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b01772-3406-4c70-805c-7c16737f5b97", "record_id": "flaws_cloudtrail:0000499:2b01772-3406-4c70-805c-7c16737f5b97", "row_index": 499, "timestamp": "2019-03-01T00:20:21Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b01772-3406-4c70-805c-7c16737f5b97", "eventTime": "2019-03-01T00:20:21Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a17f24d2-e9bb-4e82-8b0b-080b45890c81", "record_id": "flaws_cloudtrail:0000500:a17f24d2-e9bb-4e82-8b0b-080b45890c81", "row_index": 500, "timestamp": "2019-03-01T00:20:21Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a17f24d2-e9bb-4e82-8b0b-080b45890c81", "eventTime": "2019-03-01T00:20:21Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "493720ed-552c-4648-a712-d65433c6bbf", "record_id": "flaws_cloudtrail:0000501:493720ed-552c-4648-a712-d65433c6bbf", "row_index": 501, "timestamp": "2019-03-01T00:20:21Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "493720ed-552c-4648-a712-d65433c6bbf", "eventTime": "2019-03-01T00:20:21Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "record_id": "flaws_cloudtrail:0000502:ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "row_index": 502, "timestamp": "2019-03-01T00:20:21Z", "event_type": "ListHostedZones", "event_source": "route53.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 2, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac691dcb-cf25-4e2d-99cc-6931688a9fa9", "eventTime": "2019-03-01T00:20:21Z", "eventName": "ListHostedZones", "eventSource": "route53.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b01772-3406-4c70-805c-7c16737f5b97", "record_id": "flaws_cloudtrail:0000503:2b01772-3406-4c70-805c-7c16737f5b97", "row_index": 503, "timestamp": "2019-03-01T00:20:21Z", "event_type": "GenerateCredentialReport", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b01772-3406-4c70-805c-7c16737f5b97", "eventTime": "2019-03-01T00:20:21Z", "eventName": "GenerateCredentialReport", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a17f24d2-e9bb-4e82-8b0b-080b45890c81", "record_id": "flaws_cloudtrail:0000504:a17f24d2-e9bb-4e82-8b0b-080b45890c81", "row_index": 504, "timestamp": "2019-03-01T00:20:21Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a17f24d2-e9bb-4e82-8b0b-080b45890c81", "eventTime": "2019-03-01T00:20:21Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "005a0c81-cd51-454f-a837-7f1f971f80e7", "record_id": "flaws_cloudtrail:0000505:005a0c81-cd51-454f-a837-7f1f971f80e7", "row_index": 505, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "005a0c81-cd51-454f-a837-7f1f971f80e7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "record_id": "flaws_cloudtrail:0000506:d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "row_index": 506, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a5adca5-500d-40f3-a437-b3ea42ab0277", "record_id": "flaws_cloudtrail:0000507:0a5adca5-500d-40f3-a437-b3ea42ab0277", "row_index": 507, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a5adca5-500d-40f3-a437-b3ea42ab0277", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd57f02f-ebe4-499d-b598-fb25242f84c", "record_id": "flaws_cloudtrail:0000508:fd57f02f-ebe4-499d-b598-fb25242f84c", "row_index": 508, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd57f02f-ebe4-499d-b598-fb25242f84c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "record_id": "flaws_cloudtrail:0000509:7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "row_index": 509, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "record_id": "flaws_cloudtrail:0000510:6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "row_index": 510, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetLoginProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetLoginProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f1f1d83-d480-44c3-8fd5-093ed986955", "record_id": "flaws_cloudtrail:0000511:5f1f1d83-d480-44c3-8fd5-093ed986955", "row_index": 511, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f1f1d83-d480-44c3-8fd5-093ed986955", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "config-role-us-west-2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b24167-f19f-4cb6-8416-052e3588d492", "record_id": "flaws_cloudtrail:0000512:7b24167-f19f-4cb6-8416-052e3588d492", "row_index": 512, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b24167-f19f-4cb6-8416-052e3588d492", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "config-role-us-west-2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cced6718-de70-4042-9124-acf5a3cd9e58", "record_id": "flaws_cloudtrail:0000513:cced6718-de70-4042-9124-acf5a3cd9e58", "row_index": 513, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cced6718-de70-4042-9124-acf5a3cd9e58", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92f36d15-9873-4f95-ab3d-06f27dea7bbc", "record_id": "flaws_cloudtrail:0000514:92f36d15-9873-4f95-ab3d-06f27dea7bbc", "row_index": 514, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92f36d15-9873-4f95-ab3d-06f27dea7bbc", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56cba9da-b577-4f51-bebb-90f61ec7ccde", "record_id": "flaws_cloudtrail:0000515:56cba9da-b577-4f51-bebb-90f61ec7ccde", "row_index": 515, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56cba9da-b577-4f51-bebb-90f61ec7ccde", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "record_id": "flaws_cloudtrail:0000516:1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "row_index": 516, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "SummitRouteAdditionalViewPrivileges", "roleName": "SummitRouteAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "record_id": "flaws_cloudtrail:0000517:e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "row_index": 517, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SummitRouteAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "record_id": "flaws_cloudtrail:0000518:f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "row_index": 518, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForSupport"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4265f323-3935-4090-8224-4d2e5e8f0214", "record_id": "flaws_cloudtrail:0000519:4265f323-3935-4090-8224-4d2e5e8f0214", "row_index": 519, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4265f323-3935-4090-8224-4d2e5e8f0214", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForCloudTrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5df8a696-a04e-428b-9c0d-4e2c2957716c", "record_id": "flaws_cloudtrail:0000520:5df8a696-a04e-428b-9c0d-4e2c2957716c", "row_index": 520, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5df8a696-a04e-428b-9c0d-4e2c2957716c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForCloudTrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "739ac38b-76a9-4141-b5a9-dfc1b11cceed", "record_id": "flaws_cloudtrail:0000521:739ac38b-76a9-4141-b5a9-dfc1b11cceed", "row_index": 521, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "739ac38b-76a9-4141-b5a9-dfc1b11cceed", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "027202a6f-7ac7-497f-8b05-7bd70c03709", "record_id": "flaws_cloudtrail:0000522:027202a6f-7ac7-497f-8b05-7bd70c03709", "row_index": 522, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 675, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "027202a6f-7ac7-497f-8b05-7bd70c03709", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c30d76cf-6afc-4d6d-96c0-64986ad2a412", "record_id": "flaws_cloudtrail:0000523:c30d76cf-6afc-4d6d-96c0-64986ad2a412", "row_index": 523, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c30d76cf-6afc-4d6d-96c0-64986ad2a412", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "record_id": "flaws_cloudtrail:0000524:e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "row_index": 524, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01c0e19a-6de5-4284-9b1a-471a3182e390", "record_id": "flaws_cloudtrail:0000525:01c0e19a-6de5-4284-9b1a-471a3182e390", "row_index": 525, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01c0e19a-6de5-4284-9b1a-471a3182e390", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"scope": "Local", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48f0e57c-d429-47bf-9fea-d83a900c2ccf", "record_id": "flaws_cloudtrail:0000526:48f0e57c-d429-47bf-9fea-d83a900c2ccf", "row_index": 526, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48f0e57c-d429-47bf-9fea-d83a900c2ccf", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b4b9871-5829-4505-934b-1ece4b129ac7", "record_id": "flaws_cloudtrail:0000527:8b4b9871-5829-4505-934b-1ece4b129ac7", "row_index": 527, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b4b9871-5829-4505-934b-1ece4b129ac7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d47892-0022-4423-9925-23b1979c1b6d", "record_id": "flaws_cloudtrail:0000528:1d47892-0022-4423-9925-23b1979c1b6d", "row_index": 528, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d47892-0022-4423-9925-23b1979c1b6d", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ee9fc2c-6e9b-4626-b693-1949d52eb317", "record_id": "flaws_cloudtrail:0000529:9ee9fc2c-6e9b-4626-b693-1949d52eb317", "row_index": 529, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ee9fc2c-6e9b-4626-b693-1949d52eb317", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "read_level_6_bucket", "roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4b05bfa-a930-4757-a4fc-a2391567d541", "record_id": "flaws_cloudtrail:0000530:b4b05bfa-a930-4757-a4fc-a2391567d541", "row_index": 530, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4b05bfa-a930-4757-a4fc-a2391567d541", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af0cd24d-6900-4061-a999-a815a1a8693f", "record_id": "flaws_cloudtrail:0000531:af0cd24d-6900-4061-a999-a815a1a8693f", "row_index": 531, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af0cd24d-6900-4061-a999-a815a1a8693f", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6996b58c-9aeb-40a6-b1eb-323031782322", "record_id": "flaws_cloudtrail:0000532:6996b58c-9aeb-40a6-b1eb-323031782322", "row_index": 532, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6996b58c-9aeb-40a6-b1eb-323031782322", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbb78bdf-43a8-49b1-b23e-12372941fe87", "record_id": "flaws_cloudtrail:0000533:bbb78bdf-43a8-49b1-b23e-12372941fe87", "row_index": 533, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbb78bdf-43a8-49b1-b23e-12372941fe87", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "record_id": "flaws_cloudtrail:0000534:ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "row_index": 534, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForOrganizations"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "record_id": "flaws_cloudtrail:0000535:ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "row_index": 535, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb1e17ed-ff94-4dca-85c6-050221b9610", "record_id": "flaws_cloudtrail:0000536:cb1e17ed-ff94-4dca-85c6-050221b9610", "row_index": 536, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb1e17ed-ff94-4dca-85c6-050221b9610", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61d53249-017b-44d1-aa50-2c1aab8db560", "record_id": "flaws_cloudtrail:0000537:61d53249-017b-44d1-aa50-2c1aab8db560", "row_index": 537, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61d53249-017b-44d1-aa50-2c1aab8db560", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForSupport"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16ce5b3e-339b-45b4-8e32-efbc17a16f35", "record_id": "flaws_cloudtrail:0000538:16ce5b3e-339b-45b4-8e32-efbc17a16f35", "row_index": 538, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16ce5b3e-339b-45b4-8e32-efbc17a16f35", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": true}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "record_id": "flaws_cloudtrail:0000539:623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "row_index": 539, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6681ed55-9927-4dc0-86fa-773f78309088", "record_id": "flaws_cloudtrail:0000540:6681ed55-9927-4dc0-86fa-773f78309088", "row_index": 540, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6681ed55-9927-4dc0-86fa-773f78309088", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70cda9bd-7568-4cd9-a186-f631238c3ef", "record_id": "flaws_cloudtrail:0000541:70cda9bd-7568-4cd9-a186-f631238c3ef", "row_index": 541, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70cda9bd-7568-4cd9-a186-f631238c3ef", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "record_id": "flaws_cloudtrail:0000542:58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "row_index": 542, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37248bb8-8fbc-4247-a119-a79bb134a29a", "record_id": "flaws_cloudtrail:0000543:37248bb8-8fbc-4247-a119-a79bb134a29a", "row_index": 543, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37248bb8-8fbc-4247-a119-a79bb134a29a", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForOrganizations"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5bbd77c9-7184-4128-b934-4a4f3f69e83c", "record_id": "flaws_cloudtrail:0000544:5bbd77c9-7184-4128-b934-4a4f3f69e83c", "row_index": 544, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetLoginProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5bbd77c9-7184-4128-b934-4a4f3f69e83c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetLoginProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "Login Profile for User Level6 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "005a0c81-cd51-454f-a837-7f1f971f80e7", "record_id": "flaws_cloudtrail:0000545:005a0c81-cd51-454f-a837-7f1f971f80e7", "row_index": 545, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "005a0c81-cd51-454f-a837-7f1f971f80e7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "record_id": "flaws_cloudtrail:0000546:d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "row_index": 546, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7f6c066-42e5-4aa3-bee6-4b8fdf074cdb", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a5adca5-500d-40f3-a437-b3ea42ab0277", "record_id": "flaws_cloudtrail:0000547:0a5adca5-500d-40f3-a437-b3ea42ab0277", "row_index": 547, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a5adca5-500d-40f3-a437-b3ea42ab0277", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd57f02f-ebe4-499d-b598-fb25242f84c", "record_id": "flaws_cloudtrail:0000548:fd57f02f-ebe4-499d-b598-fb25242f84c", "row_index": 548, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd57f02f-ebe4-499d-b598-fb25242f84c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "record_id": "flaws_cloudtrail:0000549:7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "row_index": 549, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fa7fc3f-0e6b-4ad7-b6fe-5fbd38590e5d", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "record_id": "flaws_cloudtrail:0000550:6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "row_index": 550, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetLoginProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f1f59da-48b9-4361-9b89-9b5b0c6ef147", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetLoginProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f1f1d83-d480-44c3-8fd5-093ed986955", "record_id": "flaws_cloudtrail:0000551:5f1f1d83-d480-44c3-8fd5-093ed986955", "row_index": 551, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f1f1d83-d480-44c3-8fd5-093ed986955", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "config-role-us-west-2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b24167-f19f-4cb6-8416-052e3588d492", "record_id": "flaws_cloudtrail:0000552:7b24167-f19f-4cb6-8416-052e3588d492", "row_index": 552, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b24167-f19f-4cb6-8416-052e3588d492", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "config-role-us-west-2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cced6718-de70-4042-9124-acf5a3cd9e58", "record_id": "flaws_cloudtrail:0000553:cced6718-de70-4042-9124-acf5a3cd9e58", "row_index": 553, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cced6718-de70-4042-9124-acf5a3cd9e58", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92f36d15-9873-4f95-ab3d-06f27dea7bbc", "record_id": "flaws_cloudtrail:0000554:92f36d15-9873-4f95-ab3d-06f27dea7bbc", "row_index": 554, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92f36d15-9873-4f95-ab3d-06f27dea7bbc", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56cba9da-b577-4f51-bebb-90f61ec7ccde", "record_id": "flaws_cloudtrail:0000555:56cba9da-b577-4f51-bebb-90f61ec7ccde", "row_index": 555, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56cba9da-b577-4f51-bebb-90f61ec7ccde", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "record_id": "flaws_cloudtrail:0000556:1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "row_index": 556, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1aed16bf-b9ed-4fc7-a0ee-e7d5351480db", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "SummitRouteAdditionalViewPrivileges", "roleName": "SummitRouteAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "record_id": "flaws_cloudtrail:0000557:e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "row_index": 557, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7ed1bc3-9899-4e01-bd78-2cc7846d9aaf", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "SummitRouteAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "record_id": "flaws_cloudtrail:0000558:f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "row_index": 558, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3f812991-fa85-4dd8-acb2-887a8c71ba1b", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForSupport"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4265f323-3935-4090-8224-4d2e5e8f0214", "record_id": "flaws_cloudtrail:0000559:4265f323-3935-4090-8224-4d2e5e8f0214", "row_index": 559, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4265f323-3935-4090-8224-4d2e5e8f0214", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForCloudTrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5df8a696-a04e-428b-9c0d-4e2c2957716c", "record_id": "flaws_cloudtrail:0000560:5df8a696-a04e-428b-9c0d-4e2c2957716c", "row_index": 560, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5df8a696-a04e-428b-9c0d-4e2c2957716c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForCloudTrail"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "739ac38b-76a9-4141-b5a9-dfc1b11cceed", "record_id": "flaws_cloudtrail:0000561:739ac38b-76a9-4141-b5a9-dfc1b11cceed", "row_index": 561, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "739ac38b-76a9-4141-b5a9-dfc1b11cceed", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "027202a6f-7ac7-497f-8b05-7bd70c03709", "record_id": "flaws_cloudtrail:0000562:027202a6f-7ac7-497f-8b05-7bd70c03709", "row_index": 562, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 675, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "027202a6f-7ac7-497f-8b05-7bd70c03709", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c30d76cf-6afc-4d6d-96c0-64986ad2a412", "record_id": "flaws_cloudtrail:0000563:c30d76cf-6afc-4d6d-96c0-64986ad2a412", "row_index": 563, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c30d76cf-6afc-4d6d-96c0-64986ad2a412", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "record_id": "flaws_cloudtrail:0000564:e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "row_index": 564, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e75d2fef-db7c-4a75-8691-7d60a19e3f9c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01c0e19a-6de5-4284-9b1a-471a3182e390", "record_id": "flaws_cloudtrail:0000565:01c0e19a-6de5-4284-9b1a-471a3182e390", "row_index": 565, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01c0e19a-6de5-4284-9b1a-471a3182e390", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"scope": "Local", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48f0e57c-d429-47bf-9fea-d83a900c2ccf", "record_id": "flaws_cloudtrail:0000566:48f0e57c-d429-47bf-9fea-d83a900c2ccf", "row_index": 566, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48f0e57c-d429-47bf-9fea-d83a900c2ccf", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b4b9871-5829-4505-934b-1ece4b129ac7", "record_id": "flaws_cloudtrail:0000567:8b4b9871-5829-4505-934b-1ece4b129ac7", "row_index": 567, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b4b9871-5829-4505-934b-1ece4b129ac7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d47892-0022-4423-9925-23b1979c1b6d", "record_id": "flaws_cloudtrail:0000568:1d47892-0022-4423-9925-23b1979c1b6d", "row_index": 568, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d47892-0022-4423-9925-23b1979c1b6d", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ee9fc2c-6e9b-4626-b693-1949d52eb317", "record_id": "flaws_cloudtrail:0000569:9ee9fc2c-6e9b-4626-b693-1949d52eb317", "row_index": 569, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 729, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ee9fc2c-6e9b-4626-b693-1949d52eb317", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "read_level_6_bucket", "roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4b05bfa-a930-4757-a4fc-a2391567d541", "record_id": "flaws_cloudtrail:0000570:b4b05bfa-a930-4757-a4fc-a2391567d541", "row_index": 570, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4b05bfa-a930-4757-a4fc-a2391567d541", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af0cd24d-6900-4061-a999-a815a1a8693f", "record_id": "flaws_cloudtrail:0000571:af0cd24d-6900-4061-a999-a815a1a8693f", "row_index": 571, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af0cd24d-6900-4061-a999-a815a1a8693f", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6996b58c-9aeb-40a6-b1eb-323031782322", "record_id": "flaws_cloudtrail:0000572:6996b58c-9aeb-40a6-b1eb-323031782322", "row_index": 572, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 821, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6996b58c-9aeb-40a6-b1eb-323031782322", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-d306bccd-4ecb-4557-a96f-9dbc7460dddc", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbb78bdf-43a8-49b1-b23e-12372941fe87", "record_id": "flaws_cloudtrail:0000573:bbb78bdf-43a8-49b1-b23e-12372941fe87", "row_index": 573, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbb78bdf-43a8-49b1-b23e-12372941fe87", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "record_id": "flaws_cloudtrail:0000574:ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "row_index": 574, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab6ad51d-8c71-4bf9-aa1a-75bd8ae1fe86", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForOrganizations"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "record_id": "flaws_cloudtrail:0000575:ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "row_index": 575, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff9b6fdc-b528-4d5e-a2f9-451a1ef56563", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb1e17ed-ff94-4dca-85c6-050221b9610", "record_id": "flaws_cloudtrail:0000576:cb1e17ed-ff94-4dca-85c6-050221b9610", "row_index": 576, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb1e17ed-ff94-4dca-85c6-050221b9610", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3", "versionId": "v10"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61d53249-017b-44d1-aa50-2c1aab8db560", "record_id": "flaws_cloudtrail:0000577:61d53249-017b-44d1-aa50-2c1aab8db560", "row_index": 577, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61d53249-017b-44d1-aa50-2c1aab8db560", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForSupport"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16ce5b3e-339b-45b4-8e32-efbc17a16f35", "record_id": "flaws_cloudtrail:0000578:16ce5b3e-339b-45b4-8e32-efbc17a16f35", "row_index": 578, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16ce5b3e-339b-45b4-8e32-efbc17a16f35", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": true}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "record_id": "flaws_cloudtrail:0000579:623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "row_index": 579, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 820, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "623d5d2a-a1f9-4f9f-8ff2-a92ee50250fc", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-4e23caa8-1f82-45b5-9068-3200fb1a0c7a", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6681ed55-9927-4dc0-86fa-773f78309088", "record_id": "flaws_cloudtrail:0000580:6681ed55-9927-4dc0-86fa-773f78309088", "row_index": 580, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6681ed55-9927-4dc0-86fa-773f78309088", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "piper"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70cda9bd-7568-4cd9-a186-f631238c3ef", "record_id": "flaws_cloudtrail:0000581:70cda9bd-7568-4cd9-a186-f631238c3ef", "row_index": 581, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70cda9bd-7568-4cd9-a186-f631238c3ef", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "record_id": "flaws_cloudtrail:0000582:58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "row_index": 582, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListGroupsForUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58a1fe64-fa65-4192-b129-fe3e02f6e5a7", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListGroupsForUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37248bb8-8fbc-4247-a119-a79bb134a29a", "record_id": "flaws_cloudtrail:0000583:37248bb8-8fbc-4247-a119-a79bb134a29a", "row_index": 583, "timestamp": "2019-03-01T00:20:22Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37248bb8-8fbc-4247-a119-a79bb134a29a", "eventTime": "2019-03-01T00:20:22Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForOrganizations"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5bbd77c9-7184-4128-b934-4a4f3f69e83c", "record_id": "flaws_cloudtrail:0000584:5bbd77c9-7184-4128-b934-4a4f3f69e83c", "row_index": 584, "timestamp": "2019-03-01T00:20:22Z", "event_type": "GetLoginProfile", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5bbd77c9-7184-4128-b934-4a4f3f69e83c", "eventTime": "2019-03-01T00:20:22Z", "eventName": "GetLoginProfile", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "Login Profile for User Level6 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ecb1f10-22e9-401c-b91f-872f422cc956", "record_id": "flaws_cloudtrail:0000585:6ecb1f10-22e9-401c-b91f-872f422cc956", "row_index": 585, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ecb1f10-22e9-401c-b91f-872f422cc956", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"roleName": "AWSServiceRoleForTrustedAdvisor"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "828c87b7-0efb-463b-8b54-d92380f1f6a3", "record_id": "flaws_cloudtrail:0000586:828c87b7-0efb-463b-8b54-d92380f1f6a3", "row_index": 586, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "828c87b7-0efb-463b-8b54-d92380f1f6a3", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonAthenaFullAccess"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d6b4de8-3ec1-4da1-a805-0baabcebf36d", "record_id": "flaws_cloudtrail:0000587:4d6b4de8-3ec1-4da1-a805-0baabcebf36d", "row_index": 587, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d6b4de8-3ec1-4da1-a805-0baabcebf36d", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkeyPerms", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a5ae2b8-1c46-4270-b8a3-9c0cd925448d", "record_id": "flaws_cloudtrail:0000588:6a5ae2b8-1c46-4270-b8a3-9c0cd925448d", "row_index": 588, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a5ae2b8-1c46-4270-b8a3-9c0cd925448d", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AdministratorAccess"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1dda57f3-38d8-4b26-be92-f60fb1d1ae62", "record_id": "flaws_cloudtrail:0000589:1dda57f3-38d8-4b26-be92-f60fb1d1ae62", "row_index": 589, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1dda57f3-38d8-4b26-be92-f60fb1d1ae62", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/AWSLambdaBasicExecutionRole-b6ab3a24-1aa4-4855-94d4-40cdef59ec5b"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d73abeaa-961a-42cd-99a0-8f8f0aa2ae20", "record_id": "flaws_cloudtrail:0000590:d73abeaa-961a-42cd-99a0-8f8f0aa2ae20", "row_index": 590, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetRolePolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d73abeaa-961a-42cd-99a0-8f8f0aa2ae20", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetRolePolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyName": "SummitRouteLogAccess", "roleName": "SummitRouteAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22dcc3b9-fb7c-4380-b81d-d6d23b3166e7", "record_id": "flaws_cloudtrail:0000591:22dcc3b9-fb7c-4380-b81d-d6d23b3166e7", "row_index": 591, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22dcc3b9-fb7c-4380-b81d-d6d23b3166e7", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkeyPerms"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fecd5a12-acc3-4707-9ab6-ba37b9c7446e", "record_id": "flaws_cloudtrail:0000592:fecd5a12-acc3-4707-9ab6-ba37b9c7446e", "row_index": 592, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fecd5a12-acc3-4707-9ab6-ba37b9c7446e", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52ab6ce2-6413-4e6c-9bb4-08ffbb6b4d07", "record_id": "flaws_cloudtrail:0000593:52ab6ce2-6413-4e6c-9bb4-08ffbb6b4d07", "row_index": 593, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52ab6ce2-6413-4e6c-9bb4-08ffbb6b4d07", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/AmazonAthenaFullAccess", "versionId": "v5"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "340a5db9-7925-4f11-ac82-68806b2d7508", "record_id": "flaws_cloudtrail:0000594:340a5db9-7925-4f11-ac82-68806b2d7508", "row_index": 594, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "340a5db9-7925-4f11-ac82-68806b2d7508", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "393263be2-471d-4b8d-be63-b2c76e33f17a", "record_id": "flaws_cloudtrail:0000595:393263be2-471d-4b8d-be63-b2c76e33f17a", "row_index": 595, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 746, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "393263be2-471d-4b8d-be63-b2c76e33f17a", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/SecurityMonkey"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03717c-6dcf-4120-880c-fbfa144f1128", "record_id": "flaws_cloudtrail:0000596:03717c-6dcf-4120-880c-fbfa144f1128", "row_index": 596, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03717c-6dcf-4120-880c-fbfa144f1128", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/aws-service-role/AWSSupportServiceRolePolicy", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c185ae0-43b0-4676-a1c7-09f357fc6967", "record_id": "flaws_cloudtrail:0000597:8c185ae0-43b0-4676-a1c7-09f357fc6967", "row_index": 597, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c185ae0-43b0-4676-a1c7-09f357fc6967", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/aws-service-role/AWSOrganizationsServiceTrustPolicy", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b7bb2b4-dcb8-4cf5-8daf-1313e5f4477b", "record_id": "flaws_cloudtrail:0000598:6b7bb2b4-dcb8-4cf5-8daf-1313e5f4477b", "row_index": 598, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b7bb2b4-dcb8-4cf5-8daf-1313e5f4477b", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/aws-service-role/AWSTrustedAdvisorServiceRolePolicy", "versionId": "v5"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce4ce71a-2304-46f5-a3b3-0d36f0df9c2d", "record_id": "flaws_cloudtrail:0000599:ce4ce71a-2304-46f5-a3b3-0d36f0df9c2d", "row_index": 599, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce4ce71a-2304-46f5-a3b3-0d36f0df9c2d", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/service-role/AWSConfigRole", "versionId": "v22"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e4c406f-75c5-4532-8014-bc3a25d29685", "record_id": "flaws_cloudtrail:0000600:6e4c406f-75c5-4532-8014-bc3a25d29685", "row_index": 600, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e4c406f-75c5-4532-8014-bc3a25d29685", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/service-role/config-role-us-west-2_AWSConfigDeliveryPermissions_us-west-2", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba4bdc6b-78ff-4b3d-9059-a3af3aa027965", "record_id": "flaws_cloudtrail:0000601:ba4bdc6b-78ff-4b3d-9059-a3af3aa027965", "row_index": 601, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba4bdc6b-78ff-4b3d-9059-a3af3aa027965", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a152ad33-b616-48d6-b4ff-14ee5a39a4db", "record_id": "flaws_cloudtrail:0000602:a152ad33-b616-48d6-b4ff-14ee5a39a4db", "row_index": 602, "timestamp": "2019-03-01T00:20:23Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a152ad33-b616-48d6-b4ff-14ee5a39a4db", "eventTime": "2019-03-01T00:20:23Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v25"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3bcedac-f6d3-4c1b-ac55-769451cd76a33", "record_id": "flaws_cloudtrail:0000603:a3bcedac-f6d3-4c1b-ac55-769451cd76a33", "row_index": 603, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3bcedac-f6d3-4c1b-ac55-769451cd76a33", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/Level3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b0b331d-4143-41a1-9154-17ce2afe8208", "record_id": "flaws_cloudtrail:0000604:9b0b331d-4143-41a1-9154-17ce2afe8208", "row_index": 604, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b0b331d-4143-41a1-9154-17ce2afe8208", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d96995bb-f987-4716-b4d9-52ee30a7263c", "record_id": "flaws_cloudtrail:0000605:d96995bb-f987-4716-b4d9-52ee30a7263c", "row_index": 605, "timestamp": "2019-03-01T00:20:23Z", "event_type": "ListEntitiesForPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.251.168.5", "user_agent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d96995bb-f987-4716-b4d9-52ee30a7263c", "eventTime": "2019-03-01T00:20:23Z", "eventName": "ListEntitiesForPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.251.168.5", "userAgent": "Boto3/1.9.105 Python/2.7.16rc1 Linux/4.19.0-kali3-amd64 Botocore/1.12.105", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/aws-service-role/CloudTrailServiceRolePolicy"}, "resources": []}}